1
I'm trying to recover data from a 3TB EXT4 partition in an LVM setup of which I hosed the first ~1GB with dd and am having trouble accessing files which have been placed in lost+found due to permissions issues.
Some background:
I've successfully recovered the LVM metadata using the files in /etc/lvm/backup and /etc/lvm/archive.
Once the metadata was back in place I used mkfs.ext4 -n -m0 (-m0 being the only parameter passed when the filesystem was initially created) to find the locations of the backup superblocks and then ran fsck specifying the backup superblock nearest the end of the partition (fsck.ext4 -b $LAST_SUPERBLOCK_OF_PARTITION -y /dev/vg/lv).
Once this was done, I tried another run of fsck to see if I could get it to a point where it reported no modifications to the filesystem, to no avail. Figuring that nothing was going to change, I mounted the partition, opened my file manager as root and started to attempt to peruse lost+found to see what had been recovered.
As can be seen from the screenshot the modification and access timestamps are completely messed up, as are the users and groups. I am able to enter the directories shown as containing 0 items (oppføringer), but for those listed with a question mark I get a
you do not have the permissions to access…
message. On a whim, I tried sudo chown -Rv root:root <mount point>/lost+found/ and familiar file and directory names started scrolling past, but with 'permission denied' messages (which I found odd given that I was root).
Does anyone have any pointers as to how I can attempt further access/recovery?
Ansel Pol
Posted 2016-09-21T19:28:32.830
Reputation: 31