2

Possible Duplicate:
Is it possible to recover filed removed by rm in linux?

I'm using a RHEL6 server RAID10 with a ext4 fs, with a volumeGroup (lvm2) VolGroup00 created on a PV /dev/sda5 [831Go]. The logical volume concerned is /dev/VolGroup00/LogVol06 [683Go]. The path where LogVol06 is mounted is /data/ .

A virtual environment was creating on this server. We use Libvirt+qemu (managed with Virt-Manager). And the VMs disks image are stored in /data/storage/. (files: v_data.img [74Go] & v_apps.img [26Go])

I accidently use tar -cvf v_data.img v_data.tgz instead of tar -cvf v_data.tgz v_data.img. Yes,... my 74Go v_data.img file was overwritten by a 10k empty file... And libvirtd daemon wasn't running as this time so I have no file PID. (Well, I cannot still access Virt-manager because libvritd wont start, but this is another problem..)

3 Months ago, I created some snapshots through Virt-Manager for the v_data_img disk image. But I cannot restore snapshots because Libvirtd wont start. (still investigating on the source of the issue). Also, I created a copy of the file just before my mistake using cp /data/storage/v_data_img /data/ but I unfortunately also removed it using rm -rf just before the tar command, so no more backup...

I have no physical access to this server. I cannot reboot the system because there're some encrypted logical volumes which will ask a passphrase at boot. It will require someone to enter the password but this is currently no possible. Also, there is not external storage attached to the server

This VM has some very very important informations.

I'm quite lost, and I'm not familiar with recovering files process under Linux. I don't really know what solution will fit to my problem... (Photorec? no external storage..., debugfs ? foremost ? etc.)

Community
  • 1
Doog
  • 21
  • 2
  • 2
    Do you take backups? – Basil Nov 27 '12 at 20:24
  • 4
    The only recovering you should be doing, is restoring from your backups. If you don't have any backups, well, now's a great time to fix up your resume'. – Magellan Nov 27 '12 at 20:26
  • 2
    Did you by any chance snapshot LogVol06? – Alastair McCormack Nov 27 '12 at 20:41
  • Hello, and thank you for your answer. Unfortunately, there's no backup and I didn't snapshot LogVol06. :-( Please, is there any solution for me like doing something with the inode or something else ? I remember having launch a "cp /data/storage/v_data_img /data/", but I also rm -rf it before just before my mystake. Cannot recover a file from a accidentaly rm command ? – Doog Nov 27 '12 at 20:53
  • I don't think you're going to like the answers you're getting. About the best I can find for something like this is using testdisk (http://en.wikipedia.org/wiki/TestDisk) in conjunction with something like PhotoRec (http://en.wikipedia.org/wiki/PhotoRec). However since you overwrote the file, I don't think that will help you. I would also alert your superior immediately so it doesn't come as a surprise if there is fallout. Especially if this mistake could cost you your job. Good luck, this is a very good reminder to *always* have backups. – Matthew Nov 27 '12 at 21:08
  • Thank you so much for your answers Madhatter, using extundelete seems efficient. I have to find a way for the restore destination.. Matthew, I already used PhotoRec under Windows several times and it saved me. But for this problem, I don't have physical access to plug an external storage for the restore destination folder. If I indicate the same harddrive for the restore destination folder, PhotoRec will start writing on the disk and it will decrease my chance to recover the file in the future (with other software foe example). There's a dev server in the same domain but only 30Go left... – Doog Nov 27 '12 at 21:39
  • @Doog Is the image file still open by your virtualization software? If so you can use a tool like `fsdb` (linux equivalent: [debugfs](http://linux.die.net/man/8/debugfs)) to re-link the inode that the open filehandle is pointing to. This is the shallow end of what I would call "deep filesystem magic", and should only be attempted if you know what you're doing (practice on a scratch install somewhere safe first). – voretaq7 Nov 27 '12 at 21:46

0 Answers0