stillnocake Posted March 18, 2021 Share Posted March 18, 2021 (edited) Unraid version: 6.9.1 Pro I am typing this message as a last resort looking for any help I could find. I woke up this morning to an apparently dead Unraid key.. It's not really dead.. just unreadable to Unraid for a reason I cannot explain. I tried to connect to the GUI as I do pretty much every day and I got a message telling me the browser was unable to connect so I immediately pluggued a monitor in to find what was up with the server. At my greatest disapointment, the server displayed the dreaded "failed to load ldlinux.c32" message. I had no idea what that meant so I googled it to find any clue on how to resolve the error. I decided that it was best to contact Unraid support directly to see if they could help in any ways. They offered to transfer my licence to another key and they gave me some pointers on what steps to take to try and resolve my issue. https://forums.unraid.net/topic/77733-help-with-dead-usb-drive-data-recovery/ https://forums.unraid.net/topic/78421-unraid-usb-died-no-backup/ https://wiki.unraid.net/UnRAID_6/Changing_The_Flash_Device#What_to_do_if_you_have_no_backup_and_do_not_know_your_disk_assignments After having read all the posts, I realized that I had no flash backup and no screenshot of my disk array assignment and that I might have just lost everything.. I went and created a new Unraid stick and backed up the config folder of the faulty key on my Windows machine. No other folder was on the drive. No trace of a "super.dat" file.. no other files whatsoever. I booted up the new stick and Unraid was back without a licence, so I asked for a transfer to my new key. As I followed the steps people were giving to recover the data, I realized that all my mountable drives show as thought they are completely empty and I don't know what to do next. I have tried to identify all of the unmountable drives and separate them from the mountable ones using the New Config tool, but it does not give me back my data, at least for now. I understand that all my Docker containers are probably gone, but it does not matter. I have not placed any of the drives in the parity slot so nothing could explain the instant disappearance of my data. Anybody knows what could have happened during the night? My array: 2 Parity drives - 8TB 4 Data drives - 16TB 1 Cache Sata = 512GB Please help me this data is pretty much all I have in life. Thank you whoever you are.. Edited March 18, 2021 by stillnocake structure, title Quote Link to comment
JorgeB Posted March 18, 2021 Share Posted March 18, 2021 Assign all disks as data devices (no parity), you can leave the SSD unassigned for now or assign it to cache, start the array and grab an post the diagnostics: Tools -> Diagnostics. Quote Link to comment
stillnocake Posted March 18, 2021 Author Share Posted March 18, 2021 tower-diagnostics-20210318-1521.zip Here is the file, thank you ! Quote Link to comment
JorgeB Posted March 18, 2021 Share Posted March 18, 2021 You left a couple of unassigned disks, but the 3 assigned disks that mounted are completely empty, just booting/using a different flash drive would never delete data, did you format any of the disks? The remaining array disks that are not mounting are complaining of an invalid partition layout, see if they mount with the UD plugin since it doesn't require a specific partition layout like Unraid does, just requires a valid one. Quote Link to comment
stillnocake Posted March 18, 2021 Author Share Posted March 18, 2021 So I lost all my data? Instantly throught the night? How can this happen? I have been using Unraid for 1 year and a half now and never had any issue with it.. what could possibly have happened? I will try the UD plugin, I'll try to find out about it first, but I am really really out of words.. Quote Link to comment
stillnocake Posted March 18, 2021 Author Share Posted March 18, 2021 Both parity and data drives cannot be read.. Is there a way to fix the partition layout? Quote Link to comment
ChatNoir Posted March 18, 2021 Share Posted March 18, 2021 Do you know what was your file system ? XFS or BTRFS ? Quote Link to comment
stillnocake Posted March 18, 2021 Author Share Posted March 18, 2021 I guess it was xfs but I am not sure. Quote Link to comment
stillnocake Posted March 19, 2021 Author Share Posted March 19, 2021 Partition file system is XFS, I am open for any advice. Thank you. Quote Link to comment
JorgeB Posted March 19, 2021 Share Posted March 19, 2021 13 hours ago, JorgeB said: are complaining of an invalid partition layout, see if they mount with the UD plugin Quote Link to comment
stillnocake Posted March 19, 2021 Author Share Posted March 19, 2021 (edited) 4 hours ago, JorgeB said: are complaining of an invalid partition layout, see if they mount with the UD plugin They don't is there anything I can do outside of Unraid? Edited March 19, 2021 by stillnocake Quote Link to comment
JorgeB Posted March 19, 2021 Share Posted March 19, 2021 If they also don't mount with UD then there's no partition or it's damaged, please post output of: fdisk -l /dev/sdX Replace X with one (or all) of the invalid partition disks. Quote Link to comment
stillnocake Posted March 19, 2021 Author Share Posted March 19, 2021 (edited) After having changed the stick yesterday and transfered my licence to a new device, I woke up to this message this morning.. I guess it's a configuration issue, I am going to investigate and unplug every third party devices like Sata expansion card and the drive enclosure hoping it will bring back my data to life.. Thank you Edited March 19, 2021 by stillnocake Quote Link to comment
JorgeB Posted March 19, 2021 Share Posted March 19, 2021 That looks like a flash drive problem, you can try redoing it, sometimes booting UEFI instead also helps, if the server supports it. Quote Link to comment
stillnocake Posted March 19, 2021 Author Share Posted March 19, 2021 1 minute ago, JorgeB said: That looks like a flash drive problem, you can try redoing it, sometimes booting UEFI instead also helps, if the server supports it. It's another flash drive than the first one.. thank you for the UEFI tip I'll also give that a shot. Quote Link to comment
stillnocake Posted March 21, 2021 Author Share Posted March 21, 2021 On 3/19/2021 at 10:05 AM, JorgeB said: If they also don't mount with UD then there's no partition or it's damaged, please post output of: fdisk -l /dev/sdX Replace X with one (or all) of the invalid partition disks. Here is the result of 'fdisk -l' used on my server: Disk /dev/loop0: 11.48 MiB, 12042240 bytes, 23520 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk /dev/loop1: 19.78 MiB, 20738048 bytes, 40504 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk /dev/sda: 14.53 GiB, 15606349824 bytes, 30481152 sectors Disk model: DT 101 G2 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x00000000 Device Boot Start End Sectors Size Id Type /dev/sda1 * 2048 30481151 30479104 14.5G c W95 FAT32 (LBA) Disk /dev/sdc: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors Disk model: ST4000VN008-2DR1 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: 6B9F70B2-C90C-43E4-B68D-EF0484CCDC9F Device Start End Sectors Size Type /dev/sdc1 64 7814037134 7814037071 3.6T Linux filesystem Disk /dev/sdd: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors Disk model: ST4000VN008-2DR1 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disk /dev/sdf: 476.94 GiB, 512110190592 bytes, 1000215216 sectors Disk model: ADATA SU800 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x00000000 Device Boot Start End Sectors Size Id Type /dev/sdf1 64 1000215215 1000215152 476.9G 83 Linux Disk /dev/sde: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors Disk model: ST4000VN008-2DR1 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disk /dev/sdb: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors Disk model: ST4000VN008-2DR1 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: C5C2019B-D306-4742-AD2B-9AB8D1FD2BD5 Device Start End Sectors Size Type /dev/sdb1 64 7814037134 7814037071 3.6T Linux filesystem Disk /dev/sdg: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors Disk model: WDC WD40EFRX-68N Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: 7CDCC0A7-7E7F-4CF2-9C34-2ED441705FB4 Device Start End Sectors Size Type /dev/sdg1 64 7814037134 7814037071 3.6T Linux filesystem Disk /dev/sdh: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors Disk model: WDC WD40EFRX-68N Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: A1C41FE5-39D7-46F2-B5F1-6CF468F5E76C Device Start End Sectors Size Type /dev/sdh1 64 7814037134 7814037071 3.6T Linux filesystem Also, here is 'lsblk': NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 11.5M 1 loop /lib/modules loop1 7:1 0 19.8M 1 loop /lib/firmware sda 8:0 1 14.5G 0 disk └─sda1 8:1 1 14.5G 0 part /boot sdb 8:16 0 3.6T 0 disk └─sdb1 8:17 0 3.6T 0 part sdc 8:32 0 3.6T 0 disk └─sdc1 8:33 0 3.6T 0 part sdd 8:48 0 3.6T 0 disk sde 8:64 0 3.6T 0 disk sdf 8:80 0 476.9G 0 disk └─sdf1 8:81 0 476.9G 0 part sdg 8:96 1 3.6T 0 disk └─sdg1 8:97 1 3.6T 0 part sdh 8:112 1 3.6T 0 disk └─sdh1 8:113 1 3.6T 0 part The partitions are probably damaged, do you know if these drives can be repaired to recover my data? Thank you Quote Link to comment
trurl Posted March 21, 2021 Share Posted March 21, 2021 On 3/18/2021 at 2:47 PM, stillnocake said: Please help me this data is pretty much all I have in life. Since nobody else said it, I will. You absolutely must have another copy of anything important and irreplaceable. Parity is not a substitute for backups. Plenty of ways to lose data that parity can't help with. Quote Link to comment
JorgeB Posted March 21, 2021 Share Posted March 21, 2021 Several disks are missing the partitions, that suggest they were deleted by someone, probably when you where hacked. A number of user have been similarly hacked lately, did you have any forwarded router ports (or DMZ enable) to your server? Did you have a strong password for root? Quote Link to comment
bsipod0 Posted March 21, 2021 Share Posted March 21, 2021 In order to confirm JorgeB's idea, we must have the following answers: 1. Once you transferred to another USB, did you get your Dockers started? 2. Do you have another server on your LAN? 3. Also, what are all the ports you forwarded (i.e. to what services)? 4. Finally, did you have Https enabled on your login page? Quote Link to comment
stillnocake Posted March 21, 2021 Author Share Posted March 21, 2021 22 minutes ago, bsipod0 said: In order to confirm JorgeB's idea, we must have the following answers: 1. Once you transferred to another USB, did you get your Dockers started? 2. Do you have another server on your LAN? 3. Also, what are all the ports you forwarded (i.e. to what services)? 4. Finally, did you have Https enabled on your login page? 1. I had nothing once the transfer was done, no dockers nothing; 2. I had a couple of docker servers hosted behind my router (I never had any problem with them to this day); 3. The ports forwarded on my router are the same the Docker containers exposed; 4. I was going to learn how to setup Https on my server, but didn't have time. Thank you Quote Link to comment
bsipod0 Posted March 21, 2021 Share Posted March 21, 2021 39 minutes ago, stillnocake said: 1. I had nothing once the transfer was done, no dockers nothing; 2. I had a couple of docker servers hosted behind my router (I never had any problem with them to this day); 3. The ports forwarded on my router are the same the Docker containers exposed; 4. I was going to learn how to setup Https on my server, but didn't have time. Thank you I am trying to narrow down where the exploit originated. Can you submit your router's port forward list? Quote Link to comment
stillnocake Posted March 21, 2021 Author Share Posted March 21, 2021 10 hours ago, JorgeB said: Several disks are missing the partitions, that suggest they were deleted by someone, probably when you where hacked. A number of user have been similarly hacked lately, did you have any forwarded router ports (or DMZ enable) to your server? Did you have a strong password for root? A couple of exposed ports for specific purposes (Docker containers forwards) nothing else really.. I was setting up a nextcloud server but it was still only at a LAN(testing) stage. Quote Link to comment
stillnocake Posted March 21, 2021 Author Share Posted March 21, 2021 So no real way of getting my data back I understand? Quote Link to comment
JorgeB Posted March 22, 2021 Share Posted March 22, 2021 13 hours ago, stillnocake said: So no real way of getting my data back I understand? Only option is a data recovery tool, a few users have used UFS explorer with some success. Quote Link to comment
mbell420 Posted March 22, 2021 Share Posted March 22, 2021 4 hours ago, JorgeB said: a few users have used UFS explorer I'm going to try this today with my situation (very similar) I'll get back you with the results stillnocake. Quote Link to comment
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.