Re: All data gone AWOL

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 2002.10.21 19:27 Stephen C. Tweedie wrote:
> Hi,
> 
> On Mon, Oct 21, 2002 at 04:59:57PM +0100, Ian Leonard wrote:
> 
> > We have been using ext3 with numerous machines and they
> > take quite a bit of abuse without incident. This morning I
> > got a call to say that a power cut had rendered one box unbootable.
> >
> > Investigations revealed that the /boot partition was in good order.
> > An fsck of / also showed things to be well - except that the partition
> > was completely empty - except for /lost+found.
> >
> > It might appear that some one had created a new filesystem on it.
> > However no one at that office would know how. Someone commented
> > that this had happened before but not reported.
> 
> Sounds like it was done deliberately.  Is the box on the net?  Could
> an intruder have done this to cover their tracks, for example?

I am told it wasn't connected to any network.


> The other thing to check is to see if there is more than one partition
> on the box which has been given the "/" label.



To follow up on this one, I have just received the disk. At one time it
had a root partition on it. I set the drive up as a slave and tried to 
mount
a partition. The partition table was trashed. I put it back (I knew
the numbers) and /boot was as expected. I mounted /. There was
one directory - lost+found. A quick look revelaled that the entire
contents of the disk were in there with the first element of the
path renamed to (I guess) the inode number.

I suppose I could recover the disk - but I'm not that keen.

I guess we have build/rebuild a hundred systems or so and this
has been reported once before. We are at the latter stages of a
development project so there is lot of abuse going on. I seem
to be the only one knows about the shutdown command.
Given that it was a power outage, it is possible that the power
failed again at a crucial stage. Also, as far as I know it shouldn't
have run fsck at boot time.


The distribution is RH 7.3 but with a 2.4.19 kernel.

Any comments would be welcome.


--
Ian Leonard
eMail: ileonard@ntlworld.com
Phone: +44 (0)1865 765273

Please ignore spelling and punctuation - I did.



_______________________________________________

Ext3-users@redhat.com
https://listman.redhat.com/mailman/listinfo/ext3-users

[Index of Archives]         [Linux RAID]     [Kernel Development]     [Red Hat Install]     [Video 4 Linux]     [Postgresql]     [Fedora]     [Gimp]     [Yosemite News]

  Powered by Linux