You are not logged in.
Pages: 1
Hi,
my laptop shut down because it ran out of battery, but when I tried to turn it back on the login screen returned "unable to connect"
I was able to log in from tty1, but only to discover that my home directory turned into some kind of empty file !
here are some logs that tell me that something is definitively wierd, I made them from a mint live usb.
Can someone explain to me what's going on here ? Are my files still there, as seem to be said by fsck and df, or they suddenly disappeared, as implied by du and ls ?
Also, of course, do you have any idea how to bring them back ?
Well, thank you, and here are the logs :
mint mint # fsck /dev/sda3
fsck from util-linux 2.20.1
e2fsck 1.42.9 (4-Feb-2014)
/dev/sda3: clean, 354325/5660672 files, 12761565/22623350 blocks
mint mint # mkdir mo
mint mint # mount /dev/sda3 mo
mint@mint ~ $ df -h | grep sda3
/dev/sda3 85G 48G 34G 59% /home/mint/mo
mint mint # du mo
4 mo/help
16 mo/lost+found
28 mo
mint mint # ls mo
centime help lost+found
mint mint # ls mo/centime -l
-rw------- 1 1000 1000 2404 Feb 19 19:42 mo/centime
ps : I tried to run extundelete on sda3, but it didn't recover anything.
Last edited by centime (2015-02-27 13:47:38)
Offline
Please use code tags when pasting to the boards: https://wiki.archlinux.org/index.php/Fo … s_and_Code
Do you have backups?
Not a Sysadmin issue, moving to NC....
Offline
Well, not for all of it. I probably wouldn't be asking here if I had.
But the output of fsck and df tells me my data are still there somehow, so...
sorry for posting in the wrong forum
Offline
Most importantly, never mount a filesystem read+write if you suspect data loss, as you could inadvertently overwrite old copies or metadata that could otherwise be used to recover files.
blockdev --setro /dev/sda
mount -r /dev/sda /mnt
Did fsck relocate your files to /lost+found? If fsck and extundelete both failed, a last resort is to try something like Photorec, which will aggressively recover anything that looks like it might have been a file at one time, regardless of the filesystem. There's a small chance that it'll find the files you're looking for without corruption, and you could spend hours sorting through the data, but it has been known to work. Hope for the best, but expect the worst; data recovery is always a shot in the dark.
Note that df and du can't really be trusted if your filesystem's metadata is corrupt. Just because those blocks are accounted for doesn't mean they are accessible or non-corrupt. Also, I believe extundelete relies on being able to read the filesystems journal, which was replayed and deleted when you mounted the filesystem (without using blockdev --setro). I could be wrong about that, so refer to the extundelete documentation.
For future reference, see Backup Programs, and LVM which can make your system slightly more resilient against power failures via snapshots.
Offline
I'm curious, what filesystem was used for "/home"? What operating system are you using?
Offline
Hi,
I managed to get it back and running this morning :
e2fsck -f -y -v -C 0
indeed put everything back in lost+found (which just fsck did not). I had to get the name of files and directories manually though.
It was ext4, on archlinux.
Thanks for the tips, and LVM, I'll make good use of it
and thanks for replies !
Last edited by centime (2015-02-27 13:48:14)
Offline
Pages: 1