Recovering deleted files from Raid1 array

turkvu · 01-05-2015, 05:09 PM

Hi - have a Synology Diskstation with 3TB of pictures & movies on it. After carefully organizing all of it, I used a utility to prune empty directories...which deleted everything. I'd really like to recover the files w/ their original names (& hopefully directories) intact.

I've pulled one of the drives from the NAS and have it attached to my ubuntu 14.04 machine. The device shows up under the list of Disk Drives with a partition type of Linux RAID. I know that it was formatted with ext4

So far I've tried r-studio and was able to get files, but no names. I'm currently trying to use debugfs, but running into some issues.

When I type in:

Code:

sudo debug fs -c /dev/sdb5

I get the following:

Code:

no talloc stackframe at ../source3/param/loadparm.c:4864, leaking memory debugfs 1.42.9 (4-Feb-2014)
/dev/sdb5: Bad magic number in super-block while opening filesystem

Any ideas or alternate methods of retrieving these files would be much appreciated

unSpawn · 01-05-2015, 06:15 PM

Quote:

Originally Posted by turkvu

I'd really like to recover the files w/ their original names (..) intact.

Think of a file system as a tree with leaves: the directories are the branches and the files are the leaves. Deleting files means deleting the link between a file and where its metadata is stored. In short it's become Autumn: there the tree stands and all the leaves are on the ground. Since these are all images your best bet to salvage what's left is to reassemble the RAID, mount it readonly and then scan for and use IPTC / EXIF metadata.

turkvu · 01-05-2015, 09:13 PM

From the extundelete website:

Quote:

extundelete was the first program able to restore both the contents and the file name of a deleted file on an ext4 partition.

So it seems that it is possible...just looking for a little help. Here's where I am now -

I used mdadm to start the device - since it's raid1 I chose to start with 1 of the 2 devices, to be safe:

Code:

sudo mdadm --stop /dev/md0
sudo mdadm -A -R /dev/md0 /dev/sdb5

mdadm then reported that it had started /dev/md0 with 1 drive (out of 2)

I tried to unmount /dev/md0 - but the system told me it was not mounted.

I then ran extundelete

Code:

sudo extundelete /dev/md0 --restore-all

And got the following:

Code:

extundelete: failed to read-only open device "/dev/md0": Error code 2133571347

A quick search turned up this thread - which tells me:

Code:

Error code 2133571347 is  "EXT2_ET_BAD_MAGIC"
This means, there is no valid signature for the superblock.

either, the superblock is corrupt, then you can try to open the file system 
with help of the superblock copies. see options "-b blocknumber " an "-B 
blocksize"

or
You have made some wrong during the creation of the file system image.

or
You have created an image of the entire disk, not a copy of the file system.
In this case you must specify offset options for losetup.

I don't think my superblock is corrupt - but I'm stuck as to how to proceed.

On a whim I tried ext4magic - it gave me the following error:

Code:

Error 13 while opening filesystem

I'm stuck - any ideas to help me push forward?

robi1 · 01-07-2015, 01:45 PM

That you can not find the ext-superblock on the raid, can be several possible reasons.
# Superblock destroyed ----------unlikely
# Raid is partitioned ----------unlikely
# Raid redesigned and disregard the mdadm versions -------possible.
# On the RAID is LVM --------- likely

But I think, however you will not be successful with extundelete or ext4magic.

2 reasons:
# Use as a NAS and a huge numbers of files? the default journal size of 128M is too small to contain unerased inode copies after deleting all the files.

# Very possible: (often/always ?) Synology uses the 64-bit flag for all ext4 file systems. This is not the ext4 default setting for files systems <16TB. extundelete and ext4magic have no support for file restore from journal inode data if "64-bit" is set in the ext4 file system.

see some old posts:
http://sourceforge.net/p/extundelete...sage/32213239/
http://sourceforge.net/p/extundelete...sage/29988846/

robi1

turkvu · 01-07-2015, 04:33 PM

Quote:

Originally Posted by robi1

That you can not find the ext-superblock on the raid, can be several possible reasons.
# Superblock destroyed ----------unlikely
# Raid is partitioned ----------unlikely
# Raid redesigned and disregard the mdadm versions -------possible.
# On the RAID is LVM --------- likely

But I think, however you will not be successful with extundelete or ext4magic.

2 reasons:
# Use as a NAS and a huge numbers of files? the default journal size of 128M is too small to contain unerased inode copies after deleting all the files.

# Very possible: (often/always ?) Synology uses the 64-bit flag for all ext4 file systems. This is not the ext4 default setting for files systems <16TB. extundelete and ext4magic have no support for file restore from journal inode data if "64-bit" is set in the ext4 file system.

see some old posts:
http://sourceforge.net/p/extundelete...sage/32213239/
http://sourceforge.net/p/extundelete...sage/29988846/

robi1

Thanks - depends on what you mean by a huge number, I'd guess 10,000ish...not an incredibly high number. But it does sound like the 64-bit flag is going to be an issue. I've seen a couple people post on the synology forum that seem to have made their way around this issue somehow with extundelete, but I can't find much in the way of detail. I posted over there, hopefully someone will chime in.