I have lost everything ("failed to load ldlinux.c32")


Recommended Posts

Unraid version: 6.9.1 Pro

I am typing this message as a last resort looking for any help I could find.

 

I woke up this morning to an apparently dead Unraid key.. It's not really dead.. just unreadable to Unraid for a reason I cannot explain.

 

I tried to connect to the GUI as I do pretty much every day and I got a message telling me the browser was unable to connect so I immediately pluggued a monitor in to find what was up with the server.

 

At my greatest disapointment, the server displayed the dreaded "failed to load ldlinux.c32" message. I had no idea what that meant so I googled it to find any clue on how to resolve the error.

 

I decided that it was best to contact Unraid support directly to see if they could help in any ways. They offered to transfer my licence to another key and they gave me some pointers on what steps to take to try and resolve my issue.

 

https://forums.unraid.net/topic/77733-help-with-dead-usb-drive-data-recovery/

https://forums.unraid.net/topic/78421-unraid-usb-died-no-backup/

https://wiki.unraid.net/UnRAID_6/Changing_The_Flash_Device#What_to_do_if_you_have_no_backup_and_do_not_know_your_disk_assignments

 

 

After having read all the posts, I realized that I had no flash backup and no screenshot of my disk array assignment and that I might have just lost everything..

I went and created a new Unraid stick and backed up the config folder of the faulty key on my Windows machine.

 

No other folder was on the drive. No trace of a "super.dat" file.. no other files whatsoever.

 

I booted up the new stick and Unraid was back without a  licence, so I asked for a transfer to my new key. 

 

As I followed the steps people were giving to recover the data, I realized that all my mountable drives show as thought they are completely empty and I don't know what to do next. I have tried to identify all of the unmountable drives and separate them from the mountable ones using the New Config tool, but it does not give me back my data, at least for now.

 

I understand that all my Docker containers are probably gone, but it does not matter.

 

I have not placed any of the drives in the parity slot so nothing could explain the instant disappearance of my data.

 

Anybody knows what could have happened during the night?

 

My array:
2 Parity drives - 8TB

4 Data drives - 16TB

1 Cache Sata = 512GB

 

Please help me this data is pretty much all I have in life.

 

Thank you whoever you are..

 

 

 

 

 

 

 

 

Edited by stillnocake
structure, title
Link to comment
  • stillnocake changed the title to I have lost everything ("failed to load ldlinux.c32")

You left a couple of unassigned disks, but the 3 assigned disks that mounted are completely empty, just booting/using a different flash drive would never delete data, did you format any of the disks?

 

The remaining array disks that are not mounting are complaining of an invalid partition layout, see if they mount with the UD plugin since it doesn't require a specific partition layout like Unraid does, just requires a valid one.

 

 

Link to comment

So I lost all my data? Instantly throught the night? How can this happen? I have been using Unraid for 1 year and a half now and never had any issue with it.. what could possibly have happened?


I will try the UD plugin, I'll try to find out about it first, but I am really really out of words..

 

 

Link to comment

After having changed the stick yesterday and transfered my licence to a new device, I woke up to this message this morning..

 

I guess it's a configuration issue, I am going to investigate and unplug every third party devices like Sata expansion card and the drive enclosure hoping it will bring back my data to life..

 

Thank you 

 

signal-2021-03-19-095222.jpg

Edited by stillnocake
Link to comment
On 3/19/2021 at 10:05 AM, JorgeB said:

If they also don't mount with UD then there's no partition or it's damaged, please post output of:

 


fdisk -l /dev/sdX

 

Replace X with one (or all) of the invalid partition disks.

 

Here is the result of 'fdisk -l' used on my server:
 

Disk /dev/loop0: 11.48 MiB, 12042240 bytes, 23520 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop1: 19.78 MiB, 20738048 bytes, 40504 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/sda: 14.53 GiB, 15606349824 bytes, 30481152 sectors
Disk model: DT 101 G2       
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start      End  Sectors  Size Id Type
/dev/sda1  *     2048 30481151 30479104 14.5G  c W95 FAT32 (LBA)


Disk /dev/sdc: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors
Disk model: ST4000VN008-2DR1
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 6B9F70B2-C90C-43E4-B68D-EF0484CCDC9F

Device     Start        End    Sectors  Size Type
/dev/sdc1     64 7814037134 7814037071  3.6T Linux filesystem


Disk /dev/sdd: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors
Disk model: ST4000VN008-2DR1
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes


Disk /dev/sdf: 476.94 GiB, 512110190592 bytes, 1000215216 sectors
Disk model: ADATA SU800     
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start        End    Sectors   Size Id Type
/dev/sdf1          64 1000215215 1000215152 476.9G 83 Linux


Disk /dev/sde: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors
Disk model: ST4000VN008-2DR1
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes


Disk /dev/sdb: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors
Disk model: ST4000VN008-2DR1
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: C5C2019B-D306-4742-AD2B-9AB8D1FD2BD5

Device     Start        End    Sectors  Size Type
/dev/sdb1     64 7814037134 7814037071  3.6T Linux filesystem


Disk /dev/sdg: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors
Disk model: WDC WD40EFRX-68N
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 7CDCC0A7-7E7F-4CF2-9C34-2ED441705FB4

Device     Start        End    Sectors  Size Type
/dev/sdg1     64 7814037134 7814037071  3.6T Linux filesystem


Disk /dev/sdh: 3.64 TiB, 4000787030016 bytes, 7814037168 sectors
Disk model: WDC WD40EFRX-68N
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: A1C41FE5-39D7-46F2-B5F1-6CF468F5E76C

Device     Start        End    Sectors  Size Type
/dev/sdh1     64 7814037134 7814037071  3.6T Linux filesystem

 

Also, here is 'lsblk':


NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
loop0    7:0    0  11.5M  1 loop /lib/modules
loop1    7:1    0  19.8M  1 loop /lib/firmware
sda      8:0    1  14.5G  0 disk 
└─sda1   8:1    1  14.5G  0 part /boot
sdb      8:16   0   3.6T  0 disk 
└─sdb1   8:17   0   3.6T  0 part 
sdc      8:32   0   3.6T  0 disk 
└─sdc1   8:33   0   3.6T  0 part 
sdd      8:48   0   3.6T  0 disk 
sde      8:64   0   3.6T  0 disk 
sdf      8:80   0 476.9G  0 disk 
└─sdf1   8:81   0 476.9G  0 part 
sdg      8:96   1   3.6T  0 disk 
└─sdg1   8:97   1   3.6T  0 part 
sdh      8:112  1   3.6T  0 disk 
└─sdh1   8:113  1   3.6T  0 part 

 

The partitions are probably damaged, do you know if these drives can be repaired to recover my data?

 

Thank you

Link to comment
On 3/18/2021 at 2:47 PM, stillnocake said:

Please help me this data is pretty much all I have in life.

Since nobody else said it, I will.

 

You absolutely must have another copy of anything important and irreplaceable. Parity is not a substitute for backups. Plenty of ways to lose data that parity can't help with.

Link to comment

In order to confirm JorgeB's idea, we must have the following answers:

 

1. Once you transferred to another USB, did you get your Dockers started?

2. Do you have another server on your LAN?

3. Also, what are all the ports you forwarded (i.e. to what services)?

4. Finally, did you have Https enabled on your login page?

Link to comment
22 minutes ago, bsipod0 said:

In order to confirm JorgeB's idea, we must have the following answers:

 

1. Once you transferred to another USB, did you get your Dockers started?

2. Do you have another server on your LAN?

3. Also, what are all the ports you forwarded (i.e. to what services)?

4. Finally, did you have Https enabled on your login page?


1. I had nothing once the transfer was done, no dockers nothing;
2. I had a couple of docker servers hosted behind my router (I never had any problem with them to this day);

3. The ports forwarded on my router are the same the Docker containers exposed;

4. I was going to learn how to setup Https on my server, but didn't have time.

 

Thank you

 

Link to comment
39 minutes ago, stillnocake said:


1. I had nothing once the transfer was done, no dockers nothing;
2. I had a couple of docker servers hosted behind my router (I never had any problem with them to this day);

3. The ports forwarded on my router are the same the Docker containers exposed;

4. I was going to learn how to setup Https on my server, but didn't have time.

 

Thank you

 

I am trying to narrow down where the exploit originated. Can you submit your router's port forward list?

Link to comment
10 hours ago, JorgeB said:

Several disks are missing the partitions, that suggest they were deleted by someone, probably when you where hacked.

 

A number of user have been similarly hacked lately, did you have any forwarded router ports (or DMZ enable) to your server? Did you have a strong password for root?

A couple of exposed ports for specific purposes (Docker containers forwards) nothing else really.. I was setting up a nextcloud server but it was still only at a LAN(testing) stage.

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.