Mailinglist Archive: opensuse (1420 mails)

< Previous Next >
Re: [opensuse] Re: Restore filesystem without losing data?
  • From: Greg Freemyer <greg.freemyer@xxxxxxxxx>
  • Date: Thu, 30 Jan 2014 14:22:38 -0500
  • Message-id: <CAGpXXZ+PqTsNki4LvmqYFcHOO_pnfQTnxsL=oDsbg6wqVm8nxQ@mail.gmail.com>
On Thu, Jan 30, 2014 at 1:53 PM, Anton Aylward
<opensuse@xxxxxxxxxxxxxxxx> wrote:
On 01/30/2014 01:35 PM, Greg Freemyer wrote:

On Thu, Jan 30, 2014 at 1:23 PM, Anton Aylward
<opensuse@xxxxxxxxxxxxxxxx> wrote:

On 01/30/2014 01:12 PM, Greg Freemyer wrote:


A file carver, such as foremost, testdisk, photrec works by scanning
all sectors looking for recognizable file headers.

Once they find that, they do a linear scan of the drive in an effort
to find the end of the file. In many cases, they just guess.



What about a disk with a LVM partition?
Suppose the partition table gets destroyed ...
Isn't the information about the LVM 'portable' and well contained?
Can't it say "There's the file system ..."


I don't think so.

If you set /dev/sda1 and /sdb2 to be the physical members of a LVM
setup, then LVM maintains the location of the logical volumes it
creates relative to the start of sda1 and sdb2.

If you lose your partition table, LVM will no longer know where sda1
and sdb2 are, so it's relative information is useless.

Now, recreating partition tables is not necessarily hard. I've used
gpart a couple times to do that with great success.


Let me ask that a different way.

I realise that LVM headers are text so they can be seen if do a 'strings' on
the whole disk ... So they make the poster-boy here, but surely other file
systems have clear headers as well.

Isn't there a scanner/tool which can look for these and help you rebuild the
partition table or whatever?

Yes, that is why I talked about gpart. It is a drive scanner that
looks for filesystem headers and rebuilds partition tables. I don't
know if gpart has LVM support, but if it doesn't it should not be hard
to add. gpart is in the distro, so zypper in gpart to experiment with
it.

=== From https://build.opensuse.org/package/show/openSUSE:13.1/gpart

Gpart is a small tool that tries to guess what partitions are on a PC
type hard disk in case the primary partition table was damaged. Gpart
supports, among others, partitions formatted as ext2, FAT 12/16/32,
ReiserFS, NTFS, and HPFS. Read the file
/usr/share/doc/packages/gpart/README and the gpart man page before
using gpart.

===

I repeat I've use gpart to good effect in the past. iirc, I ran it in
a test mode until I was comfortable it was recreating the right
partition info, then I had it update the actual partition table.
Knowing me, I'm sure I made a backup of the corrupt partition table
before overwriting it.

Greg
--
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse+owner@xxxxxxxxxxxx

< Previous Next >