[plug] Urgent Help Required - Payment Expected

[Cameron Patrick]

On Mon, Nov 17, 2003 at 12:30:52PM +0800, Stephen Morgan wrote:

| The workstation is running Redhat 9 with a Gnome desktop. The filesystem
| was EXT3 on a standard IDE drive. I was using X when a message appeared
| saying it was deleting files. Before even reading the requestor
| completely it disappeared and all of /home was gone. I shut the machine
| down and took it to friend who started it in single user mode and
| removed hda5 (/home) from fstab and used some utilities that verified
| that the files were still there. As the files are very important
| (business & related files as well as all the documents relating to my
| legal battle to get my children back through the family court) it is
| vital that I recover them. I had a relatively recent backup but when
| checked it turned out to have been overwritten (CD/RW). Additionally my
| friend did a dd of the unmounted partition to a new drive, so I also
| have a copy of the 13MB partition as a file. I have done extensive
| research on the net for solutions, but lack the technical skills and
| knowledge to fix this myself.

First, the good news: I'd imagine that it's very unlikely that any of
the files have actually been overwritten, so with any luck you /should/
be able to get most things back.  After all the data should still be
there even if it's doing a bloody good job of hiding from you at the
moment...  Taking an image of it was also a good move.  Maybe even make
another copy just in case :-)

Now, the not-so-good: What Tim (er, Weirdo) said about grepping the hard
drive was good advice, but /won't/ work for Openoffice documents which
are stored in a compressed format. :(  It's also reasonably likely that
some or all of the files are fragmented so finding the rest of a
partially cut-off document could be .... interesting.

There are a few ext2 undelete tools that I know of but they all seem to
say that ext3 isn't supported :-(  One thing that you might want to try
(_not_ on your only copy of the partition!) is to convert the ext3
partition back to ext2:

	tune2fs /dev/hdXY -O '^has_journal'

and then try 'recover' (apt-get install recover) or Midnight Commander's
undelete feature.  OTOH there's probably a good reason that ext2
undelete tools refuse to touch ext3 :-(  In fact some googling reveals:

	http://mail.gnome.org/archives/mc-devel/2003-March/msg00069.html

Grrr.

BTW the first hit on "ext3 undelete" is a message to a Mandrake mailing
list from our very own Leon:
	http://archives.mandrakelinux.com/cooker/2002-04/msg01785.php

| I am resident in Margaret River and am prepared to travel to Perth on
| short notice to get help. I will bring the machine & monitors / keyboard
| & mouse and the new drive with the image on it.

I suspect the most important thing to have would be a copy of the drive.
People could then prod it with their own system just as easily as they
could with yours, and it would save on stuff that you have to lug up here.
I shall also second Leon's recommendation of the meeting at UCC on Monday---
many knowledgeable people with nothing better to do than help other
people usually turn up to those meetings.

Good luck, and sorry I can't be more helpful!

Regards,

Cameron.

PS.  Now---or once you've got some of your data back---would be a good
time to think seriously about backups...  If you have a couple of
networked computers, a 'set and forget' way is to have a nightly cron
job back up your home partition (or the important bits there of) using
rsync[1] onto the other machine.  I've been using a system along those
lines for a while and it's come in handy a few times ("No! Not rm -r! I
meant mv you stupid machine! Aieeee!")  Though backups on CD-R/DVD-R or
the like are also good to have.

_______________________________________________
plug mailing list
plug at plug.linux.org.au
http://mail.plug.linux.org.au/cgi-bin/mailman/listinfo/plug