[linux-lvm] dd of a used part of a logical volume?

[linux-lvm] dd of a used part of a logical volume?

[Alexy Khrabrov]

I cross-post a part of my ReiserFS list message, as it
concernes copying of a used part of a filesystem running
on top of LVM.

I'd like to recover some files from a huge reiserfs file system.  It is
created above an LVM volume, which in its turn sits on a RAID.  The LVM
volume is the only one in a group which consists of the sole RAID device.
I just deleted two files in a directory I know by name, the directory is
still there.  No writing was done after the rm, except all files copied
elsewhere and diff -r'ed checked, hope that does not alter the originals.

Now I'd like to play with the dd copying of the whole reiserfs (I'm
avoiding the word partition since it covers the whole logical volume
which spans the whole RAID device).  I simply do not have space to copy
the whole RAID, but the size of the used space on this reiserfs volume was
under about 9 GB.  I wonder how can I copy just about that -- I assume it
fills the logical volume contiguously, so I can dd the first 9 GB and then
try the loopback mount/rebuild.  Now that I'm running it, it scrolls lines

pass0: reading block 20626210 failed

like crazy, perhaps up to the whole 150 GB original size declared
somewhere...

Then is quits, saying something about invalid argument to lseek,
not surprisingly as I cut dd short.

Are there LVM methods to shrink it/copy just the used blocks in
conjunction with reiserfs, such as resize_reiserfs?

-- 
Cheers,
Alexy Khrabrov :: www.setup.org :: Age Quod Agis

Re: [linux-lvm] dd of a used part of a logical volume?

[AJ Lewis]

[-- Attachment #1: Type: text/plain, Size: 1547 bytes --]

On Fri, May 28, 2004 at 02:45:53AM -0400, Alexy Khrabrov wrote:
> Now I'd like to play with the dd copying of the whole reiserfs (I'm
> avoiding the word partition since it covers the whole logical volume
> which spans the whole RAID device).  I simply do not have space to copy
> the whole RAID, but the size of the used space on this reiserfs volume was
> under about 9 GB.  I wonder how can I copy just about that -- I assume it
> fills the logical volume contiguously, so I can dd the first 9 GB and then
> try the loopback mount/rebuild.

ReiserFS tells where on the LV to write, LVM has nothing to do with it.  So
you really need to talk to the Reiserfs people to find out where metadata
and data would be written to on a 150GB volume.  It could be that some of
the data is at the front of the LV, and some is at the end.  LVM has nothing
to do with that - it just tells reiserfs it has 150GB to work with, write
stuff to it.

Regards,
-- 
AJ Lewis                                   Voice:  612-638-0500
Red Hat Inc.                               E-Mail: alewis@redhat.com
720 Washington Ave. SE, Suite 200
Minneapolis, MN 55414

Current GPG fingerprint = FE77 4B43 6A9B F982 A731  02FA 2BF5 7574 294A AA5A
Grab the key at: http://people.redhat.com/alewis/gpg.html or one of the
many keyservers out there...
-----Begin Obligatory Humorous Quote----------------------------------------
Computers make very fast, very accurate mistakes.
-----End Obligatory Humorous Quote------------------------------------------

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [linux-lvm] dd of a used part of a logical volume?

[Greg Freemyer]

On Fri, 2004-05-28 at 02:45, Alexy Khrabrov wrote:
> I cross-post a part of my ReiserFS list message, as it
> concernes copying of a used part of a filesystem running
> on top of LVM.
> 
> I'd like to recover some files from a huge reiserfs file system.  It is
> created above an LVM volume, which in its turn sits on a RAID.  The LVM
> volume is the only one in a group which consists of the sole RAID device.
> I just deleted two files in a directory I know by name, the directory is
> still there.  No writing was done after the rm, except all files copied
> elsewhere and diff -r'ed checked, hope that does not alter the originals.
> 
> Now I'd like to play with the dd copying of the whole reiserfs (I'm
> avoiding the word partition since it covers the whole logical volume
> which spans the whole RAID device).  I simply do not have space to copy
> the whole RAID, but the size of the used space on this reiserfs volume was
> under about 9 GB.  I wonder how can I copy just about that -- I assume it
> fills the logical volume contiguously, so I can dd the first 9 GB and then
> try the loopback mount/rebuild.  Now that I'm running it, it scrolls lines
> 
> pass0: reading block 20626210 failed
> 
> like crazy, perhaps up to the whole 150 GB original size declared
> somewhere...
> 
> Then is quits, saying something about invalid argument to lseek,
> not surprisingly as I cut dd short.
> 
> Are there LVM methods to shrink it/copy just the used blocks in
> conjunction with reiserfs, such as resize_reiserfs?

Personally, if the files are valuable I would spend $400 on a 200GB
drive and a ATA133 controller.  Then you can make dd copy of the whole
filesystem.  If you put that into a single large file, then you can use
the loopback driver to mount it read-only, or to search, etc.

If there is a chance there are some bad blocks on the original disks,
then be sure to use the "conv=noerror,sync" argument to dd.

You can find an interesting primer on how to do this at
http://www.linux-forensics.com/linuxintro-LEFE-2.0.5.pdf

I would also want to see if I could find any "computer forensic" tools
for working with reiser. 

In particular, the penguin sleuth CD
http://www.linux-forensics.com/downloads.html may be able to help you.

I don't know what filesystems it supports, but the concept is you boot
off of the penguin sleuth CD (based on Knoppix), then use either basic
tools like dd, grep, etc. to recover your files.  Or they also have some
true recovery tools on the CD like autopsy.  

The above primer talks about how to do much of this.

Assuming you know linux you can skim the first half of this, but the
second half may be of more interest.

Commercial note: We do this professionally, and thus have a couple of
commercial packages, but I don't know if they support reiser or not.  If
you would consider outsourcing your recovery, let me know and I can
check.

HTH
Greg
-- 
Greg Freemyer

Re: [linux-lvm] dd of a used part of a logical volume?

[Wolfgang Weisselberg]

Alexy Khrabrov wrote 40 lines:

[undeleting files w/ReiserFS]

> Now I'd like to play with the dd copying of the whole reiserfs (I'm
> avoiding the word partition since it covers the whole logical volume
> which spans the whole RAID device).

To any file system a logical volume is a partition.  

It just happens that the underlying system may be split over
several hard disks and do not even have to be continous --- just
as LVM sees a single hard drive, but in reality it's several hard
drives joined by a RAID system.

> I simply do not have space to copy
> the whole RAID, but the size of the used space on this reiserfs volume was
> under about 9 GB.  I wonder how can I copy just about that -- I assume it
> fills the logical volume contiguously,

And each time a file grows, you have to jump to the end of the
currently used space, just for that?  That's one of the things
that makes FAT a simple, slow file system.  ReiserFS --- and
most other intelligent file systems --- spread their data over
the whole disk, so even if files grow, the number of jumps the
hard disk head has to make to read a file completely stays low.

> Are there LVM methods to shrink it/copy just the used blocks in
> conjunction with reiserfs, such as resize_reiserfs?

How about asking if your RAID can't do that?  How *can* LVM know
if one chunk of it's space allocated to ReiserFS has been used
by ReiserFS or not?  And what if your precious files were on a
chunk that's *now* unused?

And even if LVM left out the blocks, wouldn't ReiserFS say "Go
block X (roughly 140 GB from the start) and read this block"
and wouldn't it be just too bad if you only had 9 GB, so this
search would fall wide outside the data range you have?

Do you really want LVM to know all intricacies of all file systems,
just to be able to do the job of a completely different tool,
badly?

-Wolfgang