Lost everything from group share

[robaq]

Hello,

I'm a new user of eBox 1.2
Unfortunately I have a big problem.
I make configuration backup after every configuration change.

Yesterday I decided to restore the last configuration.
Today I found that I lost all files from samba group's share.

How can I recover them?
I lost about 15GB of family pictures (these are the most important to me) and many other files.

PLEASE HELP!!!!

Kind regards - Robert

[robaq]

Hello again,

The situation is even worse.
I made some investigation I found that lost everything that was placed on "/home".

Here is my hardware config:
1x 20GB IDE "system" drive
2x 1TB SATA "storage" drives:

• Software RAID0 made of two 250GB partitions - mounted as /mnt/fast (EXT3)
• Software RAID1 made of two 750GB partitions - mounted as /home (EXT3)

What kind of tool I need to use in order to recover my files?

Regards - Robert

[J. A. Calvo]

You should have done a full backup instead of a configuration one... the configuration backup only stores the settings on the eBox interface, it doesn't save emails, samba data, etc...

http://doc.ebox-platform.com/en/backup.html#configuration-backups

[SamK]

What kind of tool I need to use in order to recover my files?

You have not indicated the reason for restoring a previous backup.  Assuming this did not detrimentally affect the data on your storage drives it might be possible to conduct recovery using Parted Magic:
http://partedmagic.com/
This allows the machine to be booted from a CD-ROM and contains mdadm which enables your RAID arrays to be accessed.  A range of other tools for data recovery is also included.  

Imaging software is also in available Parted Magic which will allow the creation of a copy of your data partitions and/or disk.  This means that you can then attempt recovery from the copy without the risk of losing/damaging the data on your current storage drives.  Any images created for this purpose should not be stored or restored on your current storage drives to ensure the existing data is not overwritten.

From your opening post it is unclear whether you are reporting a possible bug in the way in which the configuration backup works.  If so, it might be helpful to the Devs to indicate what happened immediately before the restore was conducted.  What were the reasons and purpose of the configuration changes and which version of eBox you are running.

[robaq]

J. A. Calvo I know that it is good to make a backup of data stored on disk but this was a new config (I installed eBox last weekend) and I had no time to do a backup jet.

What kind of tool I need to use in order to recover my files?

You have not indicated the reason for restoring a previous backup.  Assuming this did not detrimentally affect the data on your storage drives it might be possible to conduct recovery using Parted Magic:
http://partedmagic.com/
This allows the machine to be booted from a CD-ROM and contains mdadm which enables your RAID arrays to be accessed.  A range of other tools for data recovery is also included.  

Imaging software is also in available Parted Magic which will allow the creation of a copy of your data partitions and/or disk.  This means that you can then attempt recovery from the copy without the risk of losing/damaging the data on your current storage drives.  Any images created for this purpose should not be stored or restored on your current storage drives to ensure the existing data is not overwritten.

The reason was that I was playing around config of firewall and OpenVPN and since I made too many changes I decided to make a one "step back" in the eBox config.

I didn't even imagine that it can try to "touch" the files on shares  .

What I have learned is that starting from today I will never put important files within /home or any other group's shares (on eBox of course). Why? Because every single file placed on my "unsafe" RAID0 (mounted at /mnt/fast) remained unchanged.

Since I am a network administrator in a bank I have some experience in recovering data after a crash but unfortunately never from linux box.

Here is my recovery plan:
1. Turn it off
2. Unplug 1 sata hard drive
3. Boot it with some livecd (downloaded a RIP linux 10 minutes ago)
4. Try to mount the "Software RAID" partition as EXT3 (I don't know if it's possible)
5. Mount a samba share from other PC
6. Try the "grep recovery" of the EXT3 to samba share.

What do you think about the plan?

[jsalamero]

i don't know what exactly happened but i'm going to try to reproduce the issue you had (main backup developer is on holidays now). i'm sorry you lost such valuable data but first rule dealing with critical information is raid is not a backup. backup means data in a different system, better if it's miles away.

good luck with the rescue and i'm going to have a look on this.

[SamK]

Unfortunately, your circumstances provide a good example of RAID offering no protection against configuration issues.  However, the Devs are investigating the configuration backup aspect.

Here is my recovery plan:
1. Turn it off
2. Unplug 1 sata hard drive
3. Boot it with some livecd (downloaded a RIP linux 10 minutes ago)
4. Try to mount the "Software RAID" partition as EXT3 (I don't know if it's possible)
5. Mount a samba share from other PC
6. Try the "grep recovery" of the EXT3 to samba share.

What do you think about the plan?

I cannot make any comment about the tools you mention as I have never used them.

In general, it is unclear what benefit is gained by removing one of the disks.  The array will be seen as degraded but will still need to be assembled and run in order to gain access to the data.  You will also be working directly on primary data storage which further puts at risk your valuable data.  Wherever possible maintaining the integrity of the original data is preferred.  Working on a copy reduces the risk.

[robaq]

In general, it is unclear what benefit is gained by removing one of the disks.  The array will be seen as degraded but will still need to be assembled and run in order to gain access to the data.  You will also be working directly on primary data storage which further puts at risk your valuable data.  Wherever possible maintaining the integrity of the original data is preferred.  Working on a copy reduces the risk.

Since the lost data was stored on RAID1 I can assume that partitions on both disks are identical. So if I even ruin the one disk completely I still have the second one laying on my desk as backup copy. This is what I will do on server with hardware RAID controller.
As I wrote previously I'm not sure if this will work with software RAID partition. I hope it will.
The biggest problem is the EXT3 file system which makes recovery almost impossible.

[SamK]

Since the lost data was stored on RAID1 I can assume that partitions on both disks are identical. So if I even ruin the one disk completely I still have the second one laying on my desk as backup copy.

You are the best judge of the risks to take with your own data.  Even when using a single disk of the RAID array it is possible that you will have to assemble and run it as a degraded array in order to gain access to the data.

The biggest problem is the EXT3 file system which makes recovery almost impossible.

I must confess to being confused by this comment as ext3 is one of the most widely used file systems, having a history of reliable performance, with lots of tools available that work well with it.

[robaq]

I must confess to being confused by this comment as ext3 is one of the most widely used file systems, having a history of reliable performance, with lots of tools available that work well with it.

I know that EXT3 is the default file system on most of the Linux Distributions but I suggest you to read the following FAQ:
http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html

I think that many people should read this because they should know what they use.
If you spend some time to search on google you will find that it's almost impossible to find a tool which recovers lost data from EXT3.

[SamK]

The following observations seem pertinent:

• The information referred to was last updated in 2004
• It makes no reference to recovering data from an ext3 file system on a RAID1 array which is not readable due to misconfiguration but is otherwise intact
• It makes no reference to recovering data from an ext3 file system on a RAID1 array on which the files are not accessible/readable due to misconfiguration
• An address of a site with a range of tools has been provided

Edited by SamK Sep 12 2009 to improve clarity.

At this juncture I will withdraw from any further input and leave other members to offer whatever assistance they wish to.

[robaq]

The following observations seem pertinent:

• The information referred to was last updated in 2004
• It makes no reference to recovering data from an ext3 file system on a RAID1 array which is not readable due to misconfiguration but is otherwise intact
• An address of a site with a range of tools has been provided

At this juncture I will withdraw from any further input and leave other members to offer whatever assistance they wish to.

It seems that you didn't understand me correctly.
Maybe that's because of my English which is my foreign language.
Both arrays on my both 1TB hard drives are readable. As I wrote previously I reverted the configuration yesterday. Today morning my wife asked me to put some pictures to her pendrive before she goes to work. While accessing the share to find them I noticed that something is wrong.

I know that the article is old but I spent almost a whole day on looking for appropriate tool.
Here is what I found:

• Testdisk - this helps to recover lost partitions (doesn't work for me since I lost files)
• photorec - this one should allow to recover lost files (I'm using it right now)
• hundreds of commercial tools to recover files from EXT3
• hundreds of websites/forums where people write that it's impossible to recover anything from EXT3 using freeware tools
• http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html - I will try to go thorough this howto when photorec fails

I really appreciate any ideas comments and I thank all of you for trying to help me.

[dragonslayr]

I've never tried to recover from ext3. However, maybe a suggestion or two??
By default the 1.2 installer enables backup to /mnt/backup. Have you looked there?

Secondly, where did the pics originally come from, my you be able to recover from there?

Hope this helps..  If nothing else, it's a good reminder for the rest of us to keep good backups at all times.

Good luck..

[robaq]

I've never tried to recover from ext3. However, maybe a suggestion or two??
By default the 1.2 installer enables backup to /mnt/backup. Have you looked there?

Secondly, where did the pics originally come from, my you be able to recover from there?

Hope this helps..  If nothing else, it's a good reminder for the rest of us to keep good backups at all times.

Good luck..

When I installed eBox I didn't know about the /mnt/backup.
My "system" drive is only 20GB and the backup location was placed on it so after the first full backup the whole ebox stopped working because there was no room for this backup.

I must confess that I turned off the automatic backup in the modules section after mentioned situation.

Now I know that 50% of my current problem is my fault because if I had a backup I wouldn't be writing this right now.

As SamK wrote my situation shows that RAID1 is not always the best option.
After I finish with recovering my data I will repartition the drives to have 1 for the /home and 1 for the /mnt/backup.

[dragonslayr]

i don't know what exactly happened but i'm going to try to reproduce the issue you had (main backup developer is on holidays now). i'm sorry you lost such valuable data but first rule dealing with critical information is raid is not a backup. backup means data in a different system, better if it's miles away.

good luck with the rescue and i'm going to have a look on this.

Just to see, on my test ebox, I backed up the configuration. Then restored it. It did indeed delete the user files when restoring a configuration backup. This should not be..  or at the very least, it should warn you. As most people would assume a "configuration" restore would not touch the user data..

  Installed: 1.2.8-0ubuntu1~ppa1~hardy1
  Candidate: 1.2.8-0ubuntu1~ppa1~hardy1
  Version table:
 *** 1.2.8-0ubuntu1~ppa1~hardy1 0
        500 http://ppa.launchpad.net hardy/main Packages
        100 /var/lib/dpkg/status
     0.11.99-0ubuntu11 0
        500 http://us.archive.ubuntu.com hardy/universe Packages