Solved

recovering/finding data lost in a crash?

Posted on 2000-02-15
12
204 Views
Last Modified: 2010-04-20
I'm running Linux 2.2.10 with RT-Linux.
During a data acquisition task, my computer locked up and I had to do a hard reboot. When the computer came back
up, my data file that was open and being written to during the crash, another closed datafile, and the directory containing both datafiles were missing. i.e., directory newdata, which contains the files file1.dat and file2.dat was totally missing. (My application was in the middle of writing to file2.dat when the computer crashed). If it was just file2.dat that was missing, I wouldn't be totally surprised, but the fact that the main directory itself is missing really surprises me. Is it totally gone or is there a way that I can find it?
Thanks in advance! -Dave
0
Comment
Question by:djc2
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
12 Comments
 
LVL 14

Expert Comment

by:mcrider
ID: 2523834
Look in the /tmp directory... If it's not there, it's gone... Sorry!
0
 
LVL 3

Expert Comment

by:RobWMartin
ID: 2523862
If there is any hope, this article may help:

http://www.linuxcare.com/viewpoints/tales/09-01-99.epl

If the system has been up and running for a while, it may be gone fer good.

Feel for ya.

Rob
0
 

Author Comment

by:djc2
ID: 2524572
OK, no luck so far. I followed RobWMartin's suggested link. From there
I found the ext2fs undeletion mini howto (specifically, the most relevant page:  www.linuxdoc.org/HOWTO/mini/Ext2fs-Undeletion-8.html)
I followed the instructions in there about detecting recently deleted inodes.
Unfortunately, no inodes show up as deleted on my hard disk device today. But, I guess that's not really a surprise, given that I didn't actually delete a file.

A bit of new info: there was also one other file that I edited today on the same partition prior to the crash. Turns out that now that file appears as it was prior to the edits and it is timestamped Feb 3, the last time I edited it. So,
it seems that the hard disk appears exactly as it was before I did _anything_ to it today. Is it possible that it wasn't sync'ed, or that some sort of table wasn't updated (I'm totally ignorant of this stuff, so I don't know how to even describe it.) Is it possible that the changes were made to the hard disk but some sort of master record wasn't updated to indicate that?
Maybe the results of the following are relevant (/dev/hdd1 is the partition with the missing files):

[root]# e2fsck -c -f -n /dev/hdd1
e2fsck 1.12, 9-Jul-98 for EXT2 FS 0.5b, 95/08/09
Checking for bad blocks (read-only test): done
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

/dev/hdd1: ***** FILE SYSTEM WAS MODIFIED *****
/dev/hdd1: 12423/5003712 files (2.8% non-contiguous), 1575784/5000050 blocks
 
0
WordPress Tutorial 2: Terminology

An important part of learning any new piece of software is understanding the terminology it uses. Thankfully WordPress uses fairly simple names for everything that make it easy to start using the software.

 
LVL 14

Accepted Solution

by:
mcrider earned 100 total points
ID: 2524676
Unix systems don't write directly to the disk... They write to an image and that image is only written to the disk when a SYNC is executed.

Sorry, but you have lost your information.  If you dont already have SYNC running as a crontab entry, I suggest you do it.


Cheers!
0
 
LVL 2

Expert Comment

by:Reinier
ID: 2534656
I once lost two directories containing 100Mb in something like 100 files due to a power failure in the building. This data had accumulated in approx. 36 hours. Only one or two of these files where still open at the moment supreme.

How can you lose such an amount of data because of unflushed buffers? The machine is an alpha running kernel 2.0.36 with 512 MB RAM so it has the space to hold 100 MB in buffer. Still, I always thought buffers where flushed every 30 secs for data and every 5 secs for metadata.
0
 

Author Comment

by:djc2
ID: 2535638
mcrider, what do you suggest for a crontab entry to run SYNC?
Thanks
0
 
LVL 14

Expert Comment

by:mcrider
ID: 2535725
Well, at a minimum, I would sync the system every 5 minutes... Something like:

0,5,10,15,20,25,30,35,40,45,50,55 * * * * /bin/sync



Make sure sync is in your /bin directory... If it's not, put the correct path to the command.



Cheers!
0
 

Author Comment

by:djc2
ID: 2535876
mcrider, what do you suggest for a crontab entry to run SYNC?
Thanks
0
 

Author Comment

by:djc2
ID: 2535907
Sorry that I'm beating this into the ground, but given the vulnerability to
losing data in this way, why isn't syncing the disk run automatically on Linux systems every 5 minutes or so? Are there some negatives to doing it? Does anybody know of anywhere I can find more details on this?

Thanks,
Dave
0
 
LVL 14

Expert Comment

by:mcrider
ID: 2535969
Have you read the man page on "sync" ?  There are no negative aspect to it...

Linux doesn't come with this task running by default, but it should! I put this on every linux system I build...


Cheers!
0
 

Author Comment

by:djc2
ID: 2535979
OK, I'll try it out. Thanks
0
 
LVL 14

Expert Comment

by:mcrider
ID: 2536003
Thanks for the points! Glad I could help!


Cheers!
0

Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Setting up Secure Ubuntu server on VMware 1.      Insert the Ubuntu Server distribution CD or attach the ISO of the CD which is in the “Datastore”. Note that it is important to install the x64 edition on servers, not the X86 editions. 2.      Power on th…
It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial
Suggested Courses

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question