Re: worst nightmare (recovery of deleted files)
From: ssl (boscobiscotti_at_yahoo.com)
Date: 05/22/03
- Next message: Susan: "MAXINT64"
- Previous message: Alistair Nelson: "Simple HTTP Application Gateway?"
- In reply to: Andreas Borchert: "Re: worst nightmare (recovery of deleted files)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 21 May 2003 17:55:22 -0700
This is really cool! I will have to remember lofiadm if I ever need it
in the future. Thanks! I used to love rebuilding corrupted
linked-list pointers for a database company I worked for... so I'm not
sure how difficult using fsdb to do something similar would be, but
probably not impossible, specially if there were <100 files total, in
just 5 directories.
Just the kind of pointer I was hoping I would get from sun support
when I called. But no... they just suggested I pay someone for data
recovery.
so: score - comp.unix.solaris: 1 , 1-800-usa-4sun: 0 :)
In fact it turns out that the solution was much simpler, and ended up
turning worst nightmare into a funny story to tell around the fire in
the future.
Well, the best thing I did, was based on advice, unmount the
filesystem.
and go home. then I ate, obsessed, drank coffee called others on my
team and came back, fully prepared to spend the evening searching old
backups to find the best we had, or delve more deeply into data
recovery.
I returned, and someone else was already in. He said " I dont know,
but it looks like all the files are there?" Huh? we poked around, and
I did a du -a on the top-level directory, compared that against a copy
I periodically keep, and sure enough, the total disk usage for that
directory was just a bit higher than it had been a couple weeks
previous. The files were all there.
huh? then I remembered. I had been bringing up a new partition. I
had edited vfstab. I had done a mount -a as I usually do, to make sure
it would come up ok. duh.
What had happenned was that I had added an entry for a new partition a
few months previously to vfstab *INTENDING* to split off a groups home
directories, but had never actually copied them over (probably got
interrupted) the mount -a happened and voila! underlying directory
vanished :) Thats why lost+found was there, with a 2 month old date.
that was the thing that didnt make sense. a rm -R * would have removed
all subdirectories including ./lost+found, and a newfs would have had
todays date on ./lost+found.
when I unmounted the empty partition to make sure it didnt change...
voila files returned :)
And we had never added it to backup, since it wasnt being used...
Well, thanks to everyone who responded. and its probably a good wake
up call to remember the importance of backups :)
shanna
borchert@mathematik.uni-ulm.de (Andreas Borchert) wrote in message news:<3ec78850$1@news.uni-ulm.de>...
> In article <e30b81f6.0305161803.773054ce@posting.google.com>, ssl wrote:
> > anyway, I am in desparate need of suggestions for data recovery
> > options.
>
> First thing to be done: Make a copy of the current state of the
> file system before anything else is attempted. Use dd for it, e.g.
>
> dd if=/dev/rdsk/<disk-partition> of=/some/where/else/mail.disk
>
> There is a tool named lofiadm(1m) that allows you to access this
> file through a block or character device (/dev/lofi/... and
> /dev/rlofi/...) and to mount it.
>
> You have at least two options:
>
> - Pass the saved image to recovery experts who take $$$ for
> this job.
>
> - Use fsdb(1m) or other tools to locate the inodes of the
> deleted files and set the stored link count to a positive
> value. Run fsck(1m) afterwards which causes the recovered
> files to reappear in lost+found.
>
> Andreas.
- Next message: Susan: "MAXINT64"
- Previous message: Alistair Nelson: "Simple HTTP Application Gateway?"
- In reply to: Andreas Borchert: "Re: worst nightmare (recovery of deleted files)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
