Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Ubuntu and data experts, please, any advice on this situation:

We had a server with Ubuntu 12.04 with 2 HDDs in RAID1. One day system just didn't boot and after some investigation we realized that not all data are in place, in fact. There are no /home, /bin and /var folders

Here's a screenshot from Ubuntu Desktop Live CD. Could someone explain how this happened:

enter image description here

We checked HDDs with fsck - nothing came up

Smartmontools showed around 200 sectors to remap on 1st HDD, and everything is fine on the 2nd one.

We tried to restore data with TestDisk - no files in /home, /bin, /var. Just these folders - /home, /bin, /var which are shown red (as deleted, I guess) (same on both HDDs)

Actually, we found a bad block on 1 HDD with TestDisk (on picture below), but how just one bad block can affect more than 32 GB of data? Could that be a superblock?

enter image description here

My question - is there any way we could restore that hidden data? And could someone tell me how this happened, was it hardware failure or someone's evil intent?

Update: Phillip thank you very much for your answer,

First of all, running Nautilus as root doesn't give us access to any additional files.

Second, you're right, we checked /dev/md1 with Testdisk, not individual HDDs, because Testdisk didn't want to work on /dev/sda2 or /dev/sdb2 saying that this partition is a part of a raid array.

Third, I said that /bin, /home and /var are shown red when checking RAID with TestDisk, but those folders appear to be empty when I tried to get inside them (when in TestDisk)

Forth, here's output of sudo ls -ld /home /var /bin :

drwxr -xr -x 2 root root 2799 Apr 23 11:41 /bin
drwxr -xr -x 1 root root 60 Aug 9 18:56 /home
drwxr -xr -x 1 root root 120 Apr 23 11:38 /var

But this command checks not desired disk, but our virtual disk (we're working under Ubuntu live CD right now)

So, we modified this command to get to our desired mounted HDD like this: sudo ls -ld home var bin etc

ls: cannot access home: No such file or directory
ls: cannot access var: No such file or directory
ls: cannot access bin: No such file or directory
drwxr -xr -x 92 root root 4096 Aug 5 20:31 etc

(I added etc to the command just to check if command works, because etc is available on our HDD)

share|improve this question
add comment

1 Answer 1

Your first screenshot does not indicate a data loss. The message "some contents unreadable" indicates that the file manager could not read the sizes of all files because of file system permissions, not because of file system damage.

Running nautilus as root or sudo du -h /path on the command line will give you the file usage of all files.

Second, you say that folders are shown in red. What do you mean by this (where are they shown as red)? Deleted files and folders are not shown at all, so that is not the cause. It could be that there are just the permissions missing, or that these directories are in fact not directories but symbolic links where the target is missing (in this case, ls for example shows them in red color).

To further clear things up, please paste the output of sudo ls -ld /home /var /bin.

As to the read error, you say it is on one HDD, but the screenshot says it is on /dev/md1 (so on the raid with both disks)? In general, a single failure on a file system can create a complete data loss, but this is unlikely. I think you will be able to recover your data if you are careful, don't do something prematurely, and interpret all the signs and messages correctly.

An important note: Before you do anything, especially something which changes data on the disks (this includes raid resync, mounting, fscks, testdisk runs etc.), please make a complete bitwise dump of the disks! Only this way you will be able to safely experiment.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.