Solved

Ext3 partition won't mount

Posted on 2011-02-10
10
568 Views
Last Modified: 2012-05-11
Hi experts,

I have a server running Ubuntu 10.04 server, which is virtualizing another Ubuntu 10.04 server with qemu / kvm. For some reason somebody yesterday decided to press the power button on the physical server. The virtual server never came back up.

I opened up virt-manager and had a look at my virtual machine. It had just a blinking cursor. I had previously thought maybe it was fsck'ing but it didn't appear to be. I pressed a few buttons on the keyboard, trying to get some input, and all of a sudden it showed a message saying something like "skipping /backup" which is the partition that has all of my files on it. Ubuntu loaded but /dev/sdb was not mounted at /backup. I have not been able to mount it, it gave an error that I can't remember but it may have been about a superblock.

Anyway I'm analysing the partition with testdisk at the moment, but I don't really know what to do from here. Any suggestions? Am I screwed? I have some of the data backed up on an external drive, so that's a bit of a relief. The partition is just a .qcow2 file as well, so maybe there is something I can do from the physical server?

Cheers,
Michael
0
Comment
Question by:mstrelan
  • 6
  • 4
10 Comments
 
LVL 35

Accepted Solution

by:
torimar earned 500 total points
ID: 34867288
I think you are already going into the right direction: TestDisk is the optimal first step. Try to use it to get the backup superblock locations and then feed this info to fsck:
http://www.cgsecurity.org/wiki/Advanced_Find_ext2_ext3_Backup_SuperBlock

If this won't help, you might also want to try and mount the Qemu image directly in your Ubuntu host system. I never did this myself, and I hope the info given here will suffice:
http://en.wikibooks.org/wiki/QEMU/Images#Mounting_an_image_on_the_host
0
 
LVL 10

Author Comment

by:mstrelan
ID: 34867318
"To search for them, run TestDisk and in the Advanced menu, select the partition and choose Superblock."

No partition available
0
 
LVL 35

Expert Comment

by:torimar
ID: 34867373
How did you proceed? Did you boot the VM off a bootable CD?
I recommend Parted Magic for the purpose: www.partedmagic.com

Then follow this guide in order to check whether the partition table may be restored:
http://www.howtoforge.com/data_recovery_with_testdisk
0
 
LVL 10

Author Comment

by:mstrelan
ID: 34867416
The actual data image is on a separate qcow2 image than the operating system, so assumably it is safe to do any fsck / testdisk etc type of stuff without a live disc because the data partition is not mounted.

I have tried to "analyse" in test disk but it did not find any partitions. I am going to try and mount the image directly in the host OS.
0
 
LVL 10

Author Comment

by:mstrelan
ID: 34867547
UPDATE - Good news. On the host OS I was able to mount the disk image and access all my files! Yay!

qemu-nbd -c /dev/nbd0 data.qcow2
partprobe /dev/nbd0
mount /dev/nbd0p1 /mnt/data/
ls -l /mnt/data

Open in new window


Now I just need to know how to get it to mount in the guest OS. I will try the e2fsck with alternate superblock, but I want to take a backup of the disk image first.
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 
LVL 35

Expert Comment

by:torimar
ID: 34867646
That is really good news indeed.

For a backup, I assume it will suffice to copy the qcow2 file to a safe backup location, the continue to work on the original.
0
 
LVL 35

Assisted Solution

by:torimar
torimar earned 500 total points
ID: 34867686
If the e2fsck method should not turn out to be viable, you may consider backing up the data files directly from the mounted image, then, inside the VM, format the non-functional disk and "refill" it from the backup - provided that VM has access to the external media used.
0
 
LVL 10

Author Comment

by:mstrelan
ID: 34867727
Thanks torimar, the format / refill method will be my plan b if e2fsck doesn't work. I'm off to buy a bigger hard drive to back up the data. Will be back later to post my results and award points.
0
 
LVL 10

Author Comment

by:mstrelan
ID: 34884741
Ok I wasn't able to fix the disk with testdisk or anything, so the best solution is to mount the image in the host os and scp all the files to a new partition. Thanks torimar for the help
0
 
LVL 10

Author Closing Comment

by:mstrelan
ID: 34884748
Solved
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.
In this video tutorial I show you the main steps to install and configure  a VMware ESXi6.0 server. The video has my comments as text on the screen and you can pause anytime when needed. Hope this will be helpful. Verify that your hardware and BIO…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now