On Thu, Jan 30, 2014 at 1:53 PM, Anton Aylward
On 01/30/2014 01:35 PM, Greg Freemyer wrote:
On Thu, Jan 30, 2014 at 1:23 PM, Anton Aylward
wrote: On 01/30/2014 01:12 PM, Greg Freemyer wrote:
A file carver, such as foremost, testdisk, photrec works by scanning all sectors looking for recognizable file headers.
Once they find that, they do a linear scan of the drive in an effort to find the end of the file. In many cases, they just guess.
What about a disk with a LVM partition? Suppose the partition table gets destroyed ... Isn't the information about the LVM 'portable' and well contained? Can't it say "There's the file system ..."
I don't think so.
If you set /dev/sda1 and /sdb2 to be the physical members of a LVM setup, then LVM maintains the location of the logical volumes it creates relative to the start of sda1 and sdb2.
If you lose your partition table, LVM will no longer know where sda1 and sdb2 are, so it's relative information is useless.
Now, recreating partition tables is not necessarily hard. I've used gpart a couple times to do that with great success.
Let me ask that a different way.
I realise that LVM headers are text so they can be seen if do a 'strings' on the whole disk ... So they make the poster-boy here, but surely other file systems have clear headers as well.
Isn't there a scanner/tool which can look for these and help you rebuild the partition table or whatever?
Yes, that is why I talked about gpart. It is a drive scanner that looks for filesystem headers and rebuilds partition tables. I don't know if gpart has LVM support, but if it doesn't it should not be hard to add. gpart is in the distro, so zypper in gpart to experiment with it. === From https://build.opensuse.org/package/show/openSUSE:13.1/gpart Gpart is a small tool that tries to guess what partitions are on a PC type hard disk in case the primary partition table was damaged. Gpart supports, among others, partitions formatted as ext2, FAT 12/16/32, ReiserFS, NTFS, and HPFS. Read the file /usr/share/doc/packages/gpart/README and the gpart man page before using gpart. === I repeat I've use gpart to good effect in the past. iirc, I ran it in a test mode until I was comfortable it was recreating the right partition info, then I had it update the actual partition table. Knowing me, I'm sure I made a backup of the corrupt partition table before overwriting it. Greg -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org