On Wed, 9 Feb 2005 15:33:40 +0100, Rikard Johnels wrote:
Hi all!
I have a client that have lost two 30 gig disks with a huge number of files he uses in a project. The server (Linux SuSE 9.1) suddenly hickuped, and when it came back there was files on the discs but no NFS. ('df showed about 75% usage of the discs) After restart of NFS a 'df' shows total use 1% and the files are gone By some reason (so far unknown) the disk is suddenly empty. They are created under Linux and uses ReiserFS, so he thought them to be "safe". (No he didn't back them up regardles of warnings from me)
I did a 'dd if=/dev/hdc of=image.hdc and if i look at that file i can see all the data. I can find all filenames but the fat seems empty. Is there a safe way to try to restore the lost files? Parttitiontable is OK. ReiserFS in it self didn't complain about anything, and SMART didn't register any failing disks.
Where shall i start to look? --
/Rikard
Good luck. Reiser is not going to be a well supported os for recovery tools. Surpisingly, googling for "computer forensics reiserfs" turned up more hits than I expected. The first 2 look very promising: WinHex and X-Ways Forensics. http://www.x-ways.net/winhex/index-m.html http://www.x-ways.net/forensics/index-m.html WinHex in particular is a good tool for Windows based problems, I have no exp. with it and Reiser. I've never heard of the X-Ways Forensics tool before. (And forensics is what my company does.) Greg -- Greg Freemyer