Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: Need data recovery options

  1. #1
    Join Date
    Mar 2010
    Location
    Eugene, Oregon, USA
    Posts
    4

    Default Need data recovery options

    Hello,

    I was using LibreOffice 3.3.1 to do some document editing when my system froze in the middle of an autosave. (It's an irregular hardware issue as far as I can tell). Unfortunately, both the document and it's backup now show a file size of 0 kb.

    I am running OpenSuse 11.2, and I'm fairly sure I used ext4 as the file system when installing. What tool(s) should I consider to try to retrieve my data, assuming there is anything left to retrieve? I have found references to Testdisk, and I have an older copy of Knoppix available. Is there anything else out there that I should look into?

    Thanks!

  2. #2
    Join Date
    Jun 2008
    Location
    Berlin
    Posts
    2,061

    Default Re: Need data recovery options

    TestDisk / PhotoRec are pretty much the way to go. But if I were you, I wouldn't set my hopes too high, because your file *is* there, only it's empty. I doubt you will find a second copy of that document. Plus it does not sound as if you took precautions for that file not to be overwritten, meaning you seem to work with the partition that contained the document in regular read/write-mode, so that diskspace being marked as "free" was most likely overwritten several times already. Usually when something like this happens one would immediately unmount it and remount it only with read access. Others would make an image of the partition to make sure they will not harm the original partition.

  3. #3
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Need data recovery options

    On 2011-06-19 00:36, khorzan wrote:
    >
    > Hello,
    >
    > I was using LibreOffice 3.3.1 to do some document editing when my
    > system froze in the middle of an autosave. (It's an irregular hardware
    > issue as far as I can tell). Unfortunately, both the document and it's
    > backup now show a file size of 0 kb.


    Usually LO should enter recovery mode on the next start.

    > I am running OpenSuse 11.2, and I'm fairly sure I used ext4 as the file
    > system when installing. What tool(s) should I consider to try to
    > retrieve my data, assuming there is anything left to retrieve? I have
    > found references to Testdisk, and I have an older copy of Knoppix
    > available. Is there anything else out there that I should look into?


    IMO, chances are next to NIL, but provided you haven't mounted the
    partition RW yet, you might grep the entire partition searching for a
    string known to belong to your document. But LO saving as gzipped archives,
    I don't know if that will work.

    --
    Cheers / Saludos,

    Carlos E. R.
    (from 11.4 x86_64 "Celadon" at Telcontar)

  4. #4
    Join Date
    Jun 2008
    Location
    Earth - Denmark
    Posts
    10,730

    Default Re: Need data recovery options

    On 06/19/2011 12:36 AM, khorzan wrote:
    >
    > I was using LibreOffice 3.3.1 to do some document editing when my
    > system froze in the middle of an autosave. (It's an irregular hardware
    > issue as far as I can tell).


    -=welcome=- new poster (openSUSE 11.2 has passed its end of life, are
    you using Evergreen to keep it alive, or what?)

    sounds strange....should not happen, ever...and, i've not seen this
    reported before (of course, i don't remember breakfast either)

    1. has it happened to you before?

    2. if so, did you file a bug or how did you try to resolve the problem?

    3. did it happen with OpenOffice, also?

    4. what was the size of the file being auto-saved?

    5. how much RAM do you have?

    6. what size swap?

    7. how much unused space exists in your root partition and the partition
    where the file in question was placed

    8. are either of those partitions NTFS? or any non-Linux partition

    9. how did you get to LibreOffice (from OpenOffice) on 11.2? (using an
    openSUSE repo, or?)

    > Unfortunately, both the document and it's
    > backup now show a file size of 0 kb.


    you _might_ find the remains of what was open and being edited in /tmp
    or /var/tmp, but i don't actually know enough about how LibreOffice
    handles it open/transitory files (maybe it does all of that in RAM)

    be very careful if nosing around in /tmp or /var/tmp, many (maybe all)
    of those files are in use by the system, and do NOT remove them or write
    to them..

    > I am running OpenSuse 11.2, and I'm fairly sure I used ext4 as the file
    > system when installing.


    to answer your question ("what file system did i use?") and several of
    my questions above, please show us the output of entering each of the
    following into a terminal, one at a time

    Code:
    df -h
    sudo /sbin/fdisk -l
    cat /proc/partitions
    cat /etc/fstab
    free
    mount
    sudo cat /boot/grub/menu.lst
    zypper lr -d
    copy/paste the output into paste.opensuse.org and return the URL address
    back to here, please


    > What tool(s) should I consider to try to
    > retrieve my data, assuming there is anything left to retrieve?


    as the others have said, your search is probably not going to make you
    smile...

    do you have an off machine back up?

    but, even if this file is gone forever you do need to try to find out
    what went wrong, and fix it (i think maybe you filled RAM/swap or
    root--any of those might cause what you report....or, maybe you had a
    problem with a non-Linux file system.....or, maybe you are using a RAID
    or LVM or other 'fancy' file magic, which burped..

    oh, i have some other questions:

    10. the partitions in use, are they on your local machine, or somewhere
    on the network local or not?

    11. the openSUSE 11.2 you are using, is it installed on the physical
    machine you are using or is it running in a VM? if in a VM what is the
    host operating system and what VM are you running?

    > I have
    > found references to Testdisk, and I have an older copy of Knoppix
    > available. Is there anything else out there that I should look into?


    i'd use mc to manually search the /tmp and /var/tmp for very strangely
    named files of about the right size.. (looking on the partition of two
    zero length, correctly named files is not gonna bring a smile, i don't
    think...)

    --
    dd
    http://is.gd/bpoMD

  5. #5
    Join Date
    Mar 2010
    Location
    Eugene, Oregon, USA
    Posts
    4

    Default Re: Need data recovery options

    Thank you all for the input: I do appreciate it.
    I'll give TestDisc and PhotoRec a try as soon as I get another system built and running, and can nab a spare drive.

    DenverD - I'll try to answer your questions as best I can without having the system up and running. Please bear in mind that the "Puzzled Penguin" tag I have is an understatement. I'd like to change that, but it will take time. I will get the terminal info you requested as soon as I finish the system build I mentioned above.

    1, 2 & 3 - Yes, this happened once before with OOo. The system in question has an annoying habit of locking up every now and again. I have managed to isolate the problem to either the power supply or the motherboard, as I have (literally) replaced everything else inside the case.

    4 - The file was probably no larger than 250k

    5 - The system has 1 gig of ram

    6 - I don't recall the swap partition size, however I went with what YAST recommended when I set up the system. I'm guessing 1 to 2 gig.

    7 - The root partition is about 20 gig, and is about 1/2 full last time I looked.

    8 - None of the partitions are non-linux.

    9 - OOo updated itself one day into LO.

    10 & 11 - Everything is local to the machine.

    Thanks much!

  6. #6
    Join Date
    Jun 2008
    Location
    Earth - Denmark
    Posts
    10,730

    Default Re: Need data recovery options

    On 06/28/2011 04:36 AM, khorzan wrote:
    >
    > Thank you all for the input: I do appreciate it.
    > I'll give TestDisc and PhotoRec a try as soon as I get another system
    > built and running, and can nab a spare drive.
    >
    > DenverD - I'll try to answer your questions as best I can without
    > having the system up and running.


    even though you had said you thought the problem was "an irregular
    hardware issue" my questions were all aimed at giving the helpers here a
    starting point to help you figure out what the software or system setup
    fault was causing the 'freeze..

    hope you get a new system AND a new/different hard drive...i highly
    recommend you _not_ mount that drive read/write until after you have
    made all data recovery attempts with the drive mounted read only..

    the more you touch a drive before recovery is complete, the more likely
    you will inadvertently jumble the data you seek..

    on the other hand, like the others here i have little hope you will find
    any parts of that file to recover..(zero length files hold very little,
    and no 'old' data)..

    but, have a look...and, let us know how you get on with your new hardware..

    _most_ important (in my feeble mind) is you should not expect or allow
    occasional freezes (this is not your grandfathers frail software which
    falls over every time a virus says BOO!)..

    if you get one 'freeze', consider that as too many-something _is_
    wrong....find and fix the problem...don't put your data at risk by
    accepting/ignoring irregular hard- or soft-ware issues..

    my best advice would be to sit down and try to recreate that 250k
    document from your memory (rather than that disk's memory)...'cause you
    probably ain't gonna find it on the disk...let me try to explain:

    yes, files 'deleted' on MS-file systems are easily un-deleted...and,
    while they are sometimes recoverable on Linux files systems, they are
    neither 'easily' found nor recovered..

    but your situation is not as simple as looking for a 'deleted
    file'....the data you wish you had _was_ in a file that you still have
    access to..._that_ file was cleared of all data and _then_ saved as an
    entirely empty document..

    the file was not deleted, just emptied and saved....no 'deleted' file to
    find..

    *but* you did the right thing to come here and ask...

    welcome to Linux, welcome to freedom...

    --
    DD
    -Caveat-Hardware-Software-

  7. #7
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Need data recovery options

    On 2011-06-28 08:34, DenverD wrote:

    > on the other hand, like the others here i have little hope you will find
    > any parts of that file to recover..(zero length files hold very little, and
    > no 'old' data)..


    There was an issue with XFS filesystems where files after a crash had zerlo
    length. It is a complex issue. If I remember correctly, XFS had to change
    some coding, perhaps the kernel too, or app writers. I'm fuzzy on the details.

    But, ext4, being a new filesystem, and advanced, might be prone to the same
    or similar problem.

    It might be that the data is written, but the file is not closed properly.
    Old metadata is restored.

    Or, it might be that the data is never written, it is cached in memory,
    till the system sees fit to write it.

    --
    Cheers / Saludos,

    Carlos E. R.
    (from 11.4 x86_64 "Celadon" at Telcontar)

  8. #8
    Join Date
    Mar 2010
    Location
    Eugene, Oregon, USA
    Posts
    4

    Default Re: Need data recovery options

    DenverD - The info you requested is at the following url:

    SUSE Paste

    Hope it's useful...

  9. #9
    Join Date
    Jun 2008
    Location
    Earth - Denmark
    Posts
    10,730

    Default Re: Need data recovery options

    On 07/19/2011 05:06 AM, khorzan wrote:
    >
    > DenverD - The info you requested is at the following url:
    >
    > 'SUSE Paste' (http://paste.opensuse.org/19329210)
    >
    > Hope it's useful...
    >
    >


    well Sir, i've looked carefully at all that data and don't see a reason
    there for the system freeze(s) you have experienced...

    i was thinking _maybe_ you had an odd files system (or MS-file system)
    which was incapable of doing the task under heavy load/high speed....or,
    maybe you were filling RAM and swap (a system killer)....or, maybe you
    were filling a partition momentarily during the auto-save..

    say, you don't happen to work on your Great Novel of (say) near 2 GB in
    size, do you? if so, i suggest you break the file into smaller
    chapters...and keep copies of _each_ chapter on an off machine location
    for safety..

    that way each chapter will save quicker and if a chapter gets corrupted
    its a lot easier to replace than the whole novel..

    other than filling RAM and swap with a HUGE single file, it is a
    complete mystery to me why the system froze during an auto-save of a
    LibreOffice document...

    finally, i have very little hope you will be able to recovery any of the
    words/data which previously existed in a now zero-length file..

    on the other hand, if you find a magic program/application/disk which
    allows you to resurrect the dead manuscript, please return here and
    enlighten us on its existence..

    the time to take positive steps to ensure data preservation is _before_
    the calamity..

    --
    DD
    Caveat-Hardware-Software
    openSUSE®, the "German Engineered Automobiles" of operating systems!

  10. #10
    Join Date
    Mar 2010
    Location
    Eugene, Oregon, USA
    Posts
    4

    Default Re: Need data recovery options

    Thanks for the help. For what its worth, I agree on all counts. I'm still going to try to recover the data. Even if nothing comes of it, at least I'll learn something from it.

    Which brings me to a new quandry: I downloaded Testdisk onto my new Linux installation but I can't get it to run. The Testdisk documentation says to download it, un-zip it, and it's ready to go. I do that, but when I click on Testdisk, nothing happens. I've gotten the windows version to run, but for some reason WinXP doesn't realize the drive is even there, and Win-7 says it's not initialized. (I'm using a SATA-USB bridge if that is relevant).

    Any ideas?

    Thanks much!

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •