This morning I was doing a routine backup of my development drive, one of 4 primary partitions on my hard-drive. The script I ran was:
filename="/home/Backups/Devi_"`eval date +%Y%m%d`".tgz" touch $filename tar cvzf $filename /media/Devi/
After a while I started seeing the tar output say it was unable to find certain files and the same message started appearing more and more until the command exited. When I then checked, everything in the drive was gone, hidden files and all. One fact that is probably pertinent is that I had two qt programs running whose executables and libs were on the drive, though I can't figure out how a tar command would cause a deletion like this just because of files in use. I've tried running testdisk to recover directories but it only seems to find top level files/dirs and under them it says nothing found. Right now i'm running Photorec and its finding files so none were overwritten but the filesystem was definitely damaged (I tried fsk.ext4 and I get a clean status with far fewer files than are on the drive).
My syslog for the time window (I believe the deletion happend at 11:02) is:
Jul 26 10:17:01 GlaDux CRON: (root) CMD ( cd / && run-parts --report/etc/cron.hourly) Jul 26 10:17:05 GlaDux kernel: [ 5835.406184] GLViewer: segfault at 0 ip 00007eff18138ee6 sp 00007fff24187158 error 4 in libc2.17.so[7eff17fe8000+1be000] Jul 26 10:17:16 GlaDux kernel: [ 5846.856210] GLViewer: segfault at 0 ip 00007f470b838ee6 sp 00007fff999ec928 error 4 in libc-2.17.so[7f470b6e8000+1be000] Jul 26 10:43:41 GlaDux NetworkManager: <warn> nl_recvmsgs() error: (-33) Dump inconsistency detected, interrupted Jul 26 10:57:04 GlaDux dbus: [system] Activating service name='org.freedesktop.UDisks' (using servicehelper) Jul 26 10:57:04 GlaDux dbus: [system] Successfully activated service 'org.freedesktop.UDisks' Jul 26 11:12:25 GlaDux dbus: [system] Activating service name='org.freedesktop.hostname1' (using servicehelper) Jul 26 11:12:25 GlaDux dbus: [system] Successfully activated service 'org.freedesktop.hostname1' Jul 26 11:13:41 GlaDux NetworkManager: <warn> nl_recvmsgs() error: (-33) Dump inconsistency detected, interrupted Jul 26 11:15:41 GlaDux NetworkManager: <warn> nl_recvmsgs() error: (-33) Dump inconsistency detected, interrupted Jul 26 11:17:01 GlaDux CRON: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
I checked and no jobs are scheduled for cron.hourly. However, I think udisk might have something to do with it. Also I've tried doing everything from a live fedora boot and there was no difference. I also tried mounting with a different superblock and had no luck.
So I have two questions:
Is there any way to recover my directory structure using methods I haven't already mentioned? I have backups so individual file recovery seems like overkill, I'd love to be able too get the rest of the tree.
And far more importantly, how in the hell did a simple tar command delete EVERYTHING in the drive. This absolutely baffles me and is by far the worst error an OS has ever given me and it defies my previous experience with linux distros. Any possible explanation would be greatly appreciated.
I'm running 3.8.0-23-generic with cinnamint on an x64 machine. The partition in question is a 52 Gb primary ext4 (1 of 4 partitions on the disk, the last one if that matters) and has a blocksize of 4k.
Edit: the output of tar was something like:
/media/me/Devi/dir1/file1 /media/me/Devi/dir1/file2/ ...... /media/me/Devi/dir100/file1 cannot find file or folder /media/me/Devi/dir101 cannot find file or folder /media/me/Devi/dir102 cannot find file or folder /media/me/Devi/dir102
Also, an hour or so before the deletion, the disk was mounted and the following was logged in kern.log:
Jul 26 09:14:16 GlaDux kernel: [ 2068.519913] EXT4-fs (sda3): ext4_orphan_cleanup: deleting unreferenced inode 663018 Jul 26 09:14:16 GlaDux kernel: [ 2068.519952] EXT4-fs (sda3): ext4_orphan_cleanup: deleting unreferenced inode 663017 Jul 26 09:14:16 GlaDux kernel: [ 2068.519961] EXT4-fs (sda3): ext4_orphan_cleanup: deleting unreferenced inode 663016 Jul 26 09:14:16 GlaDux kernel: [ 2068.519969] EXT4-fs (sda3): 3 orphan inodes deleted Jul 26 09:14:16 GlaDux kernel: [ 2068.519970] EXT4-fs (sda3): recovery complete Jul 26 09:14:17 GlaDux kernel: [ 2068.606194] EXT4-fs (sda3): mounted filesystem with ordered data mode. Opts: (null)