Hi List, I appear to have turned my 120G backup server into a giant swap file. I typed mkswap -v1 /dev/hda (may have been hda1) instead of /dev/hda5. I've been battling for a day and am not much further down the line. I'm currently booted into knoppix. I'm trying: root@0[sda5]# mount /dev/hda1 /mnt/hda1/ -t ext3 mount: wrong fs type, bad option, bad superblock on /dev/hda1, or too many mounted file systems root@0[sda5]# dumpe2fs -h /dev/hda1 dumpe2fs 1.35 (28-Feb-2004) dumpe2fs: Bad magic number in super-block while trying to open /dev/hda1 Couldn't find valid filesystem superblock.
cfdisk reports my partitions as they should be with the filesystem as linux.
Is there any hope? Thanks. Jenny
Hi Jen
Booting from the Knoppix disk, run mke2fs -n /dev/hda1" to see where the superblock numbers are located [V.Important note: Make sure you use the -n flag]. Then try running "e2fsck -b<block number>", where the block number is one of the ones from the output of mke2fs - Don't use the first one, try the third or fourth... If all going well, you *should* be able to mount the disk.
Man pages for e2fcsk, mke2fs, and mount should provide additional info if needed.
Regards, Paul.
On Wednesday 09 March 2005 15:50, Jenny Hopkins wrote:
I appear to have turned my 120G backup server into a giant swap file. I typed mkswap -v1 /dev/hda (may have been hda1) instead of /dev/hda5. I've been battling for a day and am not much further down the line. I'm currently booted into knoppix. I'm trying: root@0[sda5]# mount /dev/hda1 /mnt/hda1/ -t ext3 mount: wrong fs type, bad option, bad superblock on /dev/hda1, or too many mounted file systems root@0[sda5]# dumpe2fs -h /dev/hda1 dumpe2fs 1.35 (28-Feb-2004) dumpe2fs: Bad magic number in super-block while trying to open /dev/hda1 Couldn't find valid filesystem superblock.
On Wed, 9 Mar 2005 16:26:46 +0000, Paul bdi-emc@ntlworld.com wrote:
Hi Jen
Booting from the Knoppix disk, run mke2fs -n /dev/hda1" to see where the superblock numbers are located [V.Important note: Make sure you use the -n flag]. Then try running "e2fsck -b<block number>", where the block number is one of the ones from the output of mke2fs - Don't use the first one, try the third or fourth... If all going well, you *should* be able to mount the disk.
Man pages for e2fcsk, mke2fs, and mount should provide additional info if needed.
Regards, Paul.
Hi Paul - thanks for replying. I tried this yesterday to no avail. Rebooting from hard drive gives kernel panic as wrong fs type found on hda.
I also found this today: http://www.uwsg.iu.edu/hypermail/linux/kernel/0104.2/1395.html which reckons e2fsck can make things worse.
This is what fdisk reckons I have: Disk /dev/hda: 122.9 GB, 122942324736 bytes 16 heads, 63 sectors/track, 238216 cylinders Units = cylinders of 1008 * 512 = 516096 bytes
Device Boot Start End Blocks Id System /dev/hda1 * 1 237223 119560360+ 83 Linux /dev/hda2 237224 238216 500472 f W95 Ext'd (LBA) /dev/hda5 237224 238216 500440+ 82 Linux swap
And this is where I have superblocks: Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 4096000, 7962624, 11239424, 20480000, 23887872
Of course, all the superblocks may think they are a giant swap file :-(
Thanks for help, Jen
Hi Jen
Reading some of the followups, I found this:http://www.uwsg.iu.edu/hypermail/linux/kernel/0104.2/1337.html
But if all your superblocks are corrupt, I fear you are in for a long night restoring from the backup disks... Unless Brett or one of the other experts know better..
Regards, Paul.
On Wednesday 09 March 2005 16:34, Jenny Hopkins wrote:
I also found this today: http://www.uwsg.iu.edu/hypermail/linux/kernel/0104.2/1395.html which reckons e2fsck can make things worse.
Of course, all the superblocks may think they are a giant swap file :-(
On Wed, 9 Mar 2005 16:26:46 +0000, Paul bdi-emc@ntlworld.com wrote:
Man pages for e2fcsk, mke2fs, and mount should provide additional info if needed.
Regards, Paul.
Hi, I've got the disk mounted. Hoorah hoorah! I re-ran e2fsk, then ran tune2fs -j, and then it finally mounted - I had tried them yesterday but maybe I did something else in between then and now. Anyway. That was the good news. The bad news is - ls for /mnt/hda1 shows nothing but lost and found, whereas df -h shows /dev/hda1 to be 71% full (what it was before it crashed). Lost and found is full of things listed like this: root@0[lost+found]# ls -l #1098288 -rw-r--r-- 1 root root 2910 Nov 12 2003 #1098288 I suspect they will add up to the 71%. I don't suppose I will rescue my data now, but I am curious as to what these are and what actually happened. Are they the 'inodes'?
Thanks, Jenny
Hi Jen
lost+found is where all the little bits of files end up that fsck can't associate with a particular file. With a little free time, you could take each "bit" and glue them all back together... Kind of like a jigsaw puzzle without the box to guide you.
Regards, Paul.
On Wednesday 09 March 2005 19:15, Jenny Hopkins wrote:
Anyway. That was the good news. The bad news is - ls for /mnt/hda1 shows nothing but lost and found, whereas df -h shows /dev/hda1 to be 71% full (what it was before it crashed). Lost and found is full of things listed like this: root@0[lost+found]# ls -l #1098288 -rw-r--r-- 1 root root 2910 Nov 12 2003 #1098288 I suspect they will add up to the 71%. I don't suppose I will rescue my data now, but I am curious as to what these are and what actually happened.
On Wed, 9 Mar 2005 19:28:04 +0000, Paul bdi-emc@ntlworld.com wrote:
Hi Jen
lost+found is where all the little bits of files end up that fsck can't associate with a particular file. With a little free time, you could take each "bit" and glue them all back together... Kind of like a jigsaw puzzle without the box to guide you.
Regards, Paul.
Yes, a 999,999 piece one at that! Thanks for your help, and all on irc. A reminder to sit on my hands before hitting enter when issuing commands as root. Jen.
Hi Jen
Despite the ribbing and quiet sniggers in the background (stop that iDunno), you have my deepest sympathies on your loss - I too have done some daft things with mount and rm when logged in as root.
Regards, Paul.
On Wednesday 09 March 2005 19:34, Jenny Hopkins wrote:
Yes, a 999,999 piece one at that! Thanks for your help, and all on irc. A reminder to sit on my hands before hitting enter when issuing commands as root.
On Wednesday 09 March 2005 7:45 pm, Paul wrote:
Hi Jen
Despite the ribbing and quiet sniggers in the background (stop that iDunno), you have my deepest sympathies on your loss - I too have done some daft things with mount and rm when logged in as root.
Regards, Paul.
Usually I get myself into pickles like that using the always dubious combination of the root password and a bottle of good wine.
One of my rainy day projects (and it would probably have to be a long rainy day) is to somehow interface one of those keyring breathalysers to my PC and set it up so a negative test is a requirement for a successful root login.
On Wed, 9 Mar 2005 22:08:10 +0000, Wayne Stallwood ALUGlist@digimatic.plus.com wrote:
On Wednesday 09 March 2005 7:45 pm, Paul wrote:
Hi Jen
Despite the ribbing and quiet sniggers in the background (stop that iDunno), you have my deepest sympathies on your loss - I too have done some daft things with mount and rm when logged in as root.
Regards, Paul.
Usually I get myself into pickles like that using the always dubious combination of the root password and a bottle of good wine.
One of my rainy day projects (and it would probably have to be a long rainy day) is to somehow interface one of those keyring breathalysers to my PC and set it up so a negative test is a requirement for a successful root login.
That is a splendid idea! I can't blame the wine on this act of foolishness...I was sat at work. The wine came later to drown my sorrows. Perhaps instead of a breathalyser we need a heartbeat detector so if the heart rate is up indicating the user being in too much of a hurry they are blocked.
Thanks for the kind words all. I've got the important bits backed up, will reinstall the reinstallable bits, and have managed to resue the incremental backups of the other servers (too much data there to make backups of the backups so I'm glad I rescued that: will save starting from scratch). Jen
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Jenny Hopkins hopkins.jenny@gmail.com wrote: <snip />
That is a splendid idea! I can't blame the wine on this act of foolishness...I was sat at work. The wine came later to drown my sorrows. Perhaps instead of a breathalyser we need a heartbeat detector so if the heart rate is up indicating the user being in too much of a hurry they are blocked.
And a brain pattern detector, to check that you are of sound mind and thinking about what you are doing, too. And, of course, the really nice thing would be for everything to be a changeset... what we need is a full changeset driven harddrive, so that we can just resort to the previous commited action ;)
Cheers, - -- Brett Parker web: http://www.sommitrealweird.co.uk/ email: iDunno@sommitrealweird.co.uk
On 09-Mar-05 Jenny Hopkins wrote:
On Wed, 9 Mar 2005 16:26:46 +0000, Paul bdi-emc@ntlworld.com wrote:
Man pages for e2fcsk, mke2fs, and mount should provide additional info if needed.
Regards, Paul.
Hi, I've got the disk mounted. Hoorah hoorah! I re-ran e2fsk, then ran tune2fs -j, and then it finally mounted - I had tried them yesterday but maybe I did something else in between then and now. Anyway. That was the good news. The bad news is - ls for /mnt/hda1 shows nothing but lost and found, whereas df -h shows /dev/hda1 to be 71% full (what it was before it crashed). Lost and found is full of things listed like this: root@0[lost+found]# ls -l #1098288 -rw-r--r-- 1 root root 2910 Nov 12 2003 #1098288 I suspect they will add up to the 71%. I don't suppose I will rescue my data now, but I am curious as to what these are and what actually happened. Are they the 'inodes'?
Hi Jenny,
I confess that when I saw your original post my reaction was "OUCH!!"
I'm a bit surprised that the OS mounted the partition as swap when mkswap had not been run on it -- apparently it didn't check whether it had been formatted as a swap partition.
Anyway, given that it happened my strong guess is that a lot of things got trashed if it was used in action as a swap partition.
Normally the things you find in lost+found like #1098288 are file fragments which correspond to lost inodes: it's a chunk of stuff which fsck can't manage to link to anything else.
If these are fragments of text files, then you've got some hope of reconstructing the originals, with a lot of work, since it's possible to read them!
But when they're bits of binary files (including things like base64-encoded attachments) then you haven't really got much hope.
Also, if these are chunks of swap, then they won't be bits of what was on the disk originally anyway.
Oh dear.
Best wishes, and sympathy, Ted.
-------------------------------------------------------------------- E-Mail: (Ted Harding) Ted.Harding@nessie.mcc.ac.uk Fax-to-email: +44 (0)870 094 0861 Date: 09-Mar-05 Time: 19:45:29 ------------------------------ XFMail ------------------------------
-
Brett Parker -
Jenny Hopkins -
Paul -
Ted.Harding＠nessie.mcc.ac.uk -
Wayne Stallwood