Re: ext3 fs /var corrupt :(
Pim Bliek wrote:
I need some help. I think I screwed my /var while trying to resize it
Nice these new features in ext3... NOT :(
Is there anyone out here that is willing to help on this one? A
filesystem/ext3 guru? Preferable someone in the Netherlands as well,
but any help is appreciated.
I cannot give much details here, since I do not understand my current
situation here either. Thing is, all seemed fine untill I ran fsck on
it... which removed all data from the partition :(. It is empty...
although df -h still gives me that 6 GB is used. I cannot umount it
either anymore. Totally weird situation...
HELP.... I work with Debian for years now.. but never had this crap!
I don't use ext3 (following my own bad experience with it) but I will start with
two basic questions: did you check /lost+found?
Here is a more complicated question: did you validate the partition table chain
manually with a disk editor, or at least do a quick check using fdisk?
Here is my general approach to problems like this:
I would not attempt another fsck on the drive. You cannot rule out a hardware
failure, and writes may cause more damage. Power it down and check the cabling.
Power up without mounting and check it with smartctl, then try to mount it
read-only. If you still can't see the data, try another superblock. Then check
it in another machine. At every step, back up whatever data you find. Then try
Debian's various disk drive forensic tools to extract more data. After rescuing
any salvageable data, attempt to mirror the partition to a identical partition
on a known good drive using dd or cp. Then experiment on repairing the copy
using the forensic tools. (See the ext3 documentation and respective man pages
for details.) Finally, if all else fails, replace the controller board from an
identical drive, with the same firmware rev. (Check Ebay for older drives.)
The last few steps, however, should not be necessary since everyone carefully
back up all their important data. Right? (oops!)