Greetings, I had an ext4 partition accessible via samba share and one day that share became empty. I considered goofing up in Windows, but then found out that there were a lot of warnings in dmesg. The partition was not set to be fsck-ed and was made available via a Xen guest. I did start running fsck but after 2 days of 100% CPU usage (single core only on a quad-core) i quit.
The data isn't quite mission critical, i do back that one up, but it's nonetheless rather important, at least some pieces. My main goal is to find out how that happened. I tried looking at the samba logs but they're quite confusing and crowded, and i couldn't pin-point any specific data that would point to a user deletion. I was hoping someone would point me to other logs i can skim. >From what i've been searching, ext4 on a virtual machine could do well with barriers off[1], and maybe ext3 would've been a better bet. I'm not sure if the cause could've been somewhere in the virtualization (the samba share was made available via a Xen PV guest). I don't think the disk is corrupted, only the file system and it's gazillion inodes (it's about 400GB of a 1TB drive) that fsck wants to clone. My second concern would be to recover the data. I tried r-studio,which did see all the neat partitions on LVM and RAID1 (another partition on this 1TB drive makes up half of a RAID1,over which is an LVM VG, the other VG being mostly used by the damaged partition). However, when i re-ran r-studio again, it can't find its bearings and i can no longer pinpoint the partition - it apparently doesn't support LVM yet[2]. It's a shame, it seemed to be the best candidate for the job. The LVM does seem to be my main problem. I also tried testdisk, but it eventually tells me the partition can't be recovered. Then i tried photorec, which does recover a whole bunch of files, but it's mostly pieces of files (i don't have 49K .cab files,so not all of the recovered files are accurate). I assume this has something to do with the underlying PEs and LEs of LVM. I do have another partition (on the same disk) where photorec has been dumping part of the data (i filtered out ISOs and such), but it's not big enough for a dd. My next bet would've been ext4magic but it's only available in testing (my host is stable), and i don't really want to risk that much of a drive stir (since host / and other / are in a partition in the same drive). I just might, if all else fails. There's also foremost and giis, but i haven't looked into these yet. Any other suggestions? I don't think there's a tool that'll even recover the directory structure and file names, that would be great, but files alone are a good start. The next step is considering a makeover on my drives :) (the outcome of which will largely depend on the success of this recovery). Can anyone tell me if RAID5 is slower to write than a single drive? This is a home machine, but if 5 is that slow i'd consider a bigger RAID1 instead. Any help, pointers, tips or any other technical feedback would be welcome. TIA, Nuno [1] http://blog.jolexa.net/2012/02/linode-dont-use-barriers-and-ext-4/ [2] http://forum.r-tt.com/lvm-t8503-10.html?sid=429b8e4210a71188712e4bed1b8d6b8b -- "On the internet, nobody knows you're a dog." -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/cadqa9uai+ak6cethlzr7ueqn3nqyjaandvug3udswnv6xg9...@mail.gmail.com
