LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 01-05-2015, 06:09 PM   #1
turkvu
LQ Newbie
 
Registered: Sep 2013
Posts: 6

Rep: Reputation: Disabled
Recovering deleted files from Raid1 array


Hi - have a Synology Diskstation with 3TB of pictures & movies on it. After carefully organizing all of it, I used a utility to prune empty directories...which deleted everything. I'd really like to recover the files w/ their original names (& hopefully directories) intact.

I've pulled one of the drives from the NAS and have it attached to my ubuntu 14.04 machine. The device shows up under the list of Disk Drives with a partition type of Linux RAID. I know that it was formatted with ext4

So far I've tried r-studio and was able to get files, but no names. I'm currently trying to use debugfs, but running into some issues.

When I type in:
Code:
sudo debug fs -c /dev/sdb5
I get the following:

Code:
no talloc stackframe at ../source3/param/loadparm.c:4864, leaking memory debugfs 1.42.9 (4-Feb-2014)
/dev/sdb5: Bad magic number in super-block while opening filesystem
Any ideas or alternate methods of retrieving these files would be much appreciated

Last edited by turkvu; 01-05-2015 at 06:12 PM.
 
Old 01-05-2015, 07:15 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590Reputation: 3590
Quote:
Originally Posted by turkvu View Post
I'd really like to recover the files w/ their original names (..) intact.
Think of a file system as a tree with leaves: the directories are the branches and the files are the leaves. Deleting files means deleting the link between a file and where its metadata is stored. In short it's become Autumn: there the tree stands and all the leaves are on the ground. Since these are all images your best bet to salvage what's left is to reassemble the RAID, mount it readonly and then scan for and use IPTC / EXIF metadata.
 
Old 01-05-2015, 10:13 PM   #3
turkvu
LQ Newbie
 
Registered: Sep 2013
Posts: 6

Original Poster
Rep: Reputation: Disabled
From the extundelete website:

Quote:
extundelete was the first program able to restore both the contents and the file name of a deleted file on an ext4 partition.
So it seems that it is possible...just looking for a little help. Here's where I am now -

I used mdadm to start the device - since it's raid1 I chose to start with 1 of the 2 devices, to be safe:

Code:
sudo mdadm --stop /dev/md0
sudo mdadm -A -R /dev/md0 /dev/sdb5
mdadm then reported that it had started /dev/md0 with 1 drive (out of 2)

I tried to unmount /dev/md0 - but the system told me it was not mounted.

I then ran extundelete
Code:
sudo extundelete /dev/md0 --restore-all
And got the following:
Code:
extundelete: failed to read-only open device "/dev/md0": Error code 2133571347
A quick search turned up this thread - which tells me:
Code:
Error code 2133571347 is  "EXT2_ET_BAD_MAGIC"
This means, there is no valid signature for the superblock.

either, the superblock is corrupt, then you can try to open the file system 
with help of the superblock copies. see options "-b blocknumber " an "-B 
blocksize"

or
You have made ​​some wrong during the creation of the file system image.

or
You have created an image of the entire disk, not a copy of the file system.
In this case you must specify offset options for losetup.
I don't think my superblock is corrupt - but I'm stuck as to how to proceed.

On a whim I tried ext4magic - it gave me the following error:

Code:
Error 13 while opening filesystem
I'm stuck - any ideas to help me push forward?
 
Old 01-07-2015, 02:45 PM   #4
robi1
LQ Newbie
 
Registered: Sep 2012
Posts: 10

Rep: Reputation: Disabled
That you can not find the ext-superblock on the raid, can be several possible reasons.
# Superblock destroyed ----------unlikely
# Raid is partitioned ----------unlikely
# Raid redesigned and disregard the mdadm versions -------possible.
# On the RAID is LVM --------- likely

But I think, however you will not be successful with extundelete or ext4magic.

2 reasons:
# Use as a NAS and a huge numbers of files? the default journal size of 128M is too small to contain unerased inode copies after deleting all the files.

# Very possible: (often/always ?) Synology uses the 64-bit flag for all ext4 file systems. This is not the ext4 default setting for files systems <16TB. extundelete and ext4magic have no support for file restore from journal inode data if "64-bit" is set in the ext4 file system.

see some old posts:
http://sourceforge.net/p/extundelete...sage/32213239/
http://sourceforge.net/p/extundelete...sage/29988846/

robi1
 
2 members found this post helpful.
Old 01-07-2015, 05:33 PM   #5
turkvu
LQ Newbie
 
Registered: Sep 2013
Posts: 6

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by robi1 View Post
That you can not find the ext-superblock on the raid, can be several possible reasons.
# Superblock destroyed ----------unlikely
# Raid is partitioned ----------unlikely
# Raid redesigned and disregard the mdadm versions -------possible.
# On the RAID is LVM --------- likely

But I think, however you will not be successful with extundelete or ext4magic.

2 reasons:
# Use as a NAS and a huge numbers of files? the default journal size of 128M is too small to contain unerased inode copies after deleting all the files.

# Very possible: (often/always ?) Synology uses the 64-bit flag for all ext4 file systems. This is not the ext4 default setting for files systems <16TB. extundelete and ext4magic have no support for file restore from journal inode data if "64-bit" is set in the ext4 file system.

see some old posts:
http://sourceforge.net/p/extundelete...sage/32213239/
http://sourceforge.net/p/extundelete...sage/29988846/

robi1
Thanks - depends on what you mean by a huge number, I'd guess 10,000ish...not an incredibly high number. But it does sound like the 64-bit flag is going to be an issue. I've seen a couple people post on the synology forum that seem to have made their way around this issue somehow with extundelete, but I can't find much in the way of detail. I posted over there, hopefully someone will chime in.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Recovering Deleted files brew1brew Mandriva 6 12-24-2005 02:21 PM
Recovering deleted files?? DaFrEQ Linux - General 8 09-17-2005 01:28 PM
recovering deleted files saipraveen Linux - Newbie 1 06-16-2005 12:00 PM
recovering deleted files hamish Linux - Newbie 2 10-04-2004 06:51 PM
Recovering Deleted Files Brian of Gep Linux - Newbie 1 03-02-2004 03:26 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 04:45 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration