[vox-tech] Recovering data

[Michael J Wenk]

Hmm.  I have several files that were over 2GB, One around 3GB, and the other
is 28GB.  Im running ext2 as my filesystem.  Ive searched using mc, recover
and debugfs, and they can find no trace of my wayward file.  I guess I have
to give up at this point, though it is painful.

Thanks
Mike

----- Original Message -----
From: "ME" <dugan@passwall.com>
To: <vox-tech@lists.lugod.org>
Sent: Monday, March 17, 2003 10:59 PM
Subject: Re: [vox-tech] Recovering data


> Others on the list can correct me if I am wrong, but I think the max
> filesize for ext2 and ext3 is 2GB while for ResierFS is in the Exabytes
> but since Max block dev size for Linux-2.4 series is 2 Terabytes, this can
> be an effective limit for all fs under this version kernel.
>
> So, if you were using ext2 or ext3, and tried to write an 8GB file via smb
> service mapped volume to an ext2/ext3 filesystem, it is not clear what
> would happen without looking at the source. I would *hope* that an error
> would be returned to smbd during the file write, or an exception would be
> thrown effecting error control and recovery so that when the write beyond
> max was being attempted, the error would be passed by smbd to the session
> to fail the transfer.
>
> This being said, I have seen files in ext2 that had reported sizes larger
> than 2GB, but in all cases where I saw this, the file was damaged and did
> not really occupy the space stated in the listing. I'm still not usi9ng a
> current ext3, so if anyone can state with certainty that ext3 can write
> beyond the 2GB file limit, then they would likely be informing you of what
> is true now.
>
> This is one feature of resierfs that makes it more sexy than ext3 -
> assuming it is still true.
>
> Probably not what you wanted to hear. :-/
>
> If the file was deleted, you can examine using "mc" (midnight commander)
> to read the device directly (as root) and try to "undelete" the lost file.
> However, last I checked, this was only officially supported for ext2 under
> mc. :-/
> (To make matters worse, i think that mc uses the same effective procedure
> as debugfs for "undelete.")
>
> Sorry, hope the news gets better,
> -ME
>
> Michael J Wenk said:
>
> > Okay more details.
> >
> > My network has 4 systems on it.  The two important systems in this case
> > are
> > praxis and buffy.   praxis is a linux system running debian woody(2.4.19
> > kernel), and buffy is a toshiba laptop running windows XP.
> >
> > I ran a full save backup on buffy using the ntbackup tool that comes
with
> > XP.  This was run last thurday or friday(I forget which.)  The next day
I
> > tested restoring a cpl of files from the backup and it worked great.
Due
> > to
> > some CD issues, I couldn't do the rebuild restore that day, so I waited
> > until last night.  I decided to run an incremental backup, and when the
> > thing thought that EVERY file had changed, I decided well, that's bogus,
> > we'll just go with the full I made before.  I also decided to use a
> > different filename for my backup(I checked append to backup as well.)
> >
> > Here's where I made my major error I think, I didn't check to make sure
> > the
> > backup file was still there before I reinstalled.  I suspect(not knowing
> > enough about the ntbackup tool, I do not know) that when I ran the
> > incremental, it decided to delete my old backup file.  Why it did this,
I
> > do
> > not know, nor can I understand why anyone would think the simple change
of
> > a
> > filename would mean the old filename was unimportant.  Anyways, after I
> > ran
> > the reinstall and added the basic driver packages, I went and lo and
> > behold
> > my backup file was empty.  The original name was "Jeanette Backup.bkf"
and
> > the name I chose to make the incremental was "Jeanette Backup2.bkf".
> >
> > The system is running samba 2.2.3a.  There is nothing useful that I can
> > see
> > in any samba logs.  I did notice something I was unaware of, the laptop
> > that
> > I call buffy was not in my static DHCP table, ie, it is getting various
IP
> > addresses and names.  I wonder if that could have an effect?  I went
thru
> > the filesystem that I stored the backup on and tried to search for the
> > file
> > with debugfs, but either because the file was too large(recover
segfaulted
> > on me) or some other reason.  Ive tried the tricks I know to recover a
> > file,
> > and have failed, so Ive pretty much given up on my data, but ANY help
> > would
> > be greatly appreciated.
> >
> > Oh, the laptop XP system did have its latest patches
installed(everything
> > on
> > windows update.) My samba uses user authentication, and other than only
> > allowing connections on my local subnet, has no other configuration...
> > Please let me know any other details needed.
> >
> > Thanks in advance,
> > Mike
> >
> > ----- Original Message -----
> > From: "Rod Roark" <rod@sunsetsystems.com>
> > To: <vox-tech@lists.lugod.org>
> > Sent: Monday, March 17, 2003 3:20 PM
> > Subject: Re: [vox-tech] Recovering data
> >
> >
> >> This sounds like one of those problems that depends
> >> completely on the smallest details.  I think it was Einstein
> >> who said a problem cannot be solved at the same level of
> >> awareness with which it was created.  :-)
> >>
> >> I don't know if anyone here can help, but if we can you'll
> >> have to give more info.  Like exactly what was involved in
> >> doing the backup and the test restore (Samba?).
> >>
> >> On Monday 17 March 2003 01:54 pm, Michael J Wenk wrote:
> >> > I have a problem where I seem to have lost around 10GB of data from a
> >> > backup of a PC I have.  The file was not rm'd.  I suspect that the
> > program
> >> > that wrote it trashed it(I admit Im not totally sure.)  What happened
> > was I
> >> > ran a backup under XP to a netdrive that resides on my linux system.
> >> I
> >> > verfied the data was there and was usable(by doing a small restore.)
> >> > However, after I rebuilt the machine, that same backup file went from
> > about
> >> > 10GB down to 20KB.  Since I have not written that kinda data to the
> > disk, I
> >> > suspect that my data is still there, however using debugfs(the trick
> >> to
> >> > getting info back I know) did not work.  Does anyone know of any
other
> > way
> >> > to get at that information?
>
> _______________________________________________
> vox-tech mailing list
> vox-tech@lists.lugod.org
> http://lists.lugod.org/mailman/listinfo/vox-tech