Recovering data from a messed up hdd

Sava · 2022-04-04 23:51:07

I have a server that due to bad weather and power surges got it's data messed up. After investigating a bit, I have concluded that the partition table god messed up. I booted from a live usb and used testdisk to recreate the partition table to get something that *looks* like my old partition table. The problem now, however is that I'm unable to mount that partition. After trying some suggestions to mount it as read only, or with an offset, none of the solutions worked.
Next logical step was to try and run fsck on my partition. After figuring out the position of an alternate superblock, I executed

fsck -fy -b 163840 /dev/sda2

After a long and painful process I got back the following error:

Resize inode (re)creation failed: Inode checksum does not match inode.Continue? yes

ext2fs_read_inode: Inode checksum does not match inode while reading inode 7 in recreate inode

/dev/sda2: ***** FILE SYSTEM WAS MODIFIED *****
e2fsck: aborted

/dev/sda2: ***** FILE SYSTEM WAS MODIFIED *****
fsck.ext4 -fy -b 163840 /dev/sda2  42.26s user 2631.99s system 87% cpu 51:11.85 total

And at this point I'm a bit lost as what my next step should be. Currently, my only lead is this article about recovering partitions manually then mounting using alternate superblock, however I'm not sure how useful it would be with my situation. I would like to avoid imaging the whole hard drive as this would require the purchase of new storage mediums and adequate readers, which could end up costing quite a bit, and especially if I'm not sure if the data will be recoverable. I am open to using any data recovery tools to check if the data is present, however I'm not sure which utility would be the best for checking.

Additional information about my setup:
The drives run in a raid array. There was a problem with my power distribution company, it was a voltage spike that activated the surge protection and shut down the server immediately, and from that point onward it refused to boot. When I booted from a live usb, no partitions were present. When I used testdisk, it found my data partition, swap partition, and FAT32 partition, which I am not sure if it was there before, or if it's something from an old installation. When I try to list data partition files in testdisk it reports that the fs is corrupt. I tried running fsck, and researching online, however at this point I've hit a dead end.

Last edited by Sava (2022-04-05 00:16:07)

frostschutz · 2022-04-05 00:20:24

Sava wrote:

The drives run in a raid array.

There are many flavors of raid... Linux mdadm raid? bios fakeraid? dedicated hardware raid? some zfs/btrfs filesystem level raid? Also which raid level, how many drives, etc...?

fsck is dangerous, you forced it and answer all questions yes... don't do that unless you are able to revert whatever modifications it makes. Otherwise there's even more irreversible damage...

Slithery · 2022-04-05 00:48:25

frostschutz wrote:

There are many flavors of raid... Linux mdadm raid? bios fakeraid? dedicated hardware raid? some zfs/btrfs filesystem level raid? Also which raid level, how many drives, etc...?
fsck is dangerous, you forced it and answer all questions yes... don't do that unless you are able to revert whatever modifications it makes. Otherwise there's even more irreversible damage...

This ^

The best method available to you now is probably just to wipe the array and restore all the data from your last backup.

Sava · 2022-04-05 10:36:26

frostschutz wrote:

Sava wrote:
The drives run in a raid array.
There are many flavors of raid... Linux mdadm raid? bios fakeraid? dedicated hardware raid? some zfs/btrfs filesystem level raid? Also which raid level, how many drives, etc...?
fsck is dangerous, you forced it and answer all questions yes... don't do that unless you are able to revert whatever modifications it makes. Otherwise there's even more irreversible damage...

The exsistance of software raid completely slipped my mind while writing this post.
I have a dedicated hardware raid. It is raid 5 with 4 drives. Due to the power surge, one of the drives failed, but hardware raid reactivated other drives, with a supposed 0% loss.

Before running fsck with force and yes flags, I first tried to execute it as is, however there was a bunch of prompts(with yes flag, fsck takes 55 mins to excute and all of those 55 mins are y/n prompts), so I decided to try with yes flag. After getting the error I posted in my original post, I tried with -f flag, just for it not to make any difference at all. Every time I try to run that fsck command I get the same prompts and the same error, like nothing changed.

Slithery · 2022-04-05 10:56:28

Then wiping the drive and adding it as a new one to the array then rebuilding should work.

frostschutz · 2022-04-05 12:26:21

fsck is a big mistake, especially when it starts asking questions, you should stop. letting it make unknown changes for an hour, it's not reversible. if the missing drive still has the original data, it might help a little - you can determine changed areas by parity mismatches - but it'll be a lot of work to recover anything, also very much impossible to help remotely through a forum, so you're on your own. if you don't have a backup and need data recovery, you shouldn't do anything anymore, make full disk copies and get a professional

bad weather or power surges are not supposed to damage partition tables, so from the start, the problem might have been something else, not sure. Good luck...

Arch Linux

#1 2022-04-04 23:51:07

Recovering data from a messed up hdd

#2 2022-04-05 00:20:24

Re: Recovering data from a messed up hdd

#3 2022-04-05 00:48:25

Re: Recovering data from a messed up hdd

#4 2022-04-05 10:36:26

Re: Recovering data from a messed up hdd

#5 2022-04-05 10:56:28

Re: Recovering data from a messed up hdd

#6 2022-04-05 12:26:21

Re: Recovering data from a messed up hdd

Board footer