Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got an unresponsive Rackspace slice that has defied all attempts at accessing. I created an emergency image from this and deleted it, downloading the files that compromise the image to a local source. There are a number of files / assets I would still like to recover from this server if possible but not sure exactly what I can do with the image files, if anything.

Here's the files I have, for what its worth:

emergency_########_######_cloudserver########.tar.gz.0 (5gb)
emergency_########_######_cloudserver########.tar.gz.1 (5gb)
emergency_########_######_cloudserver########.tar.gz.2 (5gb)
emergency_########_######_cloudserver########.tar.gz.3 (50mb)
emergency_########_######_cloudserver########.yml (25kb)

Is it possible to mount this image as a drive? Are there other forensic recovery options?

share|improve this question

migrated from superuser.com Jul 10 '12 at 22:49

This question came from our site for computer enthusiasts and power users.

2 Answers 2

up vote 4 down vote accepted

If what you get after putting the .tar.gz back together and unpacking it results in a disk image, then you should be able to recover files from it.

To begin with, for best results you should be working from a Linux system, with plenty of drive space available (50GB or more). I'm not sure if this is even possible with Windows.

First put the file back together:

cat emergency*.tar.gz.* > image.tar.gz

Now unpack it:

tar -zxvf image.tar.gz

What comes next depends on what was in the tarball. Hopefully it's a single file containing a disk image. In that case, inspect it with:

kpartx -l *imagefile*

(Where imagefile is the name of the disk image file that came out of the tarball.)

You should see what looks like a partition table. If all looks well with the partition table, run:

kpartx -v -a *imagefile*

This will map the partitions in the image to /dev/mapper/loop0p*.

You should then be able to mount these partitions and look at their contents. Remember to mount the filesystems read-only (-o ro) to prevent further damage.

share|improve this answer

FYI, this almost definitely belongs on ServerFault.

The "emergency" files are showing up as ".tar.gz" in the file extension, which tells me that they should be tar archives that you can extract like a zip file. If you're on Windows, download 7-zip from http://7-zip.org and you should be able to open them.

I'm not sure what you'll find within since I've never been a Rackspace customer; but I hear that they have "fanatical support" so it may be within your power to ask them about their backup files and how to access them....

Best of luck.

share|improve this answer
    
I use rackspace and will vouch for their support...nothing but good experiences here. Open a ticket a my.rackspace.com –  BrianAdkins Jul 11 '12 at 0:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.