Author: North-South-North
from: League of Legends Community
Abstract: This paper is about in the reiserfs file system, practice recovery methods due Erased data; the loss of a number of postulated accident reiserfs file in the file system by conjecture, to try to recover the data; paper for archiving purposes, after all, my personal favorite is the reiserfs file system for later use;
Contents Index
I, on the Linux file system (Filesystem)
Two, reiserfs file system supports undelete operation to recover the data;
1, due to misuse rm command deletes caused by lost data recovery;2, due to the recovery of formatted hard disk data loss caused by;
3, reiserfs file system, undelete data recovery agreed conditions;
Three, reiserfs file system data recovery process;
1, ready to repair disk and mass storage devices; 1) Support livecd reiserfs file system or system repair disk;2) a storage device; 1) livecd boot into the system, into the system or prosthetic disk;
2) to do the hard disk partition with dd mirror;
3) to recover the data by reiserfsck or fsck.reiserfs mirror;
4) mounted loop device to view data recovery situation;
5) after the data restoration is completed mopping;
Fourth, on paper;
Fifth, reference documents;
six related documents;
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++
text
+++++++++++++++++++++++++++++++++++++++++++ +++++++++++++
I, on the Linux file system (filesystem)
Please refer to: "Linux File System Overview"
Two, undelete reiserfs file system supports the operation to recover the data;
usually delete data, there are two cases, one is through the rm command to delete; the other is destroyed by formatting the data in reiserfs file system, restore it two types of data loss situation caused by misuse or little difference;
1, due to misuse rm command deletes caused by the recovery of lost data;
through practice, through rm delete data, we can detect reiserfs repair tool to recover, if the storage device without any problems, or the file system is not bad one hundred percent recovery is the case where the block (bad block) is;
2, due to the recovery of formatted hard disk data loss caused by;
I tested format the memory test equipment to recover lost reiserfs file system data, I practice in the mobile hard disk to do; for example, on my mobile hard disk only one partition, and based on reiserfs file system; I store more than a hundred M data, and then use mkreiserfs or mkfs.reiserfs utility to format the hard disk partition. If then we find rebuilt hard disk partition file system misuse. Then reiserfs want to repair by the repair tool can restore most of the data; but not a hundred percent, sometimes a hundred percent successful, it depends on your luck;
If I have this partition reiserfs file system format to another file system, and then if found to be erroneous, the probability of success on a very low; or mostly can not be successful;
If we take the hard drive's partition table was also rebuilt, if the next time you think of a mistake, the possibility of recovery reiserfs file system is also extremely low, or that they want to restore the success rate of zero by reiserfs file system tools; but sometimes more or less able to recover a little, or a long, long time to restore the previous data. Oh, this thing is a little strange;
If you are due to re-partition data loss caused, first of all could you want to recover the partition table to its previous state, Windows may have the tools in this regard; the Linux system should also have such a tool, but they are commercial. Good data recovery tool for Windows, it should also be commercial.
3, reiserfs file system, undelete data recovery agreed conditions;
we already said, data loss due to misuse rm command caused, and is able to recover most, or one hundred percent, which is the first case; also, if the original hard disk partition is of reiserfs, because you misuse or use mkreiserfs mkfs.reiserfs format resulting in loss of data should also be drawn within the conventions of this, but also can recover most of the data, but this should be relatively small;
Three, reiserfs file system data recovery process;
1, ready to repair disk and mass storage devices;
1) livecd support reiserfs file system or system repair disk;
if you are using a mobile storage, loss on reiserfs file system, you have direct use linux system you are currently using can be repaired, but must support reiserfs file systems only Row. Oh, this is not nonsense it? Reiserfs file system does not support Linux, my mobile hard disk with reiserfs what purpose.
livecd is the best, as long as the support reiserfs file system livecd on OK; In addition, I found the first slackware installation disk that also can be used; of course, does not exclude other release installation disk and repair disk, can be used as long as the line;
2) storage devices;
such as your hard disk partition data loss is 9G, so you have to find at least have to find unused space is 10G hard disk (or hard disk partition) it; otherwise how can accommodate mirrored data loss it? So it is best to find a large-capacity hard disk or partition to prepare;
If you're just lost in the hundreds of M mobile hard disk, is not to find a place to accommodate up; this situation would be much easier;
2, the process of restoring data;
1) with livecd boot into the system, or with repair disk into the system;
livecd relatively easy to handle, he has always been a running system on the disc; you can find a release downloads;
Go to: http://www.frozentech.com/content/livecd.php
Or may be selected slax Knoppix;
You can also use the slackware first disc, after all the way to enter, appeared bash # words, so OK; of course, you can also hang on the hard drive has a Linux machine up recovery, in short, the method is more; we are nothing more than with a reiserfs file system support Linux system to recover the data, we should understand this truth;
2) to do the hard disk partition with dd mirror;
Why hard disk partition data loss mirroring, can not directly repair? Direct repair is possible, but if the possibility of error, restore the data that appears on the low. Unless we can ensure that the hard disk partition data loss without any bad block, or on the hard disk partition without any physical and logical bad; in addition we need to ensure operational errors will not be one hundred percent again; so the hard disk partition image is extremely important, That is a mirror disk to restore data to ensure the safety and reliability of existing data;
Another point worth mentioning is that, please do not mount the hard disk partition data loss, and do not re-write data; otherwise, data recovery success rate decreases; see if there automatically mount the partition, with df - h to see; if found to have been mounted, it puts umount unloading;
We want to figure out which partition of the data loss, you can use fdisk -l to view the partition table; for example, I think very clear data loss / dev / sda1 of the; then we do / dev / sda1 mirror image ;
Then we have prepared a partition space is linux file system, such as ext3 or reiserfs will do; dd out just to save the partition image; we mount to mount the partition to store the image file; which preparation work has already been mentioned; for example, I would like a hard disk partition with the file system reiserfs / dev / hda8 to hold the mirror / dev / sda1, it would mount / dev / hda8;
bash# mkdir hda8 注：创建一个目录
bash# mount -t reiserfs /dev/hda8 hda8 注：把/dev/hda8 挂载到hda8目录上；
bash# df -h 注：查看/dev/hda8是否挂载上了；
bash# cd hda8 注：进入hda8目录；
bash# dd if=/dev/sda1 conv=noerror > sda1.img 注：做 /dev/sda1 的整个分区的镜像；
3) to recover the data by reiserfsck or fsck.reiserfs mirror;
bash# losetup -f 注：查询哪个loop设备是空的；
/dev/loop0 注：发现有一个空的是/dev/loop0 ；
bash# losetup /dev/loop0 sda1.img
注：把sda1.img 镜象关联到/dev/loop0的设备中；
bash# reiserfsck --rebuild-tree -S -l undelete.log /dev/loop0
注：通过reiserfsck 来修复，-S 表示整个分区，-l 后面是接日志输出，最后是/dev/loop0设备；因为我们前面把sda1.img 关联到了/dev/loop0设备中，这样/dev/loop0就拥有了sda1.img的所有属性；这和直接通过下面命令修复的效果是一样的；但这样通过镜像装载修复的方法主要是为了安全；
bash# reiserfsck --rebuild-tree -S -l undelete.log /dev/sda1
注：这样直接操作也行，如果 /dev/sda1上有bad block就麻烦了；可能会损伤到/dev/sda1 数据的安全，明白了吧；
Then there will be similar to the following tips:
reiserfsck 3.6.19 (2003 www.namesys.com)
*************************************************************
** Do not run the program with --rebuild-tree unless **
** something is broken and MAKE A BACKUP before using it. **
** If you have bad sectors on a drive it is usually a bad **
** idea to continue using it. Then you probably should get **
** a working hard drive, copy the file system from the bad **
** drive to the good one -- dd_rescue is a good tool for **
** that -- and only then run this program. **
** If you are using the latest reiserfsprogs and it fails **
** please email bug reports to [email protected], **
** providing as much information as possible -- your **
** hardware, kernel, patches, settings, all reiserfsck **
** messages (including version), the reiserfsck logfile, **
** check the syslog file for any related information. **
** If you would like advice on using this program, support **
** is available for $25 at www.namesys.com/support.html. **
*************************************************************
Will rebuild the filesystem (/dev/loop0) tree
Will put log info to 'undelete.log'
Do you want to run this program?[N/Yes] (note need to type Yes if you do): Yes
注：请输入Yes，这样就进行修复了；
Details are as follows:
Replaying journal..
Reiserfs journal '/dev/loop0' in blocks [18..8211]: 0 transactions replayed
###########
reiserfsck --rebuild-tree started at Thu Dec 1 21:01:53 2005
###########
Pass 0:
The whole partition (251984 blocks) is to be scanned
Skipping 8218 blocks (super block, journal, bitmaps) 243766 blocks will be read
0%....20%....40%....60%....80%....100% left 0, 6588 /sec
"r5" hash is selected
Flushing..finished
Read blocks (but not data blocks) 243766
Leaves among those 56
Objectids found 77
Pass 1 (will try to insert 56 leaves):
Looking for allocable blocks .. finished
0%....20%....40%....60%....80%....100% left 0, 56 /sec
Flushing..finished
56 leaves read
45 inserted
11 not inserted
non-unique pointers in indirect items (zeroed) 633
Pass 2:
0%....20%....40%....60%....80%....100% left 0, 0 /sec
Flushing..finished
Leaves inserted item by item 11
Pass 3 (semantic):
Flushing..finished
Files found: 42
Directories found: 12
Pass 3a (looking for lost dir/files):
Looking for lost directories:
Looking for lost files:0 /sec
Flushing..finished 48, 0 /sec
Objects without names 16
Dirs linked to /lost+found: 1
Files linked to /lost+found 15
Pass 4 - finished done 44, 0 /sec
Flushing..finished
Syncing..finished
###########
reiserfsck finished at Thu Dec 1 21:02:31 2005
###########
4) mount the loop device to view data recovery;
bash# mkdir recoversda1 注：创建一个目录；
bash# mount /dev/loop0 recoversda1 注：把/dev/loop0挂载到 recoversda1 上；
bash# more undelete.log 注：查看恢复日志；
bash# cd recoversda1 注：进入recoversda1目录查看数据恢复情况；
Under normal circumstances, if you delete something rm, most of them will recover one hundred percent, some content may be restored to the lost + found directory, by contrast to be restored log viewer;
If you believe that your data is almost recovered, then you can mount the hard disk partition data loss, and then copy the data has been restored in the past;
bash# cd .. 注：从 recoversda1 退出，返回上级目录；
bash# mkdir sda1 注：创建sda1目录；
bash# mount /dev/sda1 sda1 注：挂载 /dev/sda1 到sda1目录上；
The following is from the recoversda1 directory, copy the data has been restored to the hard disk partition data loss; this work is simple it; cp command should use it, if it does not, then I can do about it, see to you and I really almost level; ha ha. . . .
5) off the work to restore good data;
To properly uninstall a series of mounted disk;
bash# umount /dev/hda8
bash# umount /dev/sda1
bash# umount /dev/loop1
bash# losetup -d /dev/loop0
... ...
If the device is busy message appears, you are in the mount directory; quit just fine;
Fourth, on paper;
This practice is based on documents provided by the practice of the method of foreigners come, if you believe in the north and south of plagiarism, then you will also be able to copy;
Fifth, reference documents;
http://www.martian.org/marty/archives/000888.html
http://marc.theaimsgroup.com/?l=reiserfs&m=104861318421306&w=2
http://www.antrix.net/ journal / techtalk / reiserfs_data_recovery_howto.html
Six related documents;
"Under the relevant ext2 file system undelete (Undelete) operation to recover the document data"
"Linux File System Overview"
Reproduced in: https: //www.cnblogs.com/licheng/archive/2008/01/21/1047442.html
Reference Document 4
Hi all,
I just want to thank for the tips on recovering deleted files. I've just wrongly deleted some files and been able to recover them by following your steps / steps from pages mentioned herein. Instead of finding deleted files in lost+found directory, I've ended up finding them in the original directories (from where they were deleted). I've compiled the sequence of steps for my specific case (slight changes will suit particular issues regarding unwanted file deletion), which follows:
Recover deleted files (from /home = /dev/hda7)
0. Unmount partition from where to recover deleted files
umount /home
1. Create partition copy
dd if=/dev/hda7 conv=noerror > /hda7.img
2. Set up device containing copy of partition (created in 1.)
losetup /dev/loop/0 /hda7.img
3. Rebuild FS tree, performing a thorough partition scan and logging to /recovery.log file
reiserfsck --rebuild-tree -S -l /recovery.log /dev/loop/0
(4. Check written log file)
(less /recovery.log)
5. Create directory for mounting recovered partition
mkdir /recovery
6. Mount recovered partition in directory created in 5.
mount /dev/loop/0 /recovery
7. Access recovered partition's lost+found directory and look for files
cd /recovery/lost+found
8. If not there (7.), then look for in original directory
cd /recovery/
9. Remount /home partition
mount /home
10. Copy recovered files from 7./8. to /home/
cp /recovery// /home//
11. Unmount recovered partition
umount /recovery
12. Detach recovered partition device
losetup -d /dev/loop/0
@nT$
Reference Document 3
Reiserfs filesystem recovery
Cleaning up after disk crashing season hasn't been fun, but I am pleased with what I've managed to recover from the worst crash.
I wanted to get the latest data from the dead webserver. It was in MySQL, and stored in /var/lib/mysql. Unfortunately, the /var/lib directory no longer existed.
I didn't want to try to recover it in place -- with so many bad blocks, things can only get worse -- so I copied the entire partition to a file on my laptop (the one with the shiny new disk): ssh deadserver dd if=/dev/hda1 conv=noerror > hda1.img (You need the conv=noerror or else dd will stop when it hits the first bad block.)
So, then I had most of a corrupt filesystem image. To make it useful I used the loop driver: losetup /dev/loop/0 hda1.img
Now I could try reiserfsck to see what I could recover. I started with reiserfsck --rebuild-sb /dev/loop/0 to rebuild the superblock: even it if hadn't been affected by the physical disk corruption, it would certainly be confused by it new home in a looped image that probably wasn't the same size as the original partition. Next step was reiserfsck --rebuild-tree /dev/loop/0 to try to find the contents of the missing directories. I finished it off with reiserfsck --check /dev/loop/0 to make sure it was happy.
Now I can just mount /dev/loop/0 /mnt and have a look in /mnt/lost+found. The data is there!
Reference Document 2
List: reiserfs
Subject: Re: "Unformat" a ReiserFS partition : a testimony :-)
From: Vitaly Fertman
Date: 2003-03-25 17:25:38
[Download message RAW]
Hi,
On Tuesday 25 March 2003 03:16, Yury Umanets wrote:
> Nicolas Vanderavero wrote:
> > Hello,
>
> Hello Nicolas,
>
> > while reinstalling a Debian on a new hard drive, I made the mistake to
> > format in reiserfs my good old /home which was on /dev/sda7 instead of
> > formatting the new /dev/hda7. Gasp ! Eight gigabytes lost ...
> >
> > Or ... maybe it was not totally lost :-) I immediately made a dump of
> > the partition with 'dd' and started grepping some known text on it. It
> > seemed that no data was really lost. I didn't know what to do. So I
> > read the man pages and found the reiserfsck command quite interesting :-)
>
> You have lost the super block and probably old root node. I said
> "probably" because it might be not used in teh time you did format.
superblock, bitmaps, journal content and almost always one block which usualy
> Ok, I am a total newbie to filesystems and to ReiserFS. So maybe itis not old root node, but the very first leaf on the fs with a part/the whole
root directory.
> > will sound trivial to you, but just in case it happens to anyone else,
> > I just wanted to say that running a reiserfsck --rebuild-tree -S on my
> > partition was enough to unformat it. I ended up with some file in
> > lost+found, but a 'file *' is enough to discover what they are.
Right.
The first thing you should do in cases like this is to make backup. I> hope you'll find eight gigabytes for that. Now you may feel free to do
> anything with you old partition. Then you should to do --rebuild-sb and
> try to fsck the partition with --check key. Then follow to fsck sugestions.
:)) no, Yura, reiserfs is in a good state after mkreiserfs and --rebuild-sb /
These should be enought for getting you partition back.--check will say 'all is fine, enjoy'. Plus, -S is used in cases when fs is
ok, but some data are lost, so you may want to backup not the whole partition,
but only cp important data somewhere from the mounted fs (to avoid their
corruption while rebuilding with -S option what may occure).
>
> > So, maybe it would be usefull to add an entry in the "Example of
> > using" section of the man page of reiserfsck, saying something like :
> > "If you reformatted by mistake a reiserFS partition, you can try to
> > unformat it by running reiserfsck --rebuild-tree -S on it".
--scan-whole-partition does what is written in man page - scan the whole
partition, not only used space - and brings back all what was found. That
means that have just created reiserfs partition with all copeid data on
it will be recovered, all not overwritten data from the previous reiserfs
will be recovered. There were also some data which were deleted once and
the space they occupied has not been reused - get recoved also. All data
with the same key go to the same file/dir and old versions of files will
be merged with new versions, or deleted file will be merged with the new
one - this may lead to data corruption. And while building the tree for
all these found data you can run out of disk space.
So it is not an undelete feature and not unformat feature, although can be
P.S. Please read http://www.namesys.com/support.html. Can you as forused pretty efficiently for these 2 purpose _just_after_ a wrong remove /
format. Or just after fsck --rebuild-tree, if fsck has not recovered some
important data due to bitmap corruption.
As a result, -S is more like a hack - it is not undelete, unformat, undo,
but you can try to recover smth from unused space, valid data can become
corrupted while being merged with old data, so it should be used with high
caution and it is not for wide-usage anyway.
> support?
It seems that Nicolas does not need our support as he wrote about his
result how he had successfully unformatted the fs.
--
Thanks,
Vitaly Fertman
Reference Document 1
UPDATE (15 June, 2004): I just found this thread which warns of possible corruption of existing files on the partition. Essentially, the recovery process may take older (deleted) versions of a current file and try and merge it with the new file resulting in data corruption. As a safety measure, make a backup of important undamaged files on another partition before you carry out the steps below.
UPDATE (31 March, 2005): Make sure you read through all the comments to this howto before starting the recovery process. Lots of tips and warnings are present in those comments!
UPDATE (11 August, 2005): For even more hopeless data loss cases, try Foremost.
NOTE: These steps are only for really bad hard disk muck-ups and accidentally deleted files. For normal filesystem inconsistencies, don't use these steps!
1. Once you realize that you've lost data, don't do anything else on that partition - you may cause that data to be overwritten by new data.
2. Unmount that partition. e.g., umount /home
3. Find out what actual device this partition refers to. You can usually get this information from the file /etc/fstab. We'll assume here that the device is /dev/hda3.
4.
Run the command: reiserfsck --rebuild-tree -S -l /root/recovery.log /dev/hda3
You need to be root to do this. Read the reiserfsck man page for what these options do and for more options. Some interesting options are '--rebuild-sb, --check'
After the command finishes, which might be a long time for a big partition, you can take a look at the logfile /root/recovery.log if you wish.
5. Mount your partition: mount /home
6. Look for the lost+found directory in the root of the partition. Here, that would be: /home/lost+found
7. This directory contains all the files that could be recovered. Unfortunately, the filenames are not preserved for a lot of files. You'll find some sub-directories - filenames within those are preserved!
8. Look through the files and copy back what you need.
Here's a useful link for more advanced tricks.
Hope that helps! Please leave a comment here if you found this page useful and/or if there should be something more on this page that I missed.
PS: For normal filesystem inconsistencies, use the --fix-fixable option with reiserfsck. See the man page for more on that.