little linux file system help

[Howell]

Let's say "hypothetically" that I:

Installed the newest version of XenServer (5.6) over an older version (4.1) completely wiping out the partition and file tables and "deleting" my VMs. How can I recover those files? I do not know what the file system was at the time of deletion. They also don't have the backups they said they did. It sits on top of HW RAID5 so I can't even pop out a disk to preserve it.

I'd like to start with preserving the problem as it is. How can I take an image of the disk booting from CD and writing the data to a USB drive that will preserve all "deleted" files?

How do I go about recovering the VM files from a linux filesystem?

 

[ddrueding]

I know that Acronis allows "block level" imaging that may help you preserve what you have. The rest will have to wait for a *nix guy.

 

[Mercutio]

Well,

dd /if=/dev/[whatever the disk device or array is] conv=noerror,sync | bzip2 > blah.bz2

Would in theory make a complete copy of the array, presuming there's a USB drive or something big enough to hold blah.bz2. Then maybe you can run debugfs against that.

 

[Howell]

Thanks for the suggestions.

I'm in the middle of running PhotoRec in read-only mode. I'll let you know how it pans out.

 

[blakerwry]

I believe XenServer uses ext3 within LVM. If PhotoRec doesn't pan out for you, it looks like there are a few tools out there specifically intended for ext3 data recovery. I'd suggest googling for ext3 data recovery and try one or more of them.

 

[Howell]

Thanks for the chime in. Yep that version was a RH kernel with ext3 and LVM.

Photorec didn't work out well for me mainly, I think, because although it has .vmdk file headers in its tables it doesn't seem to know anything about .vhds. It doesn't seem to be able to go to a lower level than that. It did find 2 .vmdks about the right size but there are not supposed to be any vmdks on there so I don't know what to make of that.

I was able to see one of the VMs and its contents using EASEUS disk recovery wizard pro DEMO but unfortunately it is the less important of the two. I'm restoring the sector backup I made right after the incident to give me my best shot at recovery.

When booting from a Knoppix CD should I have to run a command to get proper access to the LVM?

 

[blakerwry]

Normally, Knoppix does a scan on boot and tries to mount all drives connected to the system. For working disks it's very convenient. Should work with LVM and just about any file sysyem out there.

But I'm not sure how it would load the old LVs if the disk has since been repartitioned. I imagine a vgscan would only show the new LV's that were created when you installed the new version of XenServer.

 

[Howell]

The folder structure is a nightmare but the EASUS software recovered the data. It's crazy how long stuff can stick around if you don't security wipe the disk.

 

[Howell]

I spoke too soon.
The folder structure, file names and file sizes are are all right but the files themselves are corrupt.
Bummer.