1

This morning I was doing a routine backup of my development drive, one of 4 primary partitions on my hard-drive. The script I ran was:

filename="/home/Backups/Devi_"`eval date +%Y%m%d`".tgz"
touch $filename
tar cvzf $filename /media/Devi/ 

After a while I started seeing the tar output say it was unable to find certain files and the same message started appearing more and more until the command exited. When I then checked, everything in the drive was gone, hidden files and all. One fact that is probably pertinent is that I had two qt programs running whose executables and libs were on the drive, though I can't figure out how a tar command would cause a deletion like this just because of files in use. I've tried running testdisk to recover directories but it only seems to find top level files/dirs and under them it says nothing found. Right now i'm running Photorec and its finding files so none were overwritten but the filesystem was definitely damaged (I tried fsk.ext4 and I get a clean status with far fewer files than are on the drive).

My syslog for the time window (I believe the deletion happend at 11:02) is:

Jul 26 10:17:01 GlaDux CRON[7004]: (root) CMD (   cd / && run-parts --report/etc/cron.hourly)
Jul 26 10:17:05 GlaDux kernel: [ 5835.406184] GLViewer[7032]: segfault at 0 ip 00007eff18138ee6 sp 00007fff24187158 error 4 in libc2.17.so[7eff17fe8000+1be000]
Jul 26 10:17:16 GlaDux kernel: [ 5846.856210] GLViewer[7059]: segfault at 0 ip 00007f470b838ee6 sp 00007fff999ec928 error 4 in libc-2.17.so[7f470b6e8000+1be000]
Jul 26 10:43:41 GlaDux NetworkManager[1141]: <warn> nl_recvmsgs() error: (-33) Dump inconsistency detected, interrupted
Jul 26 10:57:04 GlaDux dbus[1060]: [system] Activating service name='org.freedesktop.UDisks' (using servicehelper)
Jul 26 10:57:04 GlaDux dbus[1060]: [system] Successfully activated service 'org.freedesktop.UDisks'
Jul 26 11:12:25 GlaDux dbus[1060]: [system] Activating service name='org.freedesktop.hostname1' (using servicehelper)
Jul 26 11:12:25 GlaDux dbus[1060]: [system] Successfully activated service 'org.freedesktop.hostname1'
Jul 26 11:13:41 GlaDux NetworkManager[1141]: <warn> nl_recvmsgs() error: (-33) Dump inconsistency detected, interrupted
Jul 26 11:15:41 GlaDux NetworkManager[1141]: <warn> nl_recvmsgs() error: (-33)         Dump inconsistency detected, interrupted
Jul 26 11:17:01 GlaDux CRON[8999]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)

I checked and no jobs are scheduled for cron.hourly. However, I think udisk might have something to do with it. Also I've tried doing everything from a live fedora boot and there was no difference. I also tried mounting with a different superblock and had no luck.

So I have two questions:

Is there any way to recover my directory structure using methods I haven't already mentioned? I have backups so individual file recovery seems like overkill, I'd love to be able too get the rest of the tree.

And far more importantly, how in the hell did a simple tar command delete EVERYTHING in the drive. This absolutely baffles me and is by far the worst error an OS has ever given me and it defies my previous experience with linux distros. Any possible explanation would be greatly appreciated.

I'm running 3.8.0-23-generic with cinnamint on an x64 machine. The partition in question is a 52 Gb primary ext4 (1 of 4 partitions on the disk, the last one if that matters) and has a blocksize of 4k.

Edit: the output of tar was something like:

/media/me/Devi/dir1/file1
/media/me/Devi/dir1/file2/
......
/media/me/Devi/dir100/file1
cannot find file or folder /media/me/Devi/dir101
cannot find file or folder /media/me/Devi/dir102
cannot find file or folder /media/me/Devi/dir102

Also, an hour or so before the deletion, the disk was mounted and the following was logged in kern.log:

Jul 26 09:14:16 GlaDux kernel: [ 2068.519913] EXT4-fs (sda3):     ext4_orphan_cleanup: deleting unreferenced inode 663018
Jul 26 09:14:16 GlaDux kernel: [ 2068.519952] EXT4-fs (sda3): ext4_orphan_cleanup: deleting unreferenced inode 663017
Jul 26 09:14:16 GlaDux kernel: [ 2068.519961] EXT4-fs (sda3): ext4_orphan_cleanup: deleting unreferenced inode 663016
Jul 26 09:14:16 GlaDux kernel: [ 2068.519969] EXT4-fs (sda3): 3 orphan inodes deleted
Jul 26 09:14:16 GlaDux kernel: [ 2068.519970] EXT4-fs (sda3): recovery complete
Jul 26 09:14:17 GlaDux kernel: [ 2068.606194] EXT4-fs (sda3): mounted filesystem with ordered data mode. Opts: (null)
  • Do you have the exact output from tar? Also, I suspect you don't have the right messages—look in /var/log/kern.log (if you have that). I'd guess your filesystem hit some error, maybe a bad block... – derobert Jul 26 '13 at 19:59
  • See edit above. – user2525598 Jul 26 '13 at 20:10
  • There is nothing after that in the kernel log, that happened around the time of the files vanishing? – derobert Jul 26 '13 at 20:14
  • 30 min before deletion there are a few segfaults that came from the application I'm developing (the same one located on this partition) but there is nothing near the actual time. I suspect my application might have some fault but it barely ever touches the filesystem. – user2525598 Jul 26 '13 at 20:17
  • 1
    If there is nothing else about ext4, or sda, or bad blocks, or SATA exceptions, etc. then I'd guess that what happened is that something deleted the files (maybe a bug in your app, a mistake in a makefile, an accidental rm -Rf, etc.), completely unrelated to your tar backup. I'm somewhat confused what partition this is, with one of your pastes showing /media and one showing /home. You could try fsck on it (after unmounting it, add -f if fsck just quickly says its clean). – derobert Jul 26 '13 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.