[vox-tech] Recovering data

[Michael J Wenk]

Okay more details.

My network has 4 systems on it.  The two important systems in this case are
praxis and buffy.   praxis is a linux system running debian woody(2.4.19
kernel), and buffy is a toshiba laptop running windows XP.

I ran a full save backup on buffy using the ntbackup tool that comes with
XP.  This was run last thurday or friday(I forget which.)  The next day I
tested restoring a cpl of files from the backup and it worked great.  Due to
some CD issues, I couldn't do the rebuild restore that day, so I waited
until last night.  I decided to run an incremental backup, and when the
thing thought that EVERY file had changed, I decided well, that's bogus,
we'll just go with the full I made before.  I also decided to use a
different filename for my backup(I checked append to backup as well.)

Here's where I made my major error I think, I didn't check to make sure the
backup file was still there before I reinstalled.  I suspect(not knowing
enough about the ntbackup tool, I do not know) that when I ran the
incremental, it decided to delete my old backup file.  Why it did this, I do
not know, nor can I understand why anyone would think the simple change of a
filename would mean the old filename was unimportant.  Anyways, after I ran
the reinstall and added the basic driver packages, I went and lo and behold
my backup file was empty.  The original name was "Jeanette Backup.bkf" and
the name I chose to make the incremental was "Jeanette Backup2.bkf".

The system is running samba 2.2.3a.  There is nothing useful that I can see
in any samba logs.  I did notice something I was unaware of, the laptop that
I call buffy was not in my static DHCP table, ie, it is getting various IP
addresses and names.  I wonder if that could have an effect?  I went thru
the filesystem that I stored the backup on and tried to search for the file
with debugfs, but either because the file was too large(recover segfaulted
on me) or some other reason.  Ive tried the tricks I know to recover a file,
and have failed, so Ive pretty much given up on my data, but ANY help would
be greatly appreciated.

Oh, the laptop XP system did have its latest patches installed(everything on
windows update.) My samba uses user authentication, and other than only
allowing connections on my local subnet, has no other configuration...
Please let me know any other details needed.

Thanks in advance,
Mike

----- Original Message -----
From: "Rod Roark" <rod@sunsetsystems.com>
To: <vox-tech@lists.lugod.org>
Sent: Monday, March 17, 2003 3:20 PM
Subject: Re: [vox-tech] Recovering data


> This sounds like one of those problems that depends
> completely on the smallest details.  I think it was Einstein
> who said a problem cannot be solved at the same level of
> awareness with which it was created.  :-)
>
> I don't know if anyone here can help, but if we can you'll
> have to give more info.  Like exactly what was involved in
> doing the backup and the test restore (Samba?).
>
> --
> Rod Roark, Sunset Systems     http://www.sunsetsystems.com/
> Offering preconfigured Linux computers, custom software and
> remote system administration services.
> Public Key: http://www.sunsetsystems.com/rodspublickey.asc
>
> On Monday 17 March 2003 01:54 pm, Michael J Wenk wrote:
> > Hey,
> >
> > I have a problem where I seem to have lost around 10GB of data from a
> > backup of a PC I have.  The file was not rm'd.  I suspect that the
program
> > that wrote it trashed it(I admit Im not totally sure.)  What happened
was I
> > ran a backup under XP to a netdrive that resides on my linux system.  I
> > verfied the data was there and was usable(by doing a small restore.)
> > However, after I rebuilt the machine, that same backup file went from
about
> > 10GB down to 20KB.  Since I have not written that kinda data to the
disk, I
> > suspect that my data is still there, however using debugfs(the trick to
> > getting info back I know) did not work.  Does anyone know of any other
way
> > to get at that information?
> >
> > Thanks in advance,
> >
> > Mike
>
> _______________________________________________
> vox-tech mailing list
> vox-tech@lists.lugod.org
> http://lists.lugod.org/mailman/listinfo/vox-tech