3

The journal on my disk had died, and the drive was mounted only as read-only and I could not re-mount it as read write.

So I have unmounted it ran e2fsck and re-mounted the drive.

The disk is fixed, but the files are gone. I can actually see the space on the disk being taken by my files as:

Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/drive
                      1.9T   46G  1.7T   3% /drive

So They are there, I just cannot access it. The following is what I did

[root@box log]# umount /dev/mapper/drive
[root@box log]# e2fsck /dev/mapper/drive
e2fsck 1.41.12 (17-May-2010)
/dev/mapper/drive: recovering journal
/dev/mapper/drive contains a file system with errors, check forced.
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

/dev/mapper/drive: ***** FILE SYSTEM WAS MODIFIED *****
/dev/mapper/drive: 1704368/124518400 files (1.1% non-contiguous), 19741609/498065408 blocks

[root@box log]# mount -o remount,rw /drive

How can I recover the files? Did I re-mount it incorrectly? Thanks in advance!

1
  • What happens if you just run mount /drive without including options?
    – Kaz Wolfe
    Nov 25, 2016 at 18:22

2 Answers 2

3

First of all: Don't try to do further repairs on the original disk ! Use another hard drive and backup /dev/mapper/drive with "dd" as an image to the new disk: (I assume the new disk use a file system and is mounted to /mnt/newdisk directory)

dd if=/dev/mapper/drive of=/mnt/newdisk/drive.img bs=4M

after that you should try to repair only using the image-copy "mnt/newdisk/drive.img". mount the image and a look to the "lost+found" directory if you can find data inside this.

losetup -f /mnt/newdisk/drive.img
losetup -a|grep drive.img   ### get the /dev/loop-device
mkdir /mnt/drv-copy && mount /dev/loopX /mnt/drv-copy
ls -la /mnt/drv-copy/lost+found

But e2fsck will normally replay only the journal and exit. If you don't use -f -p e2fsck will not check and repair the file system structure. So if you don't had a I/O error caused by a media error before you shouldn't lost data. so check if you can find I/O messages on systemlog/dmesg during the "dd" copy. if not do an unmount on /mnt/dsk-copy and use "e2fsck -f -y

0

I was facing a similar issue on an Ubuntu Server 18.10 I have 2 HDD's (2TB) and 1 SSD (120GB). Ubuntu server is installed on the SSD. I initially ran

fsck -y /dev/sdb1

it kept giving me the message

***** FILE SYSTEM WAS MODIFIED *****

I search for a solution and came up with the e2fsck one. I ran e2fsck (only on one of the HDD's) and when I mounted it everything was gone.

e2fsck -y /deb/sdb1

What was giving me a headache was the fact that the e2fsck ran very quickly so it couldn't have delete all my data. And the files in the lost+found directory were not consistent with what I had before on my hard drive. So next I did this: Ran:

sudo e2fsck -f -y /dev/sdb1

Mounted the drive back and still nothing was shown.

Afterwards I ran:

sudo e2fsck -f -p /dev/sdb1

Now everything's back into place.

I was really scared that I couldn't recover my files, now everything seems ok. I need to mention that everytime I was rebooting the system it kept going in "recovery mode".

I know the question was posted 2y ago but in my desperate search I came across it and I just wanted to mention that this fixed my dissapearing files.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .