linux-ext4 - Re: Fwd: Need help with Data Recovery on Ext4 partitions that became corrupted on running OS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Sep 2013 11:50:42 -0500
From:	Eric Sandeen <sandeen@...hat.com>
To:	InvTraySts <invtrasys@...il.com>
CC:	linux-ext4@...r.kernel.org
Subject: Re: Fwd: Need help with Data Recovery on Ext4 partitions that became
 corrupted on running OS

On 9/25/13 11:35 AM, InvTraySts wrote:
> Not used to mailing list courtesy so forgive how gmail responds to these...
> 
> I didn't have any kind of error on the RAID controller itself. When I
> went back for one of the weekends, I went into the RAID controller
> BIOS and everything was reported as normal. Of the four logical drives
> experiencing problems, only two of them were on the controller, one
> was plugged into the motherboard, the last one was plugged into an
> add-on SATA card.
> 
> I don't know what happened on the 24th of August, all I know is that
> it was working fine the previous night, tried to get on the network,
> and everything had stopped working (web server, DHCP, bind, samba,
> etc). Went down to inspect the machine and noticed that it was running
> but there was nothing showing up the monitor when plugging it in. So I
> am not sure of the exact events of how it failed, I just know that
> after hardware testing, the processor was dead.

Ok, so pretty extreme hardware failure.

> I have tried using dd and ddrescue using the following commands:
>  dd if=/dev/sdc of=/dev/sdf bs=4096 conv=notrunc,noerror,sync
>  ddrescue -vf /dev/sdh /dev/sdf /home/andrew/logfile.txt

(you said the copy was worse; what was wrong with it?)
(did the dd or ddrescue encounter any errors while doing the copy?)

dd should have worked fine, and you should be able to play with that
image.  First thing I'd try, if it still throws the bad journal
error first, is to tune2fs -O ^has_journal /dev/sdf

Then try to mount and /or run e2fsck on it, see how it fares.
The journal is just the first thing mount's going to look at;
if the corruption is widespread you may just have a cascade of other
errors behind it, but worth a shot.

-Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html