Mailinglist Archive: opensuse (2912 mails)

[Greg Freemyer <greg.freemyer@xxxxxxxxx>]

On Wed, 9 Feb 2005 15:33:40 +0100, Rikard Johnels wrote:
> Hi all!
> 
> I have a client that  have lost two 30 gig disks with a huge number of
> files he uses in a project.
> The server (Linux SuSE 9.1) suddenly hickuped, and when it came back there was
> files on the discs but no NFS. ('df showed about 75% usage of the discs)
> After restart of NFS a 'df' shows total use 1% and the files are gone
> By some reason (so far unknown) the disk is suddenly empty.
> They are created under Linux and uses ReiserFS, so he thought them to be
> "safe". (No he didn't back them up regardles of warnings from me)
> 
> I did a 'dd if=/dev/hdc of=image.hdc and if i look at that file i can see all
> the data. I can find all filenames but the fat seems empty.
> Is there a safe way to try to restore the lost files?
> Parttitiontable is OK. ReiserFS in it self didn't complain about anything,
> and SMART didn't register any failing disks.
> 
> Where shall i start to look?
> --
> 
>          /Rikard
> 
Good luck.  Reiser is not going to be a well supported os for recovery tools.

Surpisingly, googling for "computer forensics reiserfs" turned up more
hits than I expected.

The first 2 look very promising: WinHex and X-Ways Forensics.

http://www.x-ways.net/winhex/index-m.html
http://www.x-ways.net/forensics/index-m.html

WinHex in particular is a good tool for Windows based problems, I have
no exp. with it and Reiser.

I've never heard of the X-Ways Forensics tool before.  (And forensics
is what my company does.)

Greg
-- 
Greg Freemyer