-1

After troubleshooting problems with my mdadm config and kernel settings for about a week now i got careless and left my data drives plugged in after a successful boot test.

i was attempting to change the MDADM super-block so the kernel would auto-detect my system drive by re-creating the array. had a backup of the OS so it wasn't a big deal.

forgetting that i left the data drive in and that udev likes to f**k with the /dev/sd* assignments i ended up adding one of my drives that has data to my system boot drive (Grub and the kernel, ext2, 100mb) mdadm then re-synced the array to the boot drive. now sitting at the very start of my ext4 data partition is a 100mb ext2 partition of kernel and grub configs.

After that 100mb im hoping there's still intact data, what kind of tools can i use to attempt to recover some data. its not super super important data but i would really like it back.

Gentoo Linux 2.6

1 Answer 1

2

Unfortunately, although there is data on the rest of the drive there may not be a way to associated it with individual files. In a typical UNIX/Linux filesystem (including ext2 and 3...not sure about 4), information about the files is stored in the beginning of the disk (including name, attributes and location to the first seven inodes plus two references do the first double list of inodes and one to a tripple linked list of inodes; 10 total references).

In this way, the file inodes themselves (usually 2k to 4k depending on how you formatted the system) can be distributed throughout the filesystem. Unlike NTFS/FAT32 where file information is stored in the header of the file (including part of the name), such information doesn't exist throughout most Linux filesystems. It's all at the head of the disk, so when you delete a file, there really is no way to recover what that file was linked to just by looking at the inodes. There is no reference back, nor reference between the first 10 blocks.

You can try looking through the source code of an undelete program like http://extundelete.sourceforge.net/, but it looks like it uses the journal to recover information which you might have already lost.

If you haven't lost the entire head of the partition that stores file information, you may still be able to recover some files by writing a program that sifts through the disk to recover files.

2
  • Well it was part of a linear raid of 2 drives (temp fix while i wait for the 6 1TB drives for a RAID6, arrived this week, i was updating the kernel with the drivers for the raid card... the irony) so from the sound of it there is a 50% chance ive lost it all...
    – Silverfire
    Sep 12, 2011 at 12:36
  • words cannot explain how lucky i am that it went down that way... ive got the raid working now and running a very unhappy fsck
    – Silverfire
    Sep 12, 2011 at 12:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .