Issue recovering a md device with first 4kB lost.

Issue recovering a md device with first 4kB lost.

[Massimo Gais]

Hello,

I'm trying to recover an ext4 filesystem in a md device of a degraded
RAID 1 array (i.e. last copy of the mirror), where the beginning of
the partition that was hosting the md device was unreadable, due to
disk failure. Unfortunately I don't have the mdadm.conf file.
Using dd, I was able to copy entirely the damaged partition to a
different disk, except the first 4096 bytes (dd returns I/O error
there).
The md device has been probably created with mdadm v3.14, and under
kernel 2.6.32.12, and it uses metadata v1.2.
From a hexdump, at offset 0x21200 I can see the marker 'LABELONE' and
shortly after that the 'LVM2' (the ext4 partition in question is
contained in a LVM volume).
From my understanding, with metadata 1.2 at offset 0x1000 there should
be the the md superblock, but from the hexdump, nor at 0x1000 and
nowhere in the first 10MB of the partition I can find the 0xa92b4efc
'magic number'. The first non-zero byte in that partition is at offset
0x21200.

I think all what is missing in order to access the ext4 filesystem is
the md superblock, but what can I do to recreate it?
I tried some thing like: mdadm --create /dev/md4 --level=1 --force
--raid-devices=1 --metadata=1.2 --assume-clean /dev/sdd5, but the
command doesn't seem to help and actually after being executed I
noticed I cannot even find anymore the LVM2 marker in the physical
partition behind.

Thanks

Re: Issue recovering a md device with first 4kB lost.

[Miquel van Smoorenburg]

On 9-10-12 12:46 AM, Massimo Gais wrote:
> I think all what is missing in order to access the ext4 filesystem is
> the md superblock, but what can I do to recreate it?

If you know where the ext4 filesystem starts, and you just want to 
access it, then why not use a loopback device with an offset to get at 
the filesystem ?

Something like

	losetup -o <offset-of-ext4-fs> /dev/loop0 /dev/sdd5
	mount -text4 -o ro /dev/loop0 /mnt

Mike.

Re: Issue recovering a md device with first 4kB lost.

[Mikael Abrahamsson]

On Tue, 9 Oct 2012, Miquel van Smoorenburg wrote:

> On 9-10-12 12:46 AM, Massimo Gais wrote:
>> I think all what is missing in order to access the ext4 filesystem is
>> the md superblock, but what can I do to recreate it?
>
> If you know where the ext4 filesystem starts, and you just want to access it, 
> then why not use a loopback device with an offset to get at the filesystem ?
>
> Something like
>
> 	losetup -o <offset-of-ext4-fs> /dev/loop0 /dev/sdd5
> 	mount -text4 -o ro /dev/loop0 /mnt

That assumes that lvm has allocated a continous amount of blocks for the 
filesystem. It might be better to try to find the lvm offset and then get 
lvm started properly and then getting the filesystem through lvm.

-- 
Mikael Abrahamsson    email: swmike@swm.pp.se

Re: Issue recovering a md device with first 4kB lost.

[Massimo Gais]

On Tue, Oct 9, 2012 at 10:19 AM, Mikael Abrahamsson <swmike@swm.pp.se> wrote:

>> If you know where the ext4 filesystem starts, and you just want to access
>> it, then why not use a loopback device with an offset to get at the
>> filesystem ?
>>
>> Something like
>>
>>         losetup -o <offset-of-ext4-fs> /dev/loop0 /dev/sdd5
>>         mount -text4 -o ro /dev/loop0 /mnt
>
>
> That assumes that lvm has allocated a continous amount of blocks for the
> filesystem. It might be better to try to find the lvm offset and then get
> lvm started properly and then getting the filesystem through lvm.
>

How to find that offset for the ext4? And I guess that to verify
whether lvm has allocated a continuous amount of blocks, a "fsck -n
/dev/loop0" would allow to test that the fs is in a consistent state.

Otherwise, which command to use to start lvm properly?

Re: Issue recovering a md device with first 4kB lost.

[Massimo Gais]

On Tue, Oct 9, 2012 at 10:28 AM, Massimo Gais <massimo.gais@iki.fi> wrote:
>
> How to find that offset for the ext4? And I guess that to verify
> whether lvm has allocated a continuous amount of blocks, a "fsck -n
> /dev/loop0" would allow to test that the fs is in a consistent state.
>
> Otherwise, which command to use to start lvm properly?

Update: I checked and found that at offset 201728 there is the begin
of a ext4 superblock.
Comparing with a working ext4 fs, I see that superblock should be a
1024 from beginning of the partition,
so I tried Miquel's suggestion and run a "losetup -o 200704 /dev/loop0
/dev/sdd5"
It seems that has worked as an "fsck -n /dev/loop0" finally finds
something valid...

>fsck 1.41.14 (22-Dec-2010)
>e2fsck 1.41.12 (17-May-2010)
>Warning: skipping journal recovery because doing a read-only filesystem check.
>1.41.12-1285 contains a file system with errors, check forced.
>Pass 1: Checking inodes, blocks, and sizes
>Pass 2: Checking directory structure
>Pass 3: Checking directory connectivity
>Pass 4: Checking reference counts
>Pass 5: Checking group summary information
>Block bitmap differences:  -1100820 -1101341 -1101842 -1487894 -37977108
>Fix? no
>
>Free blocks count wrong (22975283, counted=12863078).
>Fix? no
>
>Free inodes count wrong (60447101, counted=60446034).
>Fix? no
>

Do you think that the fs is in a usable state?

Thanks