Volume Group Extended and lost data

Using TestDisk to undelete files
Message
Author
moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Volume Group Extended and lost data

#1 Postby moacirfaria » 30 May 2012, 19:34

I have a big challenge and I am trying to solve the problem using the TestDisk or PhotoRec.

We had a volume group with 4 disks with 512Gb.
This VG was extended and received 10 more volumes of 512Gb.
The entire volume group had 14 disks of 512Gb and was formated.
The guy that increased the volume don't backed up the data files and this files are very important.

I tried to recreate the volume group with 4 disks, but the information now have 14 disks.

I am trying to run the TestDisk and PhotoRec but I don't know if this is the correct way to solve this problem.

Someone believe that we can recovery this data?

Thank you very much!

Moacir

Sponsored links

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#2 Postby remy » 30 May 2012, 20:10

I suppose you mean you had a LVM (lvm2 ?) with 1 VG covering 4PV and splitted (or not splitted ?) in several LV.

What do you mean by "formated" ? Operation from LVM that kills previous LV ? Or creation of new filesystem using mkfs or something like that ?
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.

moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Re: Volume Group Extended and lost data

#3 Postby moacirfaria » 30 May 2012, 20:28

Yes Remy, you are correct! lvm2!

Formated means wiped! Sorry, english is not my first language!

Yes, new filesystem was created!

Thank you,
Moacir

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#4 Postby remy » 30 May 2012, 23:49

moacirfaria wrote:Yes Remy, you are correct! lvm2!

Formated means wiped! Sorry, english is not my first language!

No problem, neither me.

I don't think (and I hope) you've physically wiped 7TB of disks : It would have taken several days. Wiped means there : writing one "0" over each bit of data. If you've done that, forget datarecovery. It's just impossible to recover.
moacirfaria wrote:Yes, new filesystem was created!
Moacir


What's the filesystem, and what was the process of creation ? Do you have several LVs or just one big ?
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.

moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Re: Volume Group Extended and lost data

#5 Postby moacirfaria » 31 May 2012, 01:31

Remy,

thank you for your patience!

Certainly they have not wiped the disk. If this action take this long time that you told me, I am certain that this action not ran. Thanks god!

Then... go to the next step.

The history start when they needed to extend the "space". At this moment they had 2Gb Logical Volume formed by 4 PV´s. Than, they tried to extend inserting more 10 PV´s in this same logical volume. At this moment they created a new filesystem, and the data disapear. They tried to return to get the old structure, with only 4 PV's, but the data don't appear again.

They tried to mount and dismount, create new VG, LG, insert or delete disks in the LG.

At this moment, we have the LV with 14 PV´s running the analisys of TestDisk.

I don't know if the correct way to recovery the data is use the LV with 4 PV´s or with the new structure, with 14 PV´s.

Can you help me?

Thank you very much!

Moacir

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#6 Postby remy » 01 Jun 2012, 00:14

It will be quite hard... because of the number of destructive tries (inserting and removing PV in the VG) The only hope you may had is that the LV stripes remain the same for the 4 first disks and try to recover with testdisk (table type none, option : align parition, "no") the old filesystem, or try to recover with photorec. What are the file extensions you are looking for ?
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.

moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Re: Volume Group Extended and lost data

#7 Postby moacirfaria » 01 Jun 2012, 03:48

remy wrote:It will be quite hard... because of the number of destructive tries (inserting and removing PV in the VG) The only hope you may had is that the LV stripes remain the same for the 4 first disks and try to recover with testdisk (table type none, option : align parition, "no") the old filesystem, or try to recover with photorec. What are the file extensions you are looking for ?


Remy, thank you for your reply.

I am trying to run "Analisys" on the entiry LV with 7Tb. Now, I have 45% completed... the process is running almost 24 hours.

I'm looking for edx, key, ndx, sar files.

I tried to run Photorec and It recovered 32.000 files, but they don't have the correct names and the software recovered the files, probably key files, with txt extension but don't recovery the others (sar, edx, ndx).

:-(

I have a linux machine before but Testdisk is showing some lines with "MS Data *number* *number* *number*".

Is correct this behavior?

Thank you very much,
Moacir

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#8 Postby remy » 01 Jun 2012, 08:00

You probably select EFI/GPT table type. Choose intel instead when analysed by testdisk and give feedback about the different partitions it found.
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.

moacirfaria
Posts: 16
Joined: 30 May 2012, 19:31

Re: Volume Group Extended and lost data

#9 Postby moacirfaria » 01 Jun 2012, 14:09

remy wrote:You probably select EFI/GPT table type. Choose intel instead when analysed by testdisk and give feedback about the different partitions it found.


Remy,

can I run 2 process of "Analysis" at the same time?
Is there a problem?

Thank you,
MF

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Volume Group Extended and lost data

#10 Postby remy » 01 Jun 2012, 20:34

Yes it's really dangerous for your disk, as far as head will have to go always from A to B to A to B and so on. And it won't be quickest. The only case were you can do that is with a good computer, and two different drives to analyse.
J'ai pour habitude d'aller au bout de l'aide que j'apporte. Si vous pensez que je vous ai abandonné, et que je ne l'ai pas fait explicitement, c'est que votre message est enfoui avec d'autres. Relancez-moi (modérément) par mail.


Return to “File undelete”

Who is online

Users browsing this forum: No registered users and 0 guests