How to access files on an underlying filesystem? (External HDD).
 

Hello,

I admin a Linux based FTP server. For the past several years I have been creating tarballs of the /home/users directories and copying them to an external HDD (ext4 file system) for backup. The mount point for the back up directory was /home/myuser/cellar. The FTP server has suffered a hardware issue so I have had to migrate the FTP server to new hardware while I troubleshoot the old FTP server hardware. The new FTP server is working properly however I cannot access the existing tarballs on the external HDD from the new server.

I am able to mount the external drive from the new server and have continued to copy backups without fail. I can tell that the previously copied tarballs exist on the external HDD by checking the disk usage. I am struggling to figure out how to recover the tarballs on the underlying filesystem. Simply put, when I mount the external HDD, I can only see the new files that have been recently copied.

shows the correct UUID for the drive which is currently mounted at /dev/sdb1 in this case.

shows that the drive is currently mounted. i also have no reason to believe that the filesystem is corrupt in anyway.

I have attempted to bind mount () which binds the mountpoint to the diirectory I am requesting but I can still only see the new files I have copied from the new FTP server.

I am struggling uderstand how to mount this external drive using to access the underlying filesystem. I have researched using the links below and several others without success.

http://serverfault.com/questions/271...nfs-mountpoint

http://superuser.com/questions/20068...-a-mount-point

http://unix.stackexchange.com/questi...-mounted-drive

Here is a visual of the disk usage. https://goo.gl/photos/QK2USZK9C6UTWk119The grey portion of the pie are the files I am attempting to recover. This image is only to confirm that the files still exist on the drive and have not been deleted.

I am only looking for a nudge in the right direction to recover these tarballs. Any ideas or thoughts on this subject would be greatly appreciated.

kindly,
cl330b

Welcome to LinuxQuestions.

What distribution/version is running on your FTP server? With or without a desktop?

Underlying in the case of the links you posted is when for instance if you mounted an external drive at /mnt those existing files on /dev/sda2 (using your partition layout) would now be hidden. All you can see when viewing /mnt is the files on your external drive (sdb1).

It looks like your external drive is automatically mounted at /media/username/. If you run the mount command (no options) it will show where the external drive is mounted. If you look at the contents of that directory does it show any files? I would expect the underlying mount point to be empty since I assume a new OS installation.

Hello michaelk,

Thank you for the response and the warm greeting.

The FTP machine was an Arch machine.
I was using vsftpd.
The server was headless so no xserver. The machine I am trying to use to recover the files from is a Debian machine.
Thank you for clarifying the specifics of the links I posted. I agree with you, those posts are actually unrelated to my issue. The Debian machine I am using to recover the tarballs is neither the old server or the new server. And you are correct about the underlying directory being empty. I wonder if the underlying files are damaged and unreadable.

If I find a way to recover them, I'll report my findings.

Kindly,
cl330b

Was the posted screen shot from the debian PC? It appeared the drive was automatically mounted. Are you able to view the contents of the drive?

How to access files on an underlying filesystem? (External HDD).
 

Yes, the screenshot was from a Debian laptop I'm using to attempt data recovery. There's roughly ~19gb of data on the drive. 47mb of that data was written by the new Arch server. When the drive is auto mounted on the Debian laptop, I can see all the data written by the new server (47mb). I just can't recover the other ~19gb written by the old server that suffered a drive failure. I had a 3 disk raid 5 array on the old server for the home directories but the root directory was on a fourth drive that wasn't part of the array. Of course, that's the drive that failed. There's one particular tarball that was only on the external drive that I'm trying to recover. Thanks again for taking the time to discuss this with me. It's clearly an issue of my inability to properly archive data.

Kindly,
cl330b

It's a bit confusing because nothing in the above shows /media/cl330b.

The mount point for /dev/sdb1 is /home/cl330b/cellar/toebak. That means that /home/cl330b/cellar is not on /dev/sdb1. If you run "df /home/cl330b/cellar" you will see that it is part of your root filesystem.

When you run "mount --bind", only the single filesystem you reference, and not anything mounted below it, is attached. You will see only the /home/cl330b/cellar/toebak mount point directory -- nothing from the filesystem that is mounted there. If you want to include the submounts as well, you need to use "mount --rbind".

Just to compare numbers post the output of the following command with the external drive mounted.

df -h

The info from your original post is very confusing

/dev/sdb1 is not a mount point, it's a device name. That output doesn't show /dev/sdb1 mounted anywhere.

That is correct, /dev/sdb1 is currently mounted at /home/cl330b/cellar/toebak

Why? Why are you trying to bind mount /media/cl330b? What is there? Why are you trying to mount it to /home/cl330b/cellar? What does any of this have to do with the drive that is mounted at /home/cl330b/cellar/toebak? In fact, because your drive is mounted at /home/cl330b/cellar/toebak, as soon as you bind mount some other directory to /home/cl330b/cellar, your drive will be hidden. I don't understand the point of any of this...could you explain? And please post the output of "df -h" so we can see everything that's mounted and where.

Hello,

for all who have asked, here is the output of I apologize for a confusing post. I am only beginning to understand what this problem actually is. I have run across many issues in my Linux experience over the past 7 years but this one has me scratching my head.

suicidaleggroll,

Yes, I mis-spoke when I said that the drive is "mounted at /dev/sdb1". I know this is not a mount point, I stand corrected. My attempt to bind mount was an attempt to access the underlying files on the disk. I have mentioned before, the total disk usage is close to 19gb. I can only access 47mb of the files that are on the disk. The 19gb of data was written by a server that has suffered a drive failure. The 47mb of data that I can access was written by the replacement server. The external HDD's disk label is "toebak". That is not a directory I created. The "~/cellar" directory is the directory I mounted the external HDD under on the failed server. I believe the circumstances aren't being conveyed properly which is my shortcoming. I do however appreciate the willingness to help.


rknichols,

I agree with you regarding the mount bind not not attaching to anything below what is specified. This is my trouble. I can't clearly see yet how to mount any of the sub-directories that exist on the drive. The underlying files are all tarballs, there shouldn't be any directories. "mount --rbind" is still only mounting the portion of the drive with the readable 47mb. I believe I am fighting 19gb of corrupted data. Originally on the failed server, I was mounting this external HDD with my fstab to ~/cellar. I checked on the backups frequently, and they were in good shape. After the server failed, I haven't been able to access them from any machine. I was able to write to the drive from other machines without any issues.

This screenshot shows the total disk usage and the 47mb of accessible files. This screenshot is from the Debian machine I'm using to recover the data.
https://goo.gl/photos/QK2USZK9C6UTWk119

Thank you all for your time.


Kindly,
cl330b

How about these:

Something very interesting has come up. I unplugged the external HDD and when I read suicidaleggroll's response, I plugged it back in. Now take a peek at .

The external HDD is now showing /dev/sdb1 & /dev/sdc1. This hasn't happened before.
When I list the directory contents (/home/cl330b/cellar is of particular interest)...
And of course /home/cl330b/toebak still shows the 47mb worth or readable data.
input/output error.
Kindly,
cl330b

total = 45M is not the size of the files but the total BLOCKS, where BLOCKS is the total disk allocation for all
files in that directory. The block size currently defaults to 1024.

The ext file systems by default reserve 5% for root which is not included in the number of the df output. So
total = used + avail + 5%

The numbers appear to match. Have you looked at the contents of the other subdirectories cl330b and cl330b_attiny85? According to the picture you posted there are 46 files.

Stale mounts can happen when you unplug a drive without unmounting it first. It's also a good way to corrupt the filesystem and trash your data.

Where do you get 47 MB? I see 45M at the top of the ls output, which does not mean there's 45 MB of data, and the two files of significance shown in that output add up to 41.8 MB. What about those two directories? Again, please post the output of:
Also, this is a pet peeve of mine, but please use proper unit abbreviation to prevent confusion.
m = milli = 1e-3
M = mega = 1e6
b = bit
B = byte = 8 bits

So "47mb" means 47 millibits, about 0.006 bytes. "mb" and "MB" are completely different units, off by a factor of 8 billion. The "m" vs "M" is so different that people can pick up on what you meant through context, but "b" vs "B" is an important one that people screw up ALL the time.

If you have not already done so I suggest that you run fsck against this external hdd.

-----------------------
Steve Stites

Hello,

Thank you all for taking the time to discuss this problem with me. I really appreciate the knowledgeable and friendly members of this community. I would like to point out a few things. I did not unplug the drive without unmounting the drive first. The HDD that the root file system of the server was mounted on failed. I could not SSH or telnet in. For some reason the data on the external drive also got corrupted. I also never thought that the "total 45M" at the top of my "df -h" command output was the amount of data on the disk. I will mark this as solved even though the data wasn't recovered. I have learned quite a bit and realize that I have to practice better data archiving. I truly appreciate all who responded.

Kindly,
cl330b