little linux file system help

Howell

Storage? I am Storage!
Joined
Feb 24, 2003
Messages
4,740
Location
Chattanooga, TN
Let's say "hypothetically" that I:

Installed the newest version of XenServer (5.6) over an older version (4.1) completely wiping out the partition and file tables and "deleting" my VMs. How can I recover those files? I do not know what the file system was at the time of deletion. They also don't have the backups they said they did. It sits on top of HW RAID5 so I can't even pop out a disk to preserve it.

I'd like to start with preserving the problem as it is. How can I take an image of the disk booting from CD and writing the data to a USB drive that will preserve all "deleted" files?

How do I go about recovering the VM files from a linux filesystem?
 

ddrueding

Fixture
Joined
Feb 4, 2002
Messages
19,511
Location
Horsens, Denmark
I know that Acronis allows "block level" imaging that may help you preserve what you have. The rest will have to wait for a *nix guy.
 

Mercutio

Fatwah on Western Digital
Joined
Jan 17, 2002
Messages
21,564
Location
I am omnipresent
Well,

dd /if=/dev/[whatever the disk device or array is] conv=noerror,sync | bzip2 > blah.bz2

Would in theory make a complete copy of the array, presuming there's a USB drive or something big enough to hold blah.bz2. Then maybe you can run debugfs against that.
 

blakerwry

Storage? I am Storage!
Joined
Oct 12, 2002
Messages
4,203
Location
Kansas City, USA
Website
justblake.com
I believe XenServer uses ext3 within LVM. If PhotoRec doesn't pan out for you, it looks like there are a few tools out there specifically intended for ext3 data recovery. I'd suggest googling for ext3 data recovery and try one or more of them.
 

Howell

Storage? I am Storage!
Joined
Feb 24, 2003
Messages
4,740
Location
Chattanooga, TN
Thanks for the chime in. Yep that version was a RH kernel with ext3 and LVM.

Photorec didn't work out well for me mainly, I think, because although it has .vmdk file headers in its tables it doesn't seem to know anything about .vhds. It doesn't seem to be able to go to a lower level than that. It did find 2 .vmdks about the right size but there are not supposed to be any vmdks on there so I don't know what to make of that.

I was able to see one of the VMs and its contents using EASEUS disk recovery wizard pro DEMO but unfortunately it is the less important of the two. I'm restoring the sector backup I made right after the incident to give me my best shot at recovery.

When booting from a Knoppix CD should I have to run a command to get proper access to the LVM?
 

blakerwry

Storage? I am Storage!
Joined
Oct 12, 2002
Messages
4,203
Location
Kansas City, USA
Website
justblake.com
Normally, Knoppix does a scan on boot and tries to mount all drives connected to the system. For working disks it's very convenient. Should work with LVM and just about any file sysyem out there.

But I'm not sure how it would load the old LVs if the disk has since been repartitioned. I imagine a vgscan would only show the new LV's that were created when you installed the new version of XenServer.
 

Howell

Storage? I am Storage!
Joined
Feb 24, 2003
Messages
4,740
Location
Chattanooga, TN
The folder structure is a nightmare but the EASUS software recovered the data. It's crazy how long stuff can stick around if you don't security wipe the disk.
 

Howell

Storage? I am Storage!
Joined
Feb 24, 2003
Messages
4,740
Location
Chattanooga, TN
I spoke too soon.
The folder structure, file names and file sizes are are all right but the files themselves are corrupt.
Bummer.
 
Top