My system crash (reiser3 gone)

IceRAM · 2005-03-30 20:36:22

Well... it had to happen. Everything was too smooth. Everything was working too good. I am trying to stay calm, thinking that my data is on another partition.

The start:
I was doing homework in KDE, just finished some Gimp-ing. I had just started Win4lin ("/etc/rc.d/init.d/Win4lin start"). Then, I needed to start "win" (meaning I had to boot windows, as the daemon/modules/whatever was loaded). The computer froze. One of the few freezes I had my entire life using Linux. I pressed the power button, pressed the power button again.. then I saw it. Kernel panic.. cannot boot.. etc.

The root partition is broken. I have no idea how to fix it. I'm currently posting from Damn Small Linuxm where I tried to mount my home partition with no success.

root@ttyp1[mnt]# mount -t reiserfs /dev/hdc5 /mnt/hdc5
mount: wrong fs type, bad option, bad superblock on /dev/hdc5,
       or too many mounted file systems

The question is... what do I do now? I want my data back... and I am still calm.

I did some backups... but I haven't moved them from the /home partition, as I used them as backups between KDE upgrades.

phrakture · 2005-03-30 21:03:36

can parted help?
http://www.gnu.org/software/parted/parted.html

shadowhand · 2005-03-30 21:10:44

reiserfsck

.

IceRAM · 2005-03-30 21:13:39

@phrakture:
I'm not sure. I need a repair too, and parted seems to do checking only.

shadowhand wrote:

reiserfsck

.

I was thinking the same, but:
1. did you happen to get the same error and reiserfsck helped?
2. if yes, what caused the partition corruption?
3. what were the params you used with reiserfsck?

Bookmark for me:
http://lists.suse.com/archive/suse-linu … /0026.html

shadowhand · 2005-03-30 21:19:13

I've never had ResierFS crash, but fsck helped when my ext3 died. Try reiserfsck /dev/hdx .

IceRAM · 2005-03-30 21:35:37

Another bookmark: http://www.webservertalk.com/showthread … genumber=1

I'd be more grateful if people would also add the circumstances their reiser3 partitions got corrupted.

I must add that:
1. I've noticed eveything freezing, no HDD activity
2. pressed Ctrl+Alt+Del (Win-reflex) - nothing
3. Ctrl+Alt+Backspace <- worked! - that means X got stopped
4. I tried to log in as root, but I couldn't. The computer was frozen.
5. Everything I typed appeared on the screen. I believe it hung, one way or another, because of the Win4lin kernel modules, or CPU was 100%.

Note that I haven't tested anything yet, as I want my home partition NOT to loose its data (or, not to loose much data). Therefore, I'm still thinking how to lend a HDD from somebody.

Kern · 2005-03-30 21:36:44

i know its preferable to recover the drive in its entirety, and the following is a bit redundant if you have no spare drive but ...

if you have another drive thats bigger than the one you have now, you could take a disk image, using dd, and work on that.

never tried recovering anything from reiser myself, but in general its preferable to take an image of the drive, and recover stuff from that before risking overwriting data on the original.

there are utils i have tried that will trawl the data bit by bit, regardless of filesystem type or whether the filesystem has collapsed, and recover certain filetypes.

if the most important thing on there is graphical files, theres a utility called testdisk which incorporates 'photorec'.

this can be run from a spare drive, or Knoppix CD if you have one, but you again would have to have a target drive, and find a way of redirecting its output. the drive wouldnt need to be as large as your own as it would only dump the files it filtered out.

another useful app is magicrescue.

Hope you have luck in getting the lot back, having had similar stuff befall me in my final year project courtesy of "fast save" in M$ windows, u have my utmost sympathy.

IceRAM · 2005-03-30 21:46:48

Kern wrote:

Hope you have luck in getting the lot back, having had similar stuff befall me in my final year project courtesy of "fast save" in M$ windows, u have my utmost sympathy.

Thank you.

Something like this (unable to boot Linux) made me return to Windows some years ago, mostly because 1. it was SuSE and I didn't know how to fix it, 2. I didn't have time to start over. Currently, I can only say I have less time than I had back then and I would hate returning to that... urgh.... OS.

I'll probably start the quest for a hdd tomorrow, since I don't have some spare 40 GB around the house.

shadowhand · 2005-03-30 21:50:39

Might want to try http://www.linux-forensics.com and http://www.knoppix-std.org/.

You might be able to load the hard drive somehow with those and at least get your data back.

Kern · 2005-03-30 23:01:03

Couple of questions first

1. from the damnsmall disk you are using, have you tried fdisk -l to check what the system sees ?

2. should full recovery not work / be possble, what files are the most important ones u quickly need to recover?
Maybe we can point out a quick recover for the most important stuff, if its urgent.
----------------------
agreeing with shadowhand, a live cd maybe the way to go, but for actually mounting another partition / drive, the basic knoppix is as good as any.

The main difference between these knoppix variants is the range of tools that are available for the type of recovery you need. std is mainly security tools for instance.

If you are stuck for time, the last thing you need is to be trawling through the mass of these available, finding out how they work and if indeed they do work. and the size of disks varies dramatically. have you really time to d/l several hundred meg disks each?

usually if it cant see it - it cant mount it. try fdisk -l from root terminal
If it can - it will spec which partition to load.

The good news is tho, ive recovered specific filetypes from a disk that *no* version of knoppix has been able to mount, by using the testdisk/photorec recovery util and pointing it at the general , for me, /dev/hdb device file.

As a last gasp attempt, if you havent the time or bandwidth to grab any of the recovery CD's im going to list below, im happy to post you one or two out, although im not sure how quick snailmail would be from UK to Romania.

http://www.e-fense.com/helix/index2.html
http://www.ultimatebootcd.com/

or try

http://www.knoppix.net/wiki/Knoppix_Customisations various

and wordsearch for 'recover'

and finally
http://www.livecdlist.com/
although this lists almost everything on earth, and unless you are sure what you need, can be wasteful of time.

hth
Kern

IceRAM · 2005-03-31 05:34:06

1. the partitions show up right using "fdisk -l". I got the "... bad superblock error" when I tried mounting from Damn Small Linux.

2. the most important data is on the /home partition. Unfortunately it is 40GB and I have no hdd to dd it before running anything on it.

Update: My parallel Windows XP installation died too (= the NTFS main partition and a FAT32 partition I used to share data between Linux/Windows). I still have 2 FAT32 partitions mountable.

Conclusion: the HDD is dieing and I should dd it really soon.

Bandwidth is not a problem around here anymore, not for me at least. The dorms of my faculty have fiber optics and I could ask somebody there to make me a Knoppix-SDT live CD. Damn Small Linux is also based on Knoppix, and it is the only one live CD Linux CD I found around.

shadowhand · 2005-03-31 06:03:14

No, definately get the Penguin Slueth CD from http://www.linux-forensics.com/downloads.html . Knoppix-STD will have less, if any of the tools you need. The forensic tools _should_ be able to read the drive bit by bit and recover the data... hopefully.

Kern · 2005-03-31 10:49:49

Eeek ! more partitions lost

the Ultimate Boot CD has a variety of hard-drive test programs from various manufacturers, maybe try this.

but yes, dd as soon as possible.

just as a bit of extra, ive actually used Penguin sleuth kit.

a lot of the stuff is based around having to present the evidence in a report format, for legal forensic work. To use "the sleuthkit" takes a lot of form filling that a forensic examiner would have to do. Lost me inside a few minutes

the basic data carving tools are command line anyways, so u could bypass all that stuff.

compare packages for yourself.

http://www.knoppix-std.org/tools.html under forensics
with
http://www.linux-forensics.com/forensics/pensleuth.html

the ones ive found to work are, with apologies if you know all this stuff anyways:

the basic dd - taking a bitwise image. variants are dcfldd, dd_rescue.

md5sum / md5deep - ensure the dd image you have taken is an accurate copy of the drive.

fatback - for deleted files on a windows partition. this may not work for you if the partition table is fubar

photorec - its current version retrieves more than just camera images. very good util. can read a drive directly without having to take a dd image, and is non destructive. find the most up-to-date on the latest releases of Knoppix Live CD. comes as part of the Tesdisk package but is quite separate as a utility.

Testdisk - will try and find lost partitions and effect a repair. be very careful with this and certainly dont use it before you have a valid dd image.

foremost - based on header and footer detail this has a few shortcomings as you specify the max filesize for any recovered images and therefore ends up with small images with huge filesizes.

magicrescue- similar to photorec, works on header and footer but better than foremost. may also be able to work directly on a drive.

my favourites are dd, md5sum, and tesdisk/photorec which i believe are on any basic Live Knoppix CD, but i specialise in image recovery, so maybe biased.

be careful of Specialised Distros as they are less frequently updated, and some of the tools arent in the latest form.

Good luck !

Arch Linux

#1 2005-03-30 20:36:22

My system crash (reiser3 gone)

#2 2005-03-30 21:03:36

Re: My system crash (reiser3 gone)

#3 2005-03-30 21:10:44

Re: My system crash (reiser3 gone)

#4 2005-03-30 21:13:39

Re: My system crash (reiser3 gone)

#5 2005-03-30 21:19:13

Re: My system crash (reiser3 gone)

#6 2005-03-30 21:35:37

Re: My system crash (reiser3 gone)

#7 2005-03-30 21:36:44

Re: My system crash (reiser3 gone)

#8 2005-03-30 21:46:48

Re: My system crash (reiser3 gone)

#9 2005-03-30 21:50:39

Re: My system crash (reiser3 gone)

#10 2005-03-30 23:01:03

Re: My system crash (reiser3 gone)

#11 2005-03-31 05:34:06

Re: My system crash (reiser3 gone)

#12 2005-03-31 06:03:14

Re: My system crash (reiser3 gone)

#13 2005-03-31 10:49:49

Re: My system crash (reiser3 gone)

Board footer