Need data recovery options

Hello,

I was using LibreOffice 3.3.1 to do some document editing when my system froze in the middle of an autosave. (It’s an irregular hardware issue as far as I can tell). Unfortunately, both the document and it’s backup now show a file size of 0 kb.

I am running OpenSuse 11.2, and I’m fairly sure I used ext4 as the file system when installing. What tool(s) should I consider to try to retrieve my data, assuming there is anything left to retrieve? I have found references to Testdisk, and I have an older copy of Knoppix available. Is there anything else out there that I should look into?

Thanks!

TestDisk / PhotoRec are pretty much the way to go. But if I were you, I wouldn’t set my hopes too high, because your file is there, only it’s empty. I doubt you will find a second copy of that document. Plus it does not sound as if you took precautions for that file not to be overwritten, meaning you seem to work with the partition that contained the document in regular read/write-mode, so that diskspace being marked as “free” was most likely overwritten several times already. Usually when something like this happens one would immediately unmount it and remount it only with read access. Others would make an image of the partition to make sure they will not harm the original partition.

On 2011-06-19 00:36, khorzan wrote:
>
> Hello,
>
> I was using LibreOffice 3.3.1 to do some document editing when my
> system froze in the middle of an autosave. (It’s an irregular hardware
> issue as far as I can tell). Unfortunately, both the document and it’s
> backup now show a file size of 0 kb.

Usually LO should enter recovery mode on the next start.

> I am running OpenSuse 11.2, and I’m fairly sure I used ext4 as the file
> system when installing. What tool(s) should I consider to try to
> retrieve my data, assuming there is anything left to retrieve? I have
> found references to Testdisk, and I have an older copy of Knoppix
> available. Is there anything else out there that I should look into?

IMO, chances are next to NIL, but provided you haven’t mounted the
partition RW yet, you might grep the entire partition searching for a
string known to belong to your document. But LO saving as gzipped archives,
I don’t know if that will work.


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

On 06/19/2011 12:36 AM, khorzan wrote:
>
> I was using LibreOffice 3.3.1 to do some document editing when my
> system froze in the middle of an autosave. (It’s an irregular hardware
> issue as far as I can tell).

-=welcome=- new poster (openSUSE 11.2 has passed its end of life, are
you using Evergreen to keep it alive, or what?)

sounds strange…should not happen, ever…and, i’ve not seen this
reported before (of course, i don’t remember breakfast either)

  1. has it happened to you before?

  2. if so, did you file a bug or how did you try to resolve the problem?

  3. did it happen with OpenOffice, also?

  4. what was the size of the file being auto-saved?

  5. how much RAM do you have?

  6. what size swap?

  7. how much unused space exists in your root partition and the partition
    where the file in question was placed

  8. are either of those partitions NTFS? or any non-Linux partition

  9. how did you get to LibreOffice (from OpenOffice) on 11.2? (using an
    openSUSE repo, or?)

> Unfortunately, both the document and it’s
> backup now show a file size of 0 kb.

you might find the remains of what was open and being edited in /tmp
or /var/tmp, but i don’t actually know enough about how LibreOffice
handles it open/transitory files (maybe it does all of that in RAM)

be very careful if nosing around in /tmp or /var/tmp, many (maybe all)
of those files are in use by the system, and do NOT remove them or write
to them…

> I am running OpenSuse 11.2, and I’m fairly sure I used ext4 as the file
> system when installing.

to answer your question (“what file system did i use?”) and several of
my questions above, please show us the output of entering each of the
following into a terminal, one at a time


df -h
sudo /sbin/fdisk -l
cat /proc/partitions
cat /etc/fstab
free
mount
sudo cat /boot/grub/menu.lst
zypper lr -d

copy/paste the output into paste.opensuse.org and return the URL address
back to here, please

> What tool(s) should I consider to try to
> retrieve my data, assuming there is anything left to retrieve?

as the others have said, your search is probably not going to make you
smile…

do you have an off machine back up?

but, even if this file is gone forever you do need to try to find out
what went wrong, and fix it (i think maybe you filled RAM/swap or
root–any of those might cause what you report…or, maybe you had a
problem with a non-Linux file system…or, maybe you are using a RAID
or LVM or other ‘fancy’ file magic, which burped…

oh, i have some other questions:

  1. the partitions in use, are they on your local machine, or somewhere
    on the network local or not?

  2. the openSUSE 11.2 you are using, is it installed on the physical
    machine you are using or is it running in a VM? if in a VM what is the
    host operating system and what VM are you running?

> I have
> found references to Testdisk, and I have an older copy of Knoppix
> available. Is there anything else out there that I should look into?

i’d use mc to manually search the /tmp and /var/tmp for very strangely
named files of about the right size… (looking on the partition of two
zero length, correctly named files is not gonna bring a smile, i don’t
think…)


dd
http://is.gd/bpoMD

Thank you all for the input: I do appreciate it.
I’ll give TestDisc and PhotoRec a try as soon as I get another system built and running, and can nab a spare drive.

DenverD - I’ll try to answer your questions as best I can without having the system up and running. Please bear in mind that the “Puzzled Penguin” tag I have is an understatement. I’d like to change that, but it will take time. I will get the terminal info you requested as soon as I finish the system build I mentioned above.

1, 2 & 3 - Yes, this happened once before with OOo. The system in question has an annoying habit of locking up every now and again. I have managed to isolate the problem to either the power supply or the motherboard, as I have (literally) replaced everything else inside the case.

4 - The file was probably no larger than 250k

5 - The system has 1 gig of ram

6 - I don’t recall the swap partition size, however I went with what YAST recommended when I set up the system. I’m guessing 1 to 2 gig.

7 - The root partition is about 20 gig, and is about 1/2 full last time I looked.

8 - None of the partitions are non-linux.

9 - OOo updated itself one day into LO.

10 & 11 - Everything is local to the machine.

Thanks much!

On 06/28/2011 04:36 AM, khorzan wrote:
>
> Thank you all for the input: I do appreciate it.
> I’ll give TestDisc and PhotoRec a try as soon as I get another system
> built and running, and can nab a spare drive.
>
> DenverD - I’ll try to answer your questions as best I can without
> having the system up and running.

even though you had said you thought the problem was “an irregular
hardware issue” my questions were all aimed at giving the helpers here a
starting point to help you figure out what the software or system setup
fault was causing the 'freeze…

hope you get a new system AND a new/different hard drive…i highly
recommend you not mount that drive read/write until after you have
made all data recovery attempts with the drive mounted read only…

the more you touch a drive before recovery is complete, the more likely
you will inadvertently jumble the data you seek…

on the other hand, like the others here i have little hope you will find
any parts of that file to recover…(zero length files hold very little,
and no ‘old’ data)…

but, have a look…and, let us know how you get on with your new hardware…

most important (in my feeble mind) is you should not expect or allow
occasional freezes (this is not your grandfathers frail software which
falls over every time a virus says BOO!)…

if you get one ‘freeze’, consider that as too many-something is
wrong…find and fix the problem…don’t put your data at risk by
accepting/ignoring irregular hard- or soft-ware issues…

my best advice would be to sit down and try to recreate that 250k
document from your memory (rather than that disk’s memory)…'cause you
probably ain’t gonna find it on the disk…let me try to explain:

yes, files ‘deleted’ on MS-file systems are easily un-deleted…and,
while they are sometimes recoverable on Linux files systems, they are
neither ‘easily’ found nor recovered…

but your situation is not as simple as looking for a ‘deleted
file’…the data you wish you had was in a file that you still have
access to…that file was cleared of all data and then saved as an
entirely empty document…

the file was not deleted, just emptied and saved…no ‘deleted’ file to
find…

but you did the right thing to come here and ask…

welcome to Linux, welcome to freedom…


DD
-Caveat-Hardware-Software-

On 2011-06-28 08:34, DenverD wrote:

> on the other hand, like the others here i have little hope you will find
> any parts of that file to recover…(zero length files hold very little, and
> no ‘old’ data)…

There was an issue with XFS filesystems where files after a crash had zerlo
length. It is a complex issue. If I remember correctly, XFS had to change
some coding, perhaps the kernel too, or app writers. I’m fuzzy on the details.

But, ext4, being a new filesystem, and advanced, might be prone to the same
or similar problem.

It might be that the data is written, but the file is not closed properly.
Old metadata is restored.

Or, it might be that the data is never written, it is cached in memory,
till the system sees fit to write it.


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

DenverD - The info you requested is at the following url:

SUSE Paste

Hope it’s useful…

On 07/19/2011 05:06 AM, khorzan wrote:
>
> DenverD - The info you requested is at the following url:
>
> ‘SUSE Paste’ (http://paste.opensuse.org/19329210)
>
> Hope it’s useful…
>
>

well Sir, i’ve looked carefully at all that data and don’t see a reason
there for the system freeze(s) you have experienced…

i was thinking maybe you had an odd files system (or MS-file system)
which was incapable of doing the task under heavy load/high speed…or,
maybe you were filling RAM and swap (a system killer)…or, maybe you
were filling a partition momentarily during the auto-save…

say, you don’t happen to work on your Great Novel of (say) near 2 GB in
size, do you? if so, i suggest you break the file into smaller
chapters…and keep copies of each chapter on an off machine location
for safety…

that way each chapter will save quicker and if a chapter gets corrupted
its a lot easier to replace than the whole novel…

other than filling RAM and swap with a HUGE single file, it is a
complete mystery to me why the system froze during an auto-save of a
LibreOffice document…

finally, i have very little hope you will be able to recovery any of the
words/data which previously existed in a now zero-length file…

on the other hand, if you find a magic program/application/disk which
allows you to resurrect the dead manuscript, please return here and
enlighten us on its existence…

the time to take positive steps to ensure data preservation is before
the calamity…


DD
Caveat-Hardware-Software
openSUSE®, the “German Engineered Automobiles” of operating systems!

Thanks for the help. For what its worth, I agree on all counts. I’m still going to try to recover the data. Even if nothing comes of it, at least I’ll learn something from it.

Which brings me to a new quandry: I downloaded Testdisk onto my new Linux installation but I can’t get it to run. The Testdisk documentation says to download it, un-zip it, and it’s ready to go. I do that, but when I click on Testdisk, nothing happens. I’ve gotten the windows version to run, but for some reason WinXP doesn’t realize the drive is even there, and Win-7 says it’s not initialized. (I’m using a SATA-USB bridge if that is relevant).

Any ideas?

Thanks much!

On 07/20/2011 05:16 AM, khorzan wrote:
>
> Any ideas?

several:

-while i know absolutely nothing about Testdisk, personally i have never
and would never allow any application running in MS-windows touch my
linux partitions…especially not any partition with important data on
it (or used to have important data on it)

-never mount that partition as read/write until you have exhausted all
efforts at finding data, and given up

-data recovery is a very specialized area and there are many pitfalls
to trip you up…if you really really really need the data back, seek a
professional data recovery expert…there are many on the net…you
can usually tell the real ones because the want LOTS and LOTS of money.


DD
Caveat-Hardware-Software
openSUSE®, the “German Engineered Automobiles” of operating systems!