Volume Group Extended and lost data

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Volume Group Extended and lost data

#1 Post by moacirfaria »

I have a big challenge and I am trying to solve the problem using the TestDisk or PhotoRec.

We had a volume group with 4 disks with 512Gb.
This VG was extended and received 10 more volumes of 512Gb.
The entire volume group had 14 disks of 512Gb and was formated.
The guy that increased the volume don't backed up the data files and this files are very important.

I tried to recreate the volume group with 4 disks, but the information now have 14 disks.

I am trying to run the TestDisk and PhotoRec but I don't know if this is the correct way to solve this problem.

Someone believe that we can recovery this data?

Thank you very much!

Moacir

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#2 Post by remy »

I suppose you mean you had a LVM (lvm2 ?) with 1 VG covering 4PV and splitted (or not splitted ?) in several LV.

What do you mean by "formated" ? Operation from LVM that kills previous LV ? Or creation of new filesystem using mkfs or something like that ?

moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Re: Volume Group Extended and lost data

#3 Post by moacirfaria »

Yes Remy, you are correct! lvm2!

Formated means wiped! Sorry, english is not my first language!

Yes, new filesystem was created!

Thank you,
Moacir

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#4 Post by remy »

moacirfaria wrote:Yes Remy, you are correct! lvm2!

Formated means wiped! Sorry, english is not my first language!
No problem, neither me.

I don't think (and I hope) you've physically wiped 7TB of disks : It would have taken several days. Wiped means there : writing one "0" over each bit of data. If you've done that, forget datarecovery. It's just impossible to recover.
moacirfaria wrote: Yes, new filesystem was created!
Moacir
What's the filesystem, and what was the process of creation ? Do you have several LVs or just one big ?

moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Re: Volume Group Extended and lost data

#5 Post by moacirfaria »

Remy,

thank you for your patience!

Certainly they have not wiped the disk. If this action take this long time that you told me, I am certain that this action not ran. Thanks god!

Then... go to the next step.

The history start when they needed to extend the "space". At this moment they had 2Gb Logical Volume formed by 4 PV´s. Than, they tried to extend inserting more 10 PV´s in this same logical volume. At this moment they created a new filesystem, and the data disapear. They tried to return to get the old structure, with only 4 PV's, but the data don't appear again.

They tried to mount and dismount, create new VG, LG, insert or delete disks in the LG.

At this moment, we have the LV with 14 PV´s running the analisys of TestDisk.

I don't know if the correct way to recovery the data is use the LV with 4 PV´s or with the new structure, with 14 PV´s.

Can you help me?

Thank you very much!

Moacir

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#6 Post by remy »

It will be quite hard... because of the number of destructive tries (inserting and removing PV in the VG) The only hope you may had is that the LV stripes remain the same for the 4 first disks and try to recover with testdisk (table type none, option : align parition, "no") the old filesystem, or try to recover with photorec. What are the file extensions you are looking for ?

moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Re: Volume Group Extended and lost data

#7 Post by moacirfaria »

remy wrote:It will be quite hard... because of the number of destructive tries (inserting and removing PV in the VG) The only hope you may had is that the LV stripes remain the same for the 4 first disks and try to recover with testdisk (table type none, option : align parition, "no") the old filesystem, or try to recover with photorec. What are the file extensions you are looking for ?
Remy, thank you for your reply.

I am trying to run "Analisys" on the entiry LV with 7Tb. Now, I have 45% completed... the process is running almost 24 hours.

I'm looking for edx, key, ndx, sar files.

I tried to run Photorec and It recovered 32.000 files, but they don't have the correct names and the software recovered the files, probably key files, with txt extension but don't recovery the others (sar, edx, ndx).

:-(

I have a linux machine before but Testdisk is showing some lines with "MS Data *number* *number* *number*".

Is correct this behavior?

Thank you very much,
Moacir

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#8 Post by remy »

You probably select EFI/GPT table type. Choose intel instead when analysed by testdisk and give feedback about the different partitions it found.

moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Re: Volume Group Extended and lost data

#9 Post by moacirfaria »

remy wrote:You probably select EFI/GPT table type. Choose intel instead when analysed by testdisk and give feedback about the different partitions it found.
Remy,

can I run 2 process of "Analysis" at the same time?
Is there a problem?

Thank you,
MF

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#10 Post by remy »

Yes it's really dangerous for your disk, as far as head will have to go always from A to B to A to B and so on. And it won't be quickest. The only case were you can do that is with a good computer, and two different drives to analyse.

Locked