Linux meltdown
December 24, 2003 7:13 AM   Subscribe

Linux meltdown! Catastropic crash and the kernel didn't survive. I can't mount anything from the HD in rescue mode. Is there a program that will let me pick over the ruins and retrieve 12 gigs of mp3s (including some rare Clash bootlegs that I can never ever find again!)?

The failed recovery may be due to operator ignorance, but I'm thinking that if three hours of entering rejected commands yielded nothing, I'm a long way away from being able to do this without some tools.

Oh yeah, it was Suse 8.1 on an old Compaq 7470 if it matters.
posted by Mayor Curley to Computers & Internet (12 answers total)
Happy Birthday sucker.
posted by yerfatma at 7:25 AM on December 24, 2003

Mayor, there's a version of Linux called Knoppix. It can be burned to a cd, then you can use it to boot the machine, connect to a network, and move the files. I could send you a cd.

Alternatively, you may be able to mount the drive on another linux box, and pull the files off. I've used both these methods to recover NTFS files. Good luck.
posted by theora55 at 7:32 AM on December 24, 2003

try knoppix first.

if you still can't get to the drive, attempt an upgrade installation (i.e. don't have the install format the linux partitions) this may repair the filesystem.
posted by lescour at 7:39 AM on December 24, 2003

Yeah... it's entirely possible that you only lost one of the partitions, not all of 'em. Knoppix can help you get at your files and move 'em off to somewhere better...
posted by ph00dz at 7:47 AM on December 24, 2003

Thanks so much! I'm downloading a knoppix iso which I'll use when I get back here after Christmas!

Happy birthday to you too, Yerfatma. Learn from my mistake and don't trust Gerry. Use Mandrake or something.
posted by Mayor Curley at 8:09 AM on December 24, 2003

Here are the steps I'd follow. I'm assuming that you use ext2 or ext3. If not, debugfs won't work.

1. Boot from some sort of rescue CD.
2. Try mounting the partition.
3. Try fixing the filesystem with e2fsck (also known as fsck.ext2).
4. Try poking around the filesystem with debugfs. This is a pretty advanced tool, and I've only really used it to remove a file that had an incorrect (and very large) reported file size.
5. Save a copy of the partition by doing 'dd if=/dev/hda1 of=partition.img'. This will preserve a copy of the partition in its hopefully still not-completely-hosed state. Then you can try all sorts of different things to it. This file can only be up to 2GB unless you have support for large files compiles into your kernel. Hopefully you do!

Anyhow... good luck!
posted by lalas at 10:30 AM on December 24, 2003

Mayor Curley - Backup, backup, backup!

'Cause any data not backed up will eventually be lost. Spare hard drives - 1 to 10 gigs (or even more) are dirt cheap. I get 'em at my local dump, and a simple hack lets you run an IDE cable and power out your computer box so you can just take any 'ol IDE hard drive, set the jumper/s to "slave" (and your main HD probably will need to be set to "master" and not single/default ) and then just plug it in and save those precious clash cuts.

My Mac OS 10.2.2 melted down a few months ago - I was so pissed off (OS 10 less stable than OS 9.2 ?......) that I bought a data rescue program designed explicitly to save files lost in such a meltdown. It worked relatively well, and I'd bet there are analogous tools for Linux. One tip though - if you can possibly do it, copy the entire contents of the crashed disc to a new disc - just in case. That way, if you can't rescue the data now, you'll still have it and may be able to do so in the future.

Also - data rescue programs that run in your OS's background and constantly update redundant directories are a very smart way to a crash, you're much more likely to be able to find intact directory chunks - or even the whole thing. As a matter of fact, you could do nothing but back up the directory tree to a floppy - or whatever - and do pretty well. But then, there's always mechanical failure or bad media, lightning strikes, power surges, mice, roaches...... backups. Kept elsewhere, another apartment or house, a safety deposit box, whatever. Even better than single-location RAID arrays, I'd say.
posted by troutfishing at 11:06 AM on December 24, 2003

(on the backup to disk thing - my partner's place of work was hacked and the bastards wiped disks. they were backing up to disk. backups were wiped too. it made me see tapes in a new light)
posted by andrew cooke at 11:22 AM on December 24, 2003

andrew - yup, or hard drives unconnected to any networks (or computers at all) - Put 'em in anti static baggies, stick 'em on the shelf.
posted by troutfishing at 11:49 AM on December 24, 2003

Backing up to hard disk is so much more convenient than tape, it only makes sense. And with 160GB drives about $100 these days, you can treat the drives as you would tape cartridges -- rotate them, store them offsite, etc. You can maintain a live mirror (which is bootable) as well as compresesd archives in case you need to go back to a previous version of your files.

There are two kinds of computer users. Those who already know to make backups, and those who are about to learn.
posted by kindall at 1:37 PM on December 24, 2003

Backing up to hard disk is so much more convenient than tape, it only makes sense. And with 160GB drives about $100 these days, you can treat the drives as you would tape cartridges -- rotate them, store them offsite, etc.

i bought an external (usb 2) ide hard drive case to do this for non-critical machines at the office, and we just rotate hard drives in it like it was a tape device. works fairly well, and is a lot less trouble/expense than tape.

we still use scsi tape drives for certain mission critical boxes
posted by lescour at 11:54 AM on December 25, 2003

Too little, too late, I realize, but what about this?
posted by yerfatma at 9:06 AM on January 7, 2004

« Older School vs Work   |   Asking for a Raise Newer »
This thread is closed to new comments.