Re: how to recover filesystem after clobbering array?

[David Brown <david@westcontrol.com>]

On 19/07/2011 11:43, Vasco Névoa wrote:
>
> Hello people.
>
> I've messed up good, and now I need you nice folks to help me recover
> 500GB of irreplaceable home video, the full 7 years of my family trove. :(
>
> I mistakenly used mdadm to *create* an array instead of *starting* the
> array (big Duh!). Now the array has no partition table. I shudder to
> think I may have clobbered not only the array but also the file system.
> I hardly slept last night. Acceptance is a process. :/
>
> I've learned my lesson there, no more fiddling with "--assume-clean"
> (which was a stupid idea in the first place), but the issue remains: how
> do I get to the file system that I know is still there? The array is up
> but obviously it was never mounted.
>
> Can I just recreate the partition table and it works?.... or do I have
> to use some complex form of forensics to recover the data?
>
> Thank you very much,
> Vasco.
>

The first thing you should do is write out "RAID is not a backup 
solution" 100 times!

Then write down all the information you know - exactly how was the array 
built up, how were the disks partitioned, what filesystems, etc.  And 
what was the exact command you used to mess up the array, and how far 
did you let it go with resynchronisation, etc.  Make good notes here 
before you forget.

The next step is to get a couple spare disks that are bigger than your 
original disks (get 2 TB disks - they cost almost the same as anything 
smaller).  Make a direct copy of the entire original disks to a file on 
the new disks with something like:

	dd if=/dev/sda of=/mnt/backup/disk1.img bs=1M

Once you have got image files for each of your disks, make copies of 
these image files to another spare disk.  Keep careful notes of exactly 
what you have done here, and which files are which.  And put your 
original disks, carefully labelled, on a shelf somewhere.

Now you are in a position to attempt data recovery on your copied files. 
  If you do something wrong, you can simply re-copy the image files and 
try again.  You still have absolutely no guarantees that you'll get 
anything back - but at least you can be sure you are not going to make 
anything worse.

If you have started re-syncing the two disks as a RAID1 pair, there is a 
good chance that one of the disks contains the original data and 
filesystem, except where it was overwritten by the new metadata for the 
newly created array.

Then you sit back and hope that someone on this list can give you ideas 
about getting the data back from the image file(s).


--
To unsubscribe from this list: send the line "unsubscribe linux-raid" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html