Undelete help please!!


Recommended Posts

I have managed to accidently delete a whole bunch of files. The disk hasn't been written to since. Is there a way/program to help me recover them?

Were they on your unRAId server?

 

If yes, then see this entry in the wiki:  http://lime-technology.com/wiki/index.php?title=FAQ#How_can_I_undelete_files_from_an_unRAID_disk.3F

 

In essence

 

stop samba  [all your shares will disappear from network]

killall smbd nmbd

 

un-mount the disk  (md1=disk1, md2=disk2, md10-disk10,  etc.  Use the correct disk for your needs. this example is for disk1)

umount /dev/md1

note the above command is umount, not unmount.

 

run reiserfsck on the disk to rebuild the file tree.  Any files that can be recovered will.  This process could take many hours for a large disk as the entire disk will need to be scanned.

reiserfsck --rebuild-tree -S /dev/md1

It will ask you to confirm the rebuild of the file tree. Make certain you answer Yes (three letters, Capital "Y", lower case "es")

Anything else will be considered as "no"

 

re-mount the disk  (again, use the correct "md" and "disk" for your situation)

mount /dev/md1 /mnt/disk1

re-start samba

/usr/sbin/smbd -D

/usr/sbin/nmbd -D

 

your deleted files (any that could be recovered) will be in a lost+found folder on the disk.

 

See here for a more general description of the process

http://antrix.net/journal/techtalk/reiserfs_data_recovery_howto.comments

 

 

  • Like 1
Link to comment

Note: This process will only work if all files were on the same drive.

 

(Basically, you're forcing a simulated drive failure and rebuild)

True, this process needs to be performed on each of the physical disks where the files were located.  You cannot do it on a user-share.

 

If multiple drives were involved, do each drive in turn.

Link to comment

Thanks for your replies chaps, that gives me a couple of options becuase synctoy messed up my whs and the unraid backup (well I did) and deleted it on the unraid and synctoy removed it from my WHS :(

 

I'll let you know how  get on, I've just started the reiserfs on the unraid....

 

I don't know exact details about WHS, but assume it run's NTFS - it is MUCH EASIER to recover files from NTFS partition  with corresponding tools, ReiserFS has very bad support for this (I did it an both filesystems myself, got all files including names/directories recovered on NTFS, while lost filenames on RFS and most files recovered were corrupt).

Link to comment
I don't know exact details about WHS, but assume it run's NTFS - it is MUCH EASIER to recover files from NTFS partition  with corresponding tools, ReiserFS has very bad support for this (I did it an both filesystems myself, got all files including names/directories recovered on NTFS, while lost filenames on RFS and most files recovered were corrupt).

 

WHS just use NTFS across a "D" drive that is split across whatever drives you have told it you have, in my case just a single 1.5tb seagate. I have been careful to keep my options open and not write to either drive at the moment. Do you have a recommended undelete/recovery program?

 

 

 

Link to comment

Well, the reiserfsk has recovered many files so all is not lost but they are all jumbled up and its going to take a lot of sorting through folders. Not the end of the world but I may have another easier possibility.

 

I have a backup(ish) that's a bit old that was put on a partition that had windows home server on the system partition and that is now broken. The data is accessible when plugged into my machine as a slave drive but won't copy because the reparse points are broken, I get a "the system cannot access the file" message. My question is if I mount it into unraid or another linus distro under ntfs will it ignore this reparse requirements?

Link to comment
  • 4 months later...

I lost some files recently and don´t know why. Perhaps XBMC was cleaning some data ??? I turned off the respective switch in XBMC which enabled the application the erase files and was trying the description above to undelete the lost data.

 

/mnt/disk1 went well, produced a list+found directory.

 

After that I tried disk2 and went to bed. Today I couldn´t mount /mnt/disk2. I don´t know what happened but the disk2 is shown as unformatted.

 

Should I run reiserfsck --rebuild-tree -S /dev/md2 again? Pls. advise. Thank you.

 

Link to comment

I lost some files recently and don´t know why. Perhaps XBMC was cleaning some data ??? I turned off the respective switch in XBMC which enabled the application the erase files and was trying the description above to undelete the lost data.

 

/mnt/disk1 went well, produced a list+found directory.

 

After that I tried disk2 and went to bed. Today I couldn´t mount /mnt/disk2. I don´t know what happened but the disk2 is shown as unformatted.

 

Should I run reiserfsck --rebuild-tree -S /dev/md2 again? Pls. advise. Thank you.

 

No... you should not run anything until after you first post a syslog.

 

Unformatted simply means not-mounted.  Perhaps you did not mount it after attempting the repair.

Perhaps the first reiserfsck could not complete.

 

Post a syslog so we can take a look.

Link to comment

I see this in the syslog:

Jun 16 08:39:39 Tower kernel: REISERFS warning: reiserfs-5090 is_tree_node: node level 0 does not match to the expected one 65534
Jun 16 08:39:39 Tower kernel: REISERFS error (device md2): vs-5150 search_by_key: invalid format found in block 0. Fsck?
Jun 16 08:39:39 Tower kernel: REISERFS (device md2): Remounting filesystem read-only
Jun 16 08:39:39 Tower kernel: REISERFS error (device md2): vs-13070 reiserfs_read_locked_inode: i/o failure occurred trying to find stat data of [1 2 0x0 SD]

 

You need to start with

reiserfsck --check /dev/md2

 

Then proceed as it advises.

DO NOT attempt another scan-entire-tree until after the file system is sane.

Just a few days ago another user was doing something similar.  The reiserfsck was unable to complete because it was running out of memory.

How much RAM do you have in your server?

 

Here is the other thread: http://lime-technology.com/forum/index.php?topic=6701.0

 

Joe L.

Link to comment

Thanks Joe,

 

I ran reiserfsck --check /dev/md2 and here is the reply:

 

root@Tower:/# reiserfsck --check /dev/md2
reiserfsck 3.6.19 (2003 www.namesys.com)

*************************************************************
** If you are using the latest reiserfsprogs and  it fails **
** please  email bug reports to [email protected], **
** providing  as  much  information  as  possible --  your **
** hardware,  kernel,  patches,  settings,  all reiserfsck **
** messages  (including version),  the reiserfsck logfile, **
** check  the  syslog file  for  any  related information. **
** If you would like advice on using this program, support **
** is available  for $25 at  www.namesys.com/support.html. **
*************************************************************

Will read-only check consistency of the filesystem on /dev/md2
Will put log info to 'stdout'

Do you want to run this program?[N/Yes] (note need to type Yes if you do):Yes
###########
reiserfsck --check started at Wed Jun 16 18:39:39 2010
###########
Replaying journal..
Reiserfs journal '/dev/md2' in blocks [18..8211]: 0 transactions replayed
Checking internal tree..

Bad root block 0. (--rebuild-tree did not complete)

Aborted

 

I will proceed according to your advise (reiserfsck --rebuild-tree -S /dev/md2)

 

I have 1GB RAM but I guess the issue was that my Mac was going to sleep.

 

 

Link to comment

[quote author=EdgarWallace link=topic=5087.msg65222#msg65222 date=1276706606

I will proceed according to your advise (reiserfsck --rebuild-tree -S /dev/md2)

My advise was to NOT use the -S (scan entire tree) option until after you have a sane file-system.

you want

reiserfsck --rebuild-tree /dev/md2

I have 1GB RAM but I guess the issue was that my Mac was going to sleep.

We will soon see if 1Gig is enough.
Link to comment
What did the reiserfsck say when it finished?

 

Joe L.

 

Well Joe, reiserfsck just said nothing. Only the blinking cursor came back and this the reason  why I attached the new syslog hoping that this might give you an insight of what happened during the reiserfsck run  :-[ After a reboot the lost+found folder is full of files and one of the movie is back (only the mkv file not the fan art and not the cover).

 

(Before I started the undelete process 2 movies along with their fan art and covers were deleted, only the nfo files were left in the movies folder)

 

So maybe XBMC or TwonkyMedia Server is the delinquent but I don´t feel comfortable if files just disappear.

 

Cheers

 

Btw. the shares are read only; so none of the family was able to delete anything...

Link to comment

What did the reiserfsck say when it finished?

 

Joe L.

 

Well Joe, reiserfsck just said nothing. Only the blinking cursor came back and this the reason  why I attached the new syslog hoping that this might give you an insight of what happened during the reiserfsck run  :-[

It will always print a report.  Did you type the command on the system console? or on your PC in a telnet session?  Did your PC go to sleep while it was running?
After a reboot the lost+found folder is full of files and one of the movie is back (only the mkv file not the fan art and not the cover).

 

(Before I started the undelete process 2 movies along with their fan art and covers were deleted, only the nfo files were left in the movies folder)

 

So maybe XBMC or TwonkyMedia Server is the delinquent but I don´t feel comfortable if files just disappear.

 

Cheers

 

Btw. the shares are read only; so none of the family was able to delete anything...

Like I said, reiserfsck will always print a report when done.  If it did not, then it did not finish.

 

Joe L.

Link to comment

I´m using the Mac OSX Terminal.

 

Yes the first time I used reiserfsck the Mac went to sleep and I had the issue with disk2.

 

Yesterday this was not the case and all went well - except the report. I saw a couple of screen messages but that was it.

 

Anything more I can do? I´m currently running a parity check (without correcting errors)

 

Link to comment

I´m using the Mac OSX Terminal.

 

Yes the first time I used reiserfsck the Mac went to sleep and I had the issue with disk2.

 

Yesterday this was not the case and all went well - except the report. I saw a couple of screen messages but that was it.

 

Anything more I can do? I´m currently running a parity check (without correcting errors)

 

As in the other thread I pointed you to, you can download and install the most current version of reiserfsck and try using it.

 

You should re-check your syslog for any messages near the end indicating you ran out of RAM.  The first post did. He originally had 512 Meg. It was not enough.  He upgraded it to 2Gig, it was enough.  We don't know how much is needed to not abort.

 

Joe L.

Link to comment
  • 2 weeks later...

I attempted the instructions to recover deleted files from disk1.  Apparently I don't have enough memory (512) to accomplish this.

 

How do I proceed? Have I lost more than the files I originally deleted?

I haven't gone any further at this time.  System is in the same state.

 

I've attached todays portion of the syslog and also a file of the commands, as entered.

 

CommandsAttempted.txt

syslog_20100627.txt

Link to comment

I attempted the instructions to recover deleted files from disk1.  Apparently I don't have enough memory (512) to accomplish this.

 

How do I proceed? Have I lost more than the files I originally deleted?

I haven't gone any further at this time.  System is in the same state.

 

I've attached todays portion of the syslog and also a file of the commands, as entered.

 

 

You syslog says it all.

Jun 27 09:53:17 Tower kernel: Free swap  = 0kB

Jun 27 09:53:17 Tower kernel: Total swap = 0kB

Jun 27 09:53:17 Tower kernel: 128960 pages RAM

Jun 27 09:53:17 Tower kernel: 0 pages HighMem

Jun 27 09:53:17 Tower kernel: 2350 pages reserved

Jun 27 09:53:17 Tower kernel: 4277 pages shared

Jun 27 09:53:17 Tower kernel: 123557 pages non-shared

Jun 27 09:53:17 Tower kernel: Out of memory: kill process 5222 (reiserfsck) score 2134 or a child

Jun 27 09:53:17 Tower kernel: Killed process 5222 (reiserfsck)

 

You can try adding a swap-file as I described in this post trying to help another user with a similar issue.  We do not yet know if it will help, but if you are running any other add-on process, you'll not want them running so you'll have all the possible memory for your use.   It might even help to disable user-shares for the short term since they use valuable memory too.

 

In any case, these directions describe how to add a swap-file

http://lime-technology.com/forum/index.php?topic=6815.msg66072#msg66072

(don't forget to disable the swapfile before you attempt to stop the array, otherwise it will not be able to stop with the swap-file active on one of its data disks):

 

You might also try typing this command to encourage the release of disk buffer cache, do it before running the --rebuild-tree:

sysctl vm.vfs_cache_pressure=200

 

Joe L.

 

Link to comment

If I have Ubuntu Lucid running on a Windows 7 dual boot machine with 4G of memory, could I remove the drive and attach it using a SATA to USB adapter and run the commands from there?

 

If I just reboot, will it be ok, but just still missing the files?  They are some photos, so I may be able to find them elsewhere.

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.