Ubuntu and data experts, please, any advice on this situation:
We had a server with Ubuntu 12.04 with 2 HDDs in RAID1. One day system just didn't boot and after some investigation we realized that not all data are in place, in fact. There are no /home, /bin and /var folders
Here's a screenshot from Ubuntu Desktop Live CD. Could someone explain how this happened:
We checked HDDs with fsck - nothing came up
Smartmontools showed around 200 sectors to remap on 1st HDD, and everything is fine on the 2nd one.
We tried to restore data with TestDisk - no files in /home, /bin, /var. Just these folders - /home, /bin, /var which are shown red (as deleted, I guess) (same on both HDDs)
Actually, we found a bad block on 1 HDD with TestDisk (on picture below), but how just one bad block can affect more than 32 GB of data? Could that be a superblock?
My question - is there any way we could restore that hidden data? And could someone tell me how this happened, was it hardware failure or someone's evil intent?
Update: Phillip thank you very much for your answer,
First of all, running Nautilus as root doesn't give us access to any additional files.
Second, you're right, we checked
/dev/md1 with Testdisk, not individual HDDs, because Testdisk didn't want to work on
/dev/sdb2 saying that this partition is a part of a raid array.
Third, I said that
/bin, /home and /var are shown red when checking RAID with TestDisk, but those folders appear to be empty when I tried to get inside them (when in TestDisk)
Forth, here's output of
sudo ls -ld /home /var /bin :
drwxr -xr -x 2 root root 2799 Apr 23 11:41 /bin drwxr -xr -x 1 root root 60 Aug 9 18:56 /home drwxr -xr -x 1 root root 120 Apr 23 11:38 /var
But this command checks not desired disk, but our virtual disk (we're working under Ubuntu live CD right now)
So, we modified this command to get to our desired mounted HDD like this:
sudo ls -ld home var bin etc
ls: cannot access home: No such file or directory ls: cannot access var: No such file or directory ls: cannot access bin: No such file or directory drwxr -xr -x 92 root root 4096 Aug 5 20:31 etc
etc to the command just to check if command works, because
etc is available on our HDD)