LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (http://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Wiped my usbdisk? /umount -l (http://www.linuxquestions.org/questions/linux-newbie-8/wiped-my-usbdisk-umount-l-620778/)

Rai42 02-13-2008 06:08 AM

Wiped my usbdisk? /umount -l
 
Hi, hope someone can help. I think I've just messed up big time. Typical case of someone fiddling around with something they don't really understand :(

I have a portable usb hard drive that I work off of as I just use whichever computer is available at work. Recently for some reason I haven't been able to unmount it with the /umount command - it gives the message that the device is busy. Anyway, googling for this problem I came across people advicing that you can 'lazy unmount' using the /umount -l command. Which I did and it worked. However this morning it looks like my usbdrive is empty! Can someone explain to me what I did and if it's at all recoverable? Does the /umount -l command actually wipe everything, or has something else gone wrong.

Help please, I've got a big deadline coming up - I'm pretty good about backing up stuff, but I've still lost more than I can afford to!
Rai

Rai42 02-13-2008 06:35 AM

Hmm, ok so apparently the data is still on it, but I just can't mount the device ... got people this end working on it for me too, but I'd still be interested to know exactly what /umount -l does and if anyone has any idea why it was saying the device was busy in the first place when I'd shut all programs down - is there a command I can type to find out what it was busy with?

Cheers for any help

bigrigdriver 02-13-2008 06:51 AM

Device busy -

If there are any reads/writes taking place, the device is busy.

If you were working from the command line and cd'd into a folder on the usb drive and didn't cd out of it, the device is busy.

If you have a file manager (such as konqueror) open and were perusing files on the usb drive, and didn't close the folders and move to some other folder not on the usb drive, the device is still busy.

With regard to the usb drive, have you tried running 'fsck -a /dev/sdxy' (where x and y represent the drive letter and partition number)? It may be necessary to run fsck more than once.

The most common method to unmount that I've seen used is: 'umount /dev/sdxy', or 'umount /mnt/sdxy' (as above, x and y are partition letters and numbers).

To find out what's keeping the drive busy, try 'lsof /dev/sdxy'.

Rai42 02-13-2008 07:22 AM

Thanks for your reply, that makes a lot of sense ... I've more than likely closed a file manager while still 'looking' at the usbdisk.

unSpawn 02-13-2008 07:26 AM

Quote:

Originally Posted by Rai42 (Post 3055469)
Does the /umount -l command actually wipe everything, or has something else gone wrong.

No, mount and umount don't wipe anything. When a filesystem is not unmounted properly it will have a "marking" which signals on the next access it needs checking first. Next time you get that ominous message you can find those apps and files using (fuser or) 'lsof -w -n +D/mountpoint' where "/mountpoint" is the place you mounted the USB disk.


Quote:

Originally Posted by Rai42 (Post 3055469)
if it's at all recoverable?

Unfortunately while restoring a filesystem back to working order fsck or chkdsk may choose to remove blocks it thinks are not in use (linked to a filename). If your prime concern is preserving information then you should make a copy before running fsck. Locate a partition with enough space to hold a copy of the disk, attach the disk and 'dd if=/dev/disk of=/mountpoint/filename.dd' where "/dev/disk" is the place the system allocated the device like /dev/sda, /dev/sdb and "/mountpoint/filename.dd" is the (arbitrary) name of a file on a mounted partition. Now if you attach the disk and 'fsck.vfat -lvn' it (provided it's FAT-something formatted) the output should show some errors that could be corrected. If it looks good you can run it without the '-n' flag and check if you have the data you seek. If that's not the case you should salvage what you must keep, restore the backup image 'dd of=/dev/disk if=/mountpoint/filename.dd' and run chkdsk. Again check if you have the data you seek and salvage what you must keep. Now restore the image once again so you can run photorec in a last attempt to carve files.

bigrigdriver 02-13-2008 07:26 AM

If you have closed the file manager, that should release the disk; it's only if the file manager is still open and you have a file or folder open on the disk that would show it as busy.


All times are GMT -5. The time now is 04:33 AM.