Pim Bliek wrote:
Hi I need some help. I think I screwed my /var while trying to resize it online.. :( Nice these new features in ext3... NOT :( Is there anyone out here that is willing to help on this one? A filesystem/ext3 guru? Preferable someone in the Netherlands as well, but any help is appreciated. I cannot give much details here, since I do not understand my current situation here either. Thing is, all seemed fine untill I ran fsck on it... which removed all data from the partition :(. It is empty... although df -h still gives me that 6 GB is used. I cannot umount it either anymore. Totally weird situation... HELP.... I work with Debian for years now.. but never had this crap! Pim
I don't use ext3 (following my own bad experience with it) but I will start with two basic questions: did you check /lost+found?
Here is a more complicated question: did you validate the partition table chain manually with a disk editor, or at least do a quick check using fdisk?
Here is my general approach to problems like this:I would not attempt another fsck on the drive. You cannot rule out a hardware failure, and writes may cause more damage. Power it down and check the cabling. Power up without mounting and check it with smartctl, then try to mount it read-only. If you still can't see the data, try another superblock. Then check it in another machine. At every step, back up whatever data you find. Then try Debian's various disk drive forensic tools to extract more data. After rescuing any salvageable data, attempt to mirror the partition to a identical partition on a known good drive using dd or cp. Then experiment on repairing the copy using the forensic tools. (See the ext3 documentation and respective man pages for details.) Finally, if all else fails, replace the controller board from an identical drive, with the same firmware rev. (Check Ebay for older drives.)
The last few steps, however, should not be necessary since everyone carefully back up all their important data. Right? (oops!)