January 15, 201016 yr I have managed to accidently delete a whole bunch of files. The disk hasn't been written to since. Is there a way/program to help me recover them?
January 15, 201016 yr http://www.tech-pro.net/data-recovery-boot-cd.html http://free-backup.info/data-recovery-software.htm
January 15, 201016 yr I have managed to accidently delete a whole bunch of files. The disk hasn't been written to since. Is there a way/program to help me recover them? Were they on your unRAId server? If yes, then see this entry in the wiki: http://lime-technology.com/wiki/index.php?title=FAQ#How_can_I_undelete_files_from_an_unRAID_disk.3F In essence stop samba [all your shares will disappear from network] killall smbd nmbd un-mount the disk (md1=disk1, md2=disk2, md10-disk10, etc. Use the correct disk for your needs. this example is for disk1) umount /dev/md1 note the above command is umount, not unmount. run reiserfsck on the disk to rebuild the file tree. Any files that can be recovered will. This process could take many hours for a large disk as the entire disk will need to be scanned. reiserfsck --rebuild-tree -S /dev/md1 It will ask you to confirm the rebuild of the file tree. Make certain you answer Yes (three letters, Capital "Y", lower case "es") Anything else will be considered as "no" re-mount the disk (again, use the correct "md" and "disk" for your situation) mount /dev/md1 /mnt/disk1 re-start samba /usr/sbin/smbd -D /usr/sbin/nmbd -D your deleted files (any that could be recovered) will be in a lost+found folder on the disk. See here for a more general description of the process http://antrix.net/journal/techtalk/reiserfs_data_recovery_howto.comments
January 15, 201016 yr Note: This process will only work if all files were on the same drive. (Basically, you're forcing a simulated drive failure and rebuild)
January 15, 201016 yr Author Thanks for your replies chaps, that gives me a couple of options becuase synctoy messed up my whs and the unraid backup (well I did) and deleted it on the unraid and synctoy removed it from my WHS I'll let you know how get on, I've just started the reiserfs on the unraid....
January 15, 201016 yr Note: This process will only work if all files were on the same drive. (Basically, you're forcing a simulated drive failure and rebuild) True, this process needs to be performed on each of the physical disks where the files were located. You cannot do it on a user-share. If multiple drives were involved, do each drive in turn.
January 15, 201016 yr Thanks for your replies chaps, that gives me a couple of options becuase synctoy messed up my whs and the unraid backup (well I did) and deleted it on the unraid and synctoy removed it from my WHS I'll let you know how get on, I've just started the reiserfs on the unraid.... I don't know exact details about WHS, but assume it run's NTFS - it is MUCH EASIER to recover files from NTFS partition with corresponding tools, ReiserFS has very bad support for this (I did it an both filesystems myself, got all files including names/directories recovered on NTFS, while lost filenames on RFS and most files recovered were corrupt).
January 15, 201016 yr Author I don't know exact details about WHS, but assume it run's NTFS - it is MUCH EASIER to recover files from NTFS partition with corresponding tools, ReiserFS has very bad support for this (I did it an both filesystems myself, got all files including names/directories recovered on NTFS, while lost filenames on RFS and most files recovered were corrupt). WHS just use NTFS across a "D" drive that is split across whatever drives you have told it you have, in my case just a single 1.5tb seagate. I have been careful to keep my options open and not write to either drive at the moment. Do you have a recommended undelete/recovery program?
January 20, 201016 yr Author Well, the reiserfsk has recovered many files so all is not lost but they are all jumbled up and its going to take a lot of sorting through folders. Not the end of the world but I may have another easier possibility. I have a backup(ish) that's a bit old that was put on a partition that had windows home server on the system partition and that is now broken. The data is accessible when plugged into my machine as a slave drive but won't copy because the reparse points are broken, I get a "the system cannot access the file" message. My question is if I mount it into unraid or another linus distro under ntfs will it ignore this reparse requirements?
June 16, 201016 yr I lost some files recently and don´t know why. Perhaps XBMC was cleaning some data I turned off the respective switch in XBMC which enabled the application the erase files and was trying the description above to undelete the lost data. /mnt/disk1 went well, produced a list+found directory. After that I tried disk2 and went to bed. Today I couldn´t mount /mnt/disk2. I don´t know what happened but the disk2 is shown as unformatted. Should I run reiserfsck --rebuild-tree -S /dev/md2 again? Pls. advise. Thank you.
June 16, 201016 yr I lost some files recently and don´t know why. Perhaps XBMC was cleaning some data I turned off the respective switch in XBMC which enabled the application the erase files and was trying the description above to undelete the lost data. /mnt/disk1 went well, produced a list+found directory. After that I tried disk2 and went to bed. Today I couldn´t mount /mnt/disk2. I don´t know what happened but the disk2 is shown as unformatted. Should I run reiserfsck --rebuild-tree -S /dev/md2 again? Pls. advise. Thank you. No... you should not run anything until after you first post a syslog. Unformatted simply means not-mounted. Perhaps you did not mount it after attempting the repair. Perhaps the first reiserfsck could not complete. Post a syslog so we can take a look.
June 16, 201016 yr I see this in the syslog: Jun 16 08:39:39 Tower kernel: REISERFS warning: reiserfs-5090 is_tree_node: node level 0 does not match to the expected one 65534 Jun 16 08:39:39 Tower kernel: REISERFS error (device md2): vs-5150 search_by_key: invalid format found in block 0. Fsck? Jun 16 08:39:39 Tower kernel: REISERFS (device md2): Remounting filesystem read-only Jun 16 08:39:39 Tower kernel: REISERFS error (device md2): vs-13070 reiserfs_read_locked_inode: i/o failure occurred trying to find stat data of [1 2 0x0 SD] You need to start with reiserfsck --check /dev/md2 Then proceed as it advises. DO NOT attempt another scan-entire-tree until after the file system is sane. Just a few days ago another user was doing something similar. The reiserfsck was unable to complete because it was running out of memory. How much RAM do you have in your server? Here is the other thread: http://lime-technology.com/forum/index.php?topic=6701.0 Joe L.
June 16, 201016 yr Thanks Joe, I ran reiserfsck --check /dev/md2 and here is the reply: root@Tower:/# reiserfsck --check /dev/md2 reiserfsck 3.6.19 (2003 www.namesys.com) ************************************************************* ** If you are using the latest reiserfsprogs and it fails ** ** please email bug reports to [email protected], ** ** providing as much information as possible -- your ** ** hardware, kernel, patches, settings, all reiserfsck ** ** messages (including version), the reiserfsck logfile, ** ** check the syslog file for any related information. ** ** If you would like advice on using this program, support ** ** is available for $25 at www.namesys.com/support.html. ** ************************************************************* Will read-only check consistency of the filesystem on /dev/md2 Will put log info to 'stdout' Do you want to run this program?[N/Yes] (note need to type Yes if you do):Yes ########### reiserfsck --check started at Wed Jun 16 18:39:39 2010 ########### Replaying journal.. Reiserfs journal '/dev/md2' in blocks [18..8211]: 0 transactions replayed Checking internal tree.. Bad root block 0. (--rebuild-tree did not complete) Aborted I will proceed according to your advise (reiserfsck --rebuild-tree -S /dev/md2) I have 1GB RAM but I guess the issue was that my Mac was going to sleep.
June 16, 201016 yr [quote author=EdgarWallace link=topic=5087.msg65222#msg65222 date=1276706606 I will proceed according to your advise (reiserfsck --rebuild-tree -S /dev/md2) My advise was to NOT use the -S (scan entire tree) option until after you have a sane file-system. you want reiserfsck --rebuild-tree /dev/md2 I have 1GB RAM but I guess the issue was that my Mac was going to sleep. We will soon see if 1Gig is enough.
June 16, 201016 yr Joe, it was going well - however I still don´t know where the files are. Nothing in the lost+found folder.
June 16, 201016 yr Joe, it was going well - however I still don´t know where the files are. Nothing in the lost+found folder. What did the reiserfsck say when it finished? Joe L.
June 17, 201016 yr What did the reiserfsck say when it finished? Joe L. Well Joe, reiserfsck just said nothing. Only the blinking cursor came back and this the reason why I attached the new syslog hoping that this might give you an insight of what happened during the reiserfsck run After a reboot the lost+found folder is full of files and one of the movie is back (only the mkv file not the fan art and not the cover). (Before I started the undelete process 2 movies along with their fan art and covers were deleted, only the nfo files were left in the movies folder) So maybe XBMC or TwonkyMedia Server is the delinquent but I don´t feel comfortable if files just disappear. Cheers Btw. the shares are read only; so none of the family was able to delete anything...
June 17, 201016 yr What did the reiserfsck say when it finished? Joe L. Well Joe, reiserfsck just said nothing. Only the blinking cursor came back and this the reason why I attached the new syslog hoping that this might give you an insight of what happened during the reiserfsck run It will always print a report. Did you type the command on the system console? or on your PC in a telnet session? Did your PC go to sleep while it was running?After a reboot the lost+found folder is full of files and one of the movie is back (only the mkv file not the fan art and not the cover). (Before I started the undelete process 2 movies along with their fan art and covers were deleted, only the nfo files were left in the movies folder) So maybe XBMC or TwonkyMedia Server is the delinquent but I don´t feel comfortable if files just disappear. Cheers Btw. the shares are read only; so none of the family was able to delete anything... Like I said, reiserfsck will always print a report when done. If it did not, then it did not finish. Joe L.
June 17, 201016 yr I´m using the Mac OSX Terminal. Yes the first time I used reiserfsck the Mac went to sleep and I had the issue with disk2. Yesterday this was not the case and all went well - except the report. I saw a couple of screen messages but that was it. Anything more I can do? I´m currently running a parity check (without correcting errors)
June 17, 201016 yr I´m using the Mac OSX Terminal. Yes the first time I used reiserfsck the Mac went to sleep and I had the issue with disk2. Yesterday this was not the case and all went well - except the report. I saw a couple of screen messages but that was it. Anything more I can do? I´m currently running a parity check (without correcting errors) As in the other thread I pointed you to, you can download and install the most current version of reiserfsck and try using it. You should re-check your syslog for any messages near the end indicating you ran out of RAM. The first post did. He originally had 512 Meg. It was not enough. He upgraded it to 2Gig, it was enough. We don't know how much is needed to not abort. Joe L.
June 27, 201016 yr I attempted the instructions to recover deleted files from disk1. Apparently I don't have enough memory (512) to accomplish this. How do I proceed? Have I lost more than the files I originally deleted? I haven't gone any further at this time. System is in the same state. I've attached todays portion of the syslog and also a file of the commands, as entered. CommandsAttempted.txt syslog_20100627.txt
June 27, 201016 yr I attempted the instructions to recover deleted files from disk1. Apparently I don't have enough memory (512) to accomplish this. How do I proceed? Have I lost more than the files I originally deleted? I haven't gone any further at this time. System is in the same state. I've attached todays portion of the syslog and also a file of the commands, as entered. You syslog says it all. Jun 27 09:53:17 Tower kernel: Free swap = 0kB Jun 27 09:53:17 Tower kernel: Total swap = 0kB Jun 27 09:53:17 Tower kernel: 128960 pages RAM Jun 27 09:53:17 Tower kernel: 0 pages HighMem Jun 27 09:53:17 Tower kernel: 2350 pages reserved Jun 27 09:53:17 Tower kernel: 4277 pages shared Jun 27 09:53:17 Tower kernel: 123557 pages non-shared Jun 27 09:53:17 Tower kernel: Out of memory: kill process 5222 (reiserfsck) score 2134 or a child Jun 27 09:53:17 Tower kernel: Killed process 5222 (reiserfsck) You can try adding a swap-file as I described in this post trying to help another user with a similar issue. We do not yet know if it will help, but if you are running any other add-on process, you'll not want them running so you'll have all the possible memory for your use. It might even help to disable user-shares for the short term since they use valuable memory too. In any case, these directions describe how to add a swap-file http://lime-technology.com/forum/index.php?topic=6815.msg66072#msg66072 (don't forget to disable the swapfile before you attempt to stop the array, otherwise it will not be able to stop with the swap-file active on one of its data disks): You might also try typing this command to encourage the release of disk buffer cache, do it before running the --rebuild-tree: sysctl vm.vfs_cache_pressure=200 Joe L.
June 27, 201016 yr If I have Ubuntu Lucid running on a Windows 7 dual boot machine with 4G of memory, could I remove the drive and attach it using a SATA to USB adapter and run the commands from there? If I just reboot, will it be ok, but just still missing the files? They are some photos, so I may be able to find them elsewhere.
Archived
This topic is now archived and is closed to further replies.