system crash / major data loss / help needed

English Applications
#1

Possibly the wrong forum but…

This morning my suse 11.3 box locked up (firefox locked, the WM and mouse
worked ok but couldn’t start any processes, I switch to text console but got
“INIT cannot execute mingetty” on login and “INIT cannot execute shutdown” on
alt-cntl-del). I performed a hard reset. On reboot the disks were checked
with “filesystems have not been checked for >60 days” and reboot appeared to
proceed as normal.

However, the filesystems (ext4 / and ext3 /home) have both been wound back 64
days leading to major data loss. I am at a loss to diagnose since
/var/log/messages ends on 4/7/11 and restarts today on 7/9/11. Every single
file since shutdown in July and the 2nd reboot today is missing. I have backups
for critical data files but recovering the filesystems is a much more
attractive idea if possible.

Urgent help on fixing the filesystems and diagnosing the problem appreciated!

#2

On 09/07/2011 11:16 AM, tr1v3t wrote:
>
> Possibly the wrong forum but…
>
> This morning my suse 11.3 box locked up (firefox locked, the WM and
> mouse
> worked ok but couldn’t start any processes, I switch to text console
> but got
> “INIT cannot execute mingetty” on login and “INIT cannot execute
> shutdown” on
> alt-cntl-del). I performed a hard reset. On reboot the disks were
> checked
> with “filesystems have not been checked for>60 days” and reboot
> appeared to
> proceed as normal.
>
> However, the filesystems (ext4 / and ext3 /home) have both been wound
> back 64
> days leading to major data loss. I am at a loss to diagnose since
> /var/log/messages ends on 4/7/11 and restarts today on 7/9/11. Every
> single
> file since shutdown in July and the 2nd reboot today is missing. I have
> backups
> for critical data files but recovering the filesystems is a much more
> attractive idea if possible.
>
> Urgent help on fixing the filesystems and diagnosing the problem
> appreciated!
>
>

suggest you not mount any of those disks as anything other than read
only until you have recovery plan…(not saying recovery is possible,
but writing to the disks might forever remove all possibility)

doubt i can help, but have a few questions that might be helpful:

-did the machine run continuously from the 4th of July until today’s
problem?

-have updates been applied as they came…was there one yesterday?

-are you using RAID, what kind?

-file system full?

-how old are the disks?

-are you running S.M.A.R.T. against those disks?

-what desktop environment are you using

-is this a desktop workstation machine, a back office server, or what?
age of the hardware?

-what is the date of your last data backup?

-please show us the terminal output from


cat /etc/SuSE-release
uname -a
df -h
cat /proc/partitions
cat /etc/fstab
mount
sudo /sbin/fdisk -l            <give root pass when asked
zypper lr -d

copy/paste the output back to this thread using the instructions here:
http://goo.gl/i3wnr

–
DD
Caveat
openSUSE®, the “German Automobiles” of operating systems

#3

I had to go to work and my broken computer is not responding to remote access…
The machine has been running continuously (switched off overnight) since the 4/7/11.
Updates have been applied, I can’t recall one from yesteday but there were some minor looking ones recently.
The disk is a 1Tb disk partitioned into a / and /home partition with swap on it.
The disk is a few months old - I have to check if the 4/7/11 was the date of install which I’ll do later.
I haven’t run smart on this disk and didn’t want to yet…
I’m using KDE 4.6.0.
It is a desktop ~3 years old with a new nvidia graphics card can’t remember the details at this point.
My last user data back up was yesterday, it contains 98% of what is important (but only 20% of the data) so a fresh start isn’t a disaster but I’d prefer to recover the disk if possible. The old disk is still going and was only replaced due to insufficient capacity. It has a fully function suse 11.1 system on it I think.
The rest of the data can follow when I return home…

#4

I forgot:

The filesystems were a long way from full yesterday, there should have been a lot of space available. I don’t know at the point of the crash (and could find out) but there should have been a lot of space available.

/ was reported as ext4 after the crash but /home was reported as ext3. I think they were both orignally formatted as ext4.

#5

The date the data has reverted to (4/7/11 / 64 days ago) is beginning to look suspiciously like the date I installed suse 11.3 on this disk. In particular it looks like the last log entry is the last shutdown after I finished the install and copied my home across from the the old disk.

#6

Ok - user error to blame, no bug, all resolved.

The harddisk died and the computer rebooted from an old harddisk which I had forgot was connected. I probed for the old disk by trying to mount it (rather than looking under the table), because the disks had
renumbered when the first one died /dev/sdb wasn’t there (obviously).

Apologies for such a daft post. Thanks for you patience and help.

#7

On 09/07/2011 05:36 PM, tr1v3t wrote:
> all resolved…Thanks for you patience and help.

really happy you sorted it out (because i was all out of ideas!)

i wonder, was it “cat /etc/SuSE-release” that sent you looking under the
desk?

–
DD
openSUSE®, the “German Automobiles” of operating systems

#8

You may need some data recovery software that can recover data from EXT3 hard drive.