Recovering data from an ext4 on LVM
Greetings,
I had an ext4 partition accessible via samba share and one day that
share became empty. I considered goofing up in Windows, but then found
out that there were a lot of warnings in dmesg. The partition was not
set to be fsck-ed and was made available via a Xen guest. I did start
running fsck but after 2 days of 100% CPU usage (single core only on a
quad-core) i quit.
The data isn't quite mission critical, i do back that one up, but it's
nonetheless rather important, at least some pieces. My main goal is to
find out how that happened. I tried looking at the samba logs but
they're quite confusing and crowded, and i couldn't pin-point any
specific data that would point to a user deletion. I was hoping
someone would point me to other logs i can skim.
>From what i've been searching, ext4 on a virtual machine could do well
with barriers off[1], and maybe ext3 would've been a better bet. I'm
not sure if the cause could've been somewhere in the virtualization
(the samba share was made available via a Xen PV guest). I don't think
the disk is corrupted, only the file system and it's gazillion inodes
(it's about 400GB of a 1TB drive) that fsck wants to clone.
My second concern would be to recover the data. I tried r-studio,which
did see all the neat partitions on LVM and RAID1 (another partition on
this 1TB drive makes up half of a RAID1,over which is an LVM VG, the
other VG being mostly used by the damaged partition). However, when i
re-ran r-studio again, it can't find its bearings and i can no longer
pinpoint the partition - it apparently doesn't support LVM yet[2].
It's a shame, it seemed to be the best candidate for the job.
The LVM does seem to be my main problem. I also tried testdisk, but it
eventually tells me the partition can't be recovered. Then i tried
photorec, which does recover a whole bunch of files, but it's mostly
pieces of files (i don't have 49K .cab files,so not all of the
recovered files are accurate). I assume this has something to do with
the underlying PEs and LEs of LVM. I do have another partition (on the
same disk) where photorec has been dumping part of the data (i
filtered out ISOs and such), but it's not big enough for a dd.
My next bet would've been ext4magic but it's only available in testing
(my host is stable), and i don't really want to risk that much of a
drive stir (since host / and other / are in a partition in the same
drive). I just might, if all else fails. There's also foremost and
giis, but i haven't looked into these yet. Any other suggestions? I
don't think there's a tool that'll even recover the directory
structure and file names, that would be great, but files alone are a
good start.
The next step is considering a makeover on my drives :) (the outcome
of which will largely depend on the success of this recovery). Can
anyone tell me if RAID5 is slower to write than a single drive? This
is a home machine, but if 5 is that slow i'd consider a bigger RAID1
instead.
Any help, pointers, tips or any other technical feedback would be welcome.
TIA,
Nuno
[1] http://blog.jolexa.net/2012/02/linode-dont-use-barriers-and-ext-4/
[2] http://forum.r-tt.com/lvm-t8503-10.html?sid=429b8e4210a71188712e4bed1b8d6b8b
--
"On the internet, nobody knows you're a dog."
Reply to: