Lost Data
|
| Author | Content |
|---|---|
| theboomboomcars Dec 28, 2007 8:21 AM EDT |
I recently did a fresh install on my desktop. After Everything was done, two of my folders on my data hard drive are gone. They are still taking up space, they are about 30 gigs together (pictures and music), but the folders are missing. It is a 250gb drive, with 232gb that is in the partition. I have 180gb available for use and the information that is still accessible takes up about 26gb. So I know that my files are still there. I have tried using a live cd, with no luck, as well as photorec, but it doesn't bring any of the files I am looking for up. Does anyone have any idea how to get the folders back. They are still on the drive I just can't get into them. |
| hkwint Dec 28, 2007 8:47 AM EDT |
Depends on your FS (Reiser, EXT2/3 etc.) First, look in your lost+found dir if it exists (does exist in 'root' dir of Ext2/3, but not on ReiserFS). I once managed to retrieve data 'lost' from a ReiserFS after Win98 screwed up the partition while it shouldn't even have touched that partition, because Win98 didn't have anything to do with that partition!). If you have ReiserFS, look here: http://antrix.net/journal/techtalk/reiserfs_data_recovery_ho... |
| theboomboomcars Dec 28, 2007 9:34 AM EDT |
It is ext3. I looked in lost and found and it was empty. Thanks for the suggestion. |
| NoDough Dec 28, 2007 10:18 AM EDT |
[sarcasm]
Just restore from your backup.
[/sarcasm] A little bit of quick searching tells me that recovering deleted directories is very difficult in Ext3. Let's hope they've not been deleted. Were the directories hidden? Have they become hidden? Have you used the df and du commands to try and track down the missing 30gig? Just random thoughts. |
| Abe Dec 28, 2007 11:44 AM EDT |
do man e2fsck and read it carefully. Make sure bad partition is not mounted unless you know what you are doing. use/run e2fsck -n /dev/xxxx on your partition to check for corruption and integrity. Make sure you use -n option to open in Read Only mode for the first time. If you have errors, you can use -p option to automatically fix things. Keep in mind that, fixing could cause loss of data/blocks that can't be recovered. Strongly recommend creating a backup of what you have now first. Good luck. |
| theboomboomcars Dec 28, 2007 11:52 AM EDT |
NoDough- I did not delete them, and they are still taking up space. They were not hidden and I have looked for hidden files, no luck. :( I have not heard of the df and du commands. What are they? Abe- I havent done a file system check, perhaps I shall do that. Thanks for the help. |
| Abe Dec 28, 2007 12:16 PM EDT |
You know, is the data you can see located in a partition by itself? If it is make sure that partition is really mounted where is should be. If not and has other directories on the partition, do you see all the other directories? A little more details about you file system partitions could be helpful to troubleshoot. Like NoDough suggested df & du are very helpful to give information about file systems. man df & man du to learn about them. |
| theboomboomcars Dec 28, 2007 12:26 PM EDT |
The drive is formatted into one partition. After the install was complete I could see all of the folders that were there originally except my Music, Pictures, and isos folders. Before the new install I had 143gb available and after I had 180gb available. Which was wierd as I didn't have the installer do anything with that drive. I checked the man pages on df & du and they were helpful. It seems most of the missing stuff was from the hidden files in my backedup home folder. But I still have a 12gb hole in the reporting. Which is much smaller than the missing files, but if I could at least recoup those it would be great. This is such a wierd phenomina. I guess I should start using that spool of DVDs. :) Thanks for the help |
| gus3 Dec 28, 2007 8:58 PM EDT |
Sparse files? A sparse file is a file in which large areas of "emptiness" are simply zapped down to something that the file system reports as "there's nothing here". A program reading that area gets zeros; writing anything into the "empty" area allocates actual disk space (even if you're writing zeros). Let's say you open a new file for writing, then you position the "file pointer" to the 12G position in the file and write one byte. The file takes up very little real space on the filesystem. If you "ls -l {filename}" it will report that you have 12G of data in the file, but "du -k {filename}" shows that it takes up a lot less filesystem space. All but the very last block of the file are handled as "empty", and only the last block is "real", even though a typical program reading the file would get 12G + 1 byte of data. Here is a real transcript to demonstrate: $ dd if=/dev/urandom of=12Gplus1 bs=1 seek=12G count=1 $ stat 12Gplus1 File: `12Gplus1' Size: 12884901889 Blocks: 32 IO Block: 4096 regular file Device: fd00h/64768d Inode: 5817169 Links: 1 [snip] The "Size" is the number of bytes a program could read from the file, but the actual space on-disk is 32 blocks * 4096 bytes = 131072 actual bytes used. You could have 4 files with 3G of "empty" in them, and this would also add up to a 12G difference in file size vs. filesystem usage. Your comment about "holes" prompted my memory about this. It isn't a common phenomenon, but it can happen (especially with DB servers) and most Unix/Linux filesystems anticipate it. The filesystem check programs (e2fsck etc.) treat this as a normal affair, not an error. I'm not sure exactly what you've done for checking your filesystem so far, so take the pertinence of my information with a grain of salt. Just bear it in mind as a possible explanation as you move forward. |
| Abe Dec 29, 2007 10:40 AM EDT |
@theboomboomcars,
Quoting:Before the new install I had 143gb available and after I had 180gb available. Which was wierd as I didn't have the installer do anything with that drive. The problem you are having is peculiar and curious. You said that you did fresh install without partitioning or formating. I suspect that the installer (What distro?) wrote over whatever you had on that single partition and corrupted what you had in the home directory. This is not an appropriate practice especially when doing fresh install instead of update/upgrade. For any Linux distro, the best thing to do is to have at least three partitions. A / (root), a swap, and /home partition. / doesn't have to be big but 10 GB would be more than good enough. Swap could be twice as much the memory your computer has. If you have lots of memory, swap can be small since your system will not be swapping as much. And the /home partition could be the rest of your disk. This setup will give you flexibility since it will enable you to do fresh install on / (after formatting /) without touching /home at all. You will even be able to install a different distro on / and /home will be retained and untouched. You just have to make sure that the user name and group of your own home directory is the same as the original, other wise you would need to change ownership and permissions on your home directory to match the new user name created by the fresh install. It might be too late for this time but consider it for the future. |
| theboomboomcars Dec 30, 2007 6:46 PM EDT |
gus3- That could be where the missing 12gb are, I don't know. I still need to check the disk for errors. Abe- I understand what you are saying. This is how my disks were set up before and then now. sda- swap 1.5gb, /- remaining drive it's a 250gb drive. sdb- 1 partition 250gb drive mounted to /home/sam/documents. So all the files that I created would be stored here. When I did this install (which is not the first time I had done this new install thing, I am a tinkerer after all) this is how I set it up. sda- swap 1.5gb(left alone), /- 40gb formatted, /home- remaining drive. sdb- manually added to fstab to mount to /home/sam/documents again (did not do anything to it in the installer). So yes this is a very odd situation. |
| jdixon Dec 30, 2007 7:05 PM EDT |
theboomboomcars: Well, as I believe others have said, the first thing you need to do is back up the hard drive, preferably with a byte by byte backup tool. I think the byte by byte requirement lets out partimage, but dd will do this for you, though I can't tell you the exact syntax required. There are undoubtedly a number of commercial programs to do so also (Ghost, for example). If you want to have any hope of recovering the lost files, you need to have an exact copy of the hard drive before you start doing anything. Otherwise the very act of attempting to recover the files could destroy them. Once you have the hard drive backed up, you can experiment to your heart's content knowing the data is safe. |
| gus3 Dec 30, 2007 8:55 PM EDT |
You can make an image of the raw partition, but in your situation you must use another hard drive to hold the image. For safety, see if your hard drive has a jumper to make the drive read-only. Assuming you're familiar enough with device names: # dd if=/dev/{device} of={dev or file path} bs=16384 Using a block size of 16K will get a much faster transfer than 512 bytes. This will make a "raw" copy. However, if we're talking about storing it to a file, you may prefer to compress the image: # dd if=/dev/{device} bs=16384 | gzip -9 > {file path} If you decide to store the image into a file, you can then uncompress a copy of that file and do your experimenting on it: # zcat {file path} > {raw disk image file} You can even try mounting that file as a loopback (file-becomes-filesystem) and see what you can get: # mount -t ext3 -o ro,noload,loop {raw disk image file} {mount point} "ro" is read-only, "noload" means ignore the ext3 journal, and "loop" means it's really a disk file. If it chokes, you just unmount it, delete the copy, and uncompress another copy. I suggest you create a list of tools and ideas to try, before using this information. |
| kjhambrick Dec 31, 2007 9:07 AM EDT |
What does the df command show ? IOW, were the missing folders on a separate partition ? IHTH ... |
| theboomboomcars Dec 31, 2007 5:50 PM EDT |
gus3- Thank you for the help, unfortunately I don't have enough space available on my primary hardrive to create the image, so I'll have to wait until I can get a new drive to make the image onto. kjhambrick- This is the output of df: Filesystem Size Used Avail Use% Mounted on /dev/sdb1 230G 38G 180G 18% /home/sam/Documents The missing files are missing from my sdb1 partition, which is for the whole drive. You guys have been very helpful. Thank you. |
You cannot post until you login.