1

A couple of days ago I tried getting an old server of mine up and running. It was working initially, but after updating and rebooting the system a few times the system refused to boot, dying at GRUB rescue.

I put the hard drive in another Linux machine to see what was going on and the system partition was displaying as unknown. I ran "fsck" on the partition, which got it working again, however, now the "var" and "usr" folders are missing!

I've tried to various things to try and recover the data incuding running "Check" and "Attempt Data Rescue" (which crashes) on Gparted, fsck, testdisk, changing the superblock, creating and mounting an image using DD, and nothing seems to work. Even worse is, the files I want to recover are not in the "lost+found".

The partition type is ext3. The partition reports "5GB" of data is in use, however, only around "2.8GB" can be accessed.

If anyone could help it would be greatly appreciated.

Edit:

I've tried doing a photorec on the hard drive, but it seems completely pointless as any recovered files are unnamed so it'd be impossible for me to recover anything in a sensible manner.

  • 3
    This....is...why...you...do.. BACKUPS ! – Little Code Jun 4 '16 at 19:54
  • Do a dd first as Illdino suggested, that way, at least you have a backup in case things get worse. I've used photorec, sure the files are unnamed, but you can get a lot from the files content... And for photos from exif data. – asoundmove Jun 4 '16 at 20:06
  • I do backups these days. This server is about 4 years old, and the data isn't particularly critical, and never was. The data I want to recover is all raw, and when photorec won't know the extension it makes it almost impossible to recover the data I need. Also, I did do a DD. – Aiden Foxx Jun 4 '16 at 20:32
  • Why did you try photorec instead of testdisk? – Andrea Lazzarotto Jun 5 '16 at 9:39
  • I tried both. I mis-labeled testdisk as testpart in my description. – Aiden Foxx Jun 5 '16 at 18:52
1

It may be too late already, but the first thing you should do when you notice hard drive failure, or data loss is to make an image of the failed hard drive using ddrescue. Playing around with fsck or parted has the potential to make things worse.

That being said, if the data you've lost is mission-critical, you may want to call in a professional to help you recover the data. These folks have specialized tools and know-how and have experience recovering lost data, which sometimes isn't such an easy task.

Also, remember to backups frequently! Raid1 is NOT a backup solution ;)

  • It was an old server, and the data isn't important, and never was. I would just prefer to have it for posterity. I did do a DD, so I've a backup if I well and truly mess up the recovery. – Aiden Foxx Jun 4 '16 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.