Re: [Extundelete-users] Previously mounted ext3 partition

[<ext...@li...>]

Hi,

>I have a hard drive that came out of a Seagate NAS device. I was running a program to copy files from the main server to this storage device and did not notice that the software was set to "Mirror" rather than "Update Target". Mirror copied all the new files on the server to the NAS then proceeded to delete all the files on the target (the NAS) that were not on the source (the server). I immediately shut the NAS device down and replaced it with another one. I then found a software that found several thousand inodes that could be undeleted but could not find any names for the files. Based on the various results of different file recovery programs I have used, the file system is an ext3 partition. I called Seagate to see if they had any software that can recover lost files, but they said that because it is an ext3 filesystem, they can not recover the lost data.
>
>
>I have set up a CENTOS box and loaded extundelete on it. I then attached the hard drive from the NAS device and tried to run extundelete. It immediately came back with an error that the file system was mounted. Evidently, the device did not shut down properly and left the file system flagged as mounted. I tried using fdisk -l to see what the status is but it gave me an error and told me to use GNU Parted. I ran Parted check and it seemed to go through the partition just fine, but did not report anything.
>
>
>First, I would like to grab a byte by byte copy of this partition since this is the only copy of the files I have. Can you recommend a good ghosting program to copy an image over to another 2TB hard drive? Second - How do I fix the mounted flag on this partition so that extundelete can read it?
>


To get a byte by byte copy, use dd (or ddrescue if there is some problem with the hardware).  The command will be something like  "dd if=/dev/olddisk of=/mnt/dir/file.img bs=4M".  If you have enough extra space, make two copies so you have an extra in case you do something to compromise the first one during recovery. To fix the mount flag, fdisk is the right tool, so try that on the image file, and if it doesn't work, try upgrading to the newest version of fdisk (you may have run into a known bug in fdisk) or report your problem to the mailing list run by the developers of fdisk (which I believe is the linux-ext4 list).

Nic