[SOLVED] Aborted journal and volume remounted read-only??

alunduil · 06-05-2010, 11:25 AM

I would guess that the first e2fsck you ran did that damage. That's why when you get an aborted journal you do _not_ run e2fsck first, you drop the journal. If I understand it correctly e2fsck tries to replay the aborted journal and then places the files in lost+found because of this.

Regards,

Alunduil

anon091 · 06-05-2010, 11:28 AM

So is there an easy or systematic way I can put those files back in there original locations? I've never dealt with lost and found before.

alunduil · 06-05-2010, 12:00 PM

Not that I'm aware of. It's based on the inode numbers as the references got lost. You can use file to determine what kind of file it is and then look at the contents to put it back but I don't know about any programmatic way to accomplish that.

Regards,

Alunduil

anon091 · 06-05-2010, 12:28 PM

So will the files have the original filename or will the subfolders be the same as the original location? I had to step away for a bit so can't look, just trying to see how easy or difficult this might be

alunduil · 06-05-2010, 01:34 PM

If I'm not mistaken it's because the directory entries got misplaced that the files are in the lost+found directory so the directory structure doesn't exist in lost+found. Just the files that didn't have any references. Once you do an ls on that directory you'll see if I'm correct.

Regards,

Alunduil

anon091 · 06-05-2010, 02:23 PM

When i do an ls in lost+found, all i see is those random inode names, which are guess are really files not folders for the most part. i guess i need to figure out how to do a ls that will only show me the folders it put in lost+found so i can cd into them and see what files are there. Then you were saying there is a way to tell what type of file all those files in there renamed with the inode name are?

alunduil · 06-05-2010, 02:35 PM

You can use the file command to try and determine what format a file is in but it doesn't tell you the file name. The file name was part of the directory entry (directories are a special filesystem structure that correlates file names to inodes). I have the feeling there are no directories in your lost+found but to find out run the following:

Code:

find . -type d -print

If that comes back with any results at all they are directories otherwise everything else is a file.

Regards,

Alunduil

anon091 · 06-05-2010, 02:41 PM

Thanks. there are quite a few directories in there, maybe they have some files still that I could use and put back to where they should be. But that means that the majority of whats in the root of lost+found are files, which now have meaningless names to what they meant before

Sounds like I'm kinda in a bad spot, right?

anon091 · 06-05-2010, 02:50 PM

or i wonder if i could copy all them to my windows machine and use thumbnail view to see if any of these are actual jpgs to eliminate some? i think most of the files on the volume were jpg's to start with, so i'm guessing quite a few are them.

alunduil · 06-05-2010, 02:55 PM

Good luck and if this happens again see what the outcome is if you don't start with the e2fsck.

Regards,

Alunduil

anon091 · 06-05-2010, 03:01 PM

Thanks again, i think my best bet is to copy them all to my Windows PC so i can sift through them with a GUI. Couldn't have fixed this without you, wish i wouldnt have done the e2fsck first, i thought since the journal "aborted" it wouldn't use it when doing the e2fsck since it knew it was bad. guess not!

anon091 · 06-05-2010, 03:02 PM

can i make a samba share to my lost+found folder temporarily, or will that cause problems on the server?

alunduil · 06-05-2010, 03:42 PM

I don't use samba or windows for that matter so I can't tell you. Hopefully, someone else will mention something or just try it and let us know as usual.

Regards,

Alunduil

anon091 · 06-11-2010, 08:49 AM

I was able to share it out and copy everything to my PC to sift through it. I was able to move some stuff back to where it needed to go. Thanks again for all your help Alunduil.