[SOLVED] recover LVM2 after erasing partition table

synss · Last edited by synss on Wed Dec 19, 2007 6:56 am; edited 2 times in total

Ooops, I have been stupid I admit, but these things have to happen from time to time. I have been wanting to benchmark my LVM2 striped volume but I have used dd if=/dev/zero [EDITED] of=/dev/sda, I noticed pretty quickly and only gotten rid of the first 800M, I believe. My partition table used to look like

/dev/sda1 /boot ext2 64MB [EDITED]
/dev/sda2 / ext3 1G
/dev/sda3 LVM2
/dev/hda LVM2

/dev/sda3 and /dev/hda are in an LVM2 VG and contain /usr, /var, /var/tmp, /home, swap, a squashfs'ed backup from suse9 and a Debian base install + LVM support (that was meant for recovery).

I have just chrooted into the Debian system so that I get some working linux. And finally, I am connected to this computer via ssh from my OS X computer. Debian works right, I could mount --bind /dev into it form gentoo and it is connected to the internet; also mounted /proc from debian. I had just finished (obviously) to install Gentoo on this workstation, so it would not be a problem to download a stage and reinstall it, actually. The problem is:

frostschutz · Advocate Joined: 22 Feb 2005 Posts: 2977 Location: Germany

Why would you have 64GB for /boot, do you have like several thousands kernels to choose from or did you mean 64MB?

dd if=/dev/null of=/dev/sda doesn't do anything much, or did you mean if=/dev/zero? In that case, the area that you zeroed, is lost, and can not be rescued, not even by a data rescuing company or FBI, so you can forget about the data that resided on your boot and / partitions, and if you wrote more than the (I assume) 64MB+1G you can say good-bye to your LVM as well, at least, to the partition layout and the data that was actually overwritten.

testdisk and parted allow scanning for lost partitions (partition tables) and restoring them, maybe they will work for you.

If you know the exact partition size and layout (e.g. the exact commands you used to create this partition table in fdisk), you can also try to just manually restore the exact same layout by issuing the exact same commands. It may work.

If everything else fails, there are some forensics softwares that allow searching for useful data in raw stream, in app-forensics. However if the system is still running and you still have access to that data, make a backup of it while it's hot, and curse you for not making backups regularly. What do you do if your disk suddenly dies without warning (which is something any disk can do anytime), huh?

Also if the system is still running and the partition table was not re-read yet, it may be that your old partition layout can be obtained from /proc/partitions

synss · Posted: Tue Dec 18, 2007 11:25 am Post subject:

Yes, sorry, I was a little excited...
You corrected well, it was a 64MB /boot. And dd if=/dev/zero of course. I have relatively recent backups for /home, too. So the best and possibly easiest solution is to reinstall... pain, :evil:

but doable, though.

However,

frostschutz · Advocate Joined: 22 Feb 2005 Posts: 2977 Location: Germany

1. Backup all the data you can still access (you tarred it already?)
2. Boot from Live CD or quit the chroot or something. I'd not access the disk while repartitioning it.
3. Restore the partition table and allow it to re-read the table. (sfdisk -R device)
4. Check if the partitions are correct with 'file -s /dev/partition' - if you found the correct entry points it should show something like '/dev/sda5: LVM2 (Linux Logical Volume Manager) , UUID: 123...'
5. Reboot (pray to the lilo god or install grub) and see if it still works.
6. If all else fails, repartition, reinstall and restore backup from 1.

synss · Posted: Wed Dec 19, 2007 7:04 am Post subject:

I could recover my LVM2 volume:

The rest is reinstalling gentoo, so a bit time consuming

but I do not have to sit there...

All in all, it was not that bad. Good I have been fast enough on the ctr-C!

Thank you very much!
_________________
Compress portage tree
Elog viewer
Autodetect swap