[clug] bebug puzzel

[Peter Barker]

On Sat, 1 Feb 2014, Eyal Lebedinsky wrote:

I'm with Eyal on the below.  Make an image of the disk and work on that 
image.  You don't play fast and loose with important data.

(and a note... backups are easy.  Restoring... that's the tricky bit).  I 
hope everyone else is thinking, "I will try to restore a file from backup 
tonight and see how I go" ;-)

Peter



> Excuse the long document. It is a hot, slow day and writing beats doing the 
> walk around
> the lake.
>
> What follows is how I approach such a situation. No promises, no guarantees, 
> I take
> no responsibility yada yada yada... It is so much fun taking risks at someone 
> else's
> expense :-)
>
> First) get your hands off the keyboard. At first do nothing. Am I too late?
> Then) seems that the data on the disk is precious so you should try and *not* 
> edit a thing.
>
> Executive summary:
> - copy the disk to somewhere else
> - investigate, recover and fix things in the copy. Repeat as much as you 
> need.
> - finally apply what you learnt to the broken machine.
>
> BTW, there normally is an earlier message saying why you dropped to the debug 
> shell. It
> will be good to find it, the problem may be minor. What follows assumes there 
> is a major
> problem with the data partition. Some time a second boot will work fine (when 
> the first
> boot corrected some minor fs issues).
>
> Finally, is this an SSD? I had cases where it disappeared on me. I needed to 
> power cycle
> the machine, go to the BIOS settings and reinstate the correct disk in the 
> boot order.
>
> While you can do the investigation from the debug shell, assuming there are 
> disk problems
> I suggest you do not do so.
>
> - Boot from recovery media (CD, USB).
> - Attach another disk to the machine (usb, sata). Or, if you know how, use a 
> network attached
> fs (nfs) or computer (ssh).
>
> Alternatively, if this is an option, remove the disk and attach it to another 
> computer
> and do the copying there.
>
> If you can tell that the whole disk is good except for the one partition then 
> you can
> copy out just the bad partition rather than the whole disk.
>
> - copy the whole computer disk to a file on the external disk, e.g.
> 	dd if=/dev/sda of=/MyMountedDisk/sda.dd bs=16M
> (replace /dev/sda with the correct device name, and /MyMountedDisk with the 
> mount point
> of the external disk).
> Or, using ssh as 'user' to computer 'host':
> 	dd if=/dev/sda bs=16M | ssh user at host 'cat 
>> /SomeDirWithEnoughRoom/sda.dd'
> - If the data is REALLY important then copy it to a second external disk too 
> (from
> the broken machine again or from the first copy).
>
> Hopefully there are no media errors or the above may not work, in which case 
> you will
> need to work harder.
>
> Now you can start playing with your computer knowing that you can always 
> restore from
> the copy. If you have another good computer then you can loop mount the 
> copied partition
> and do the investigation in an environment you are familiar with (and leave 
> the broken
> machine alone, a good thing).
>
> Try to mount the partition read-only. See what you have and what you lost.
> Copy away whatever you can to an external disk.
>
> If you recovered all that you need then you can cut your losses and reformat 
> the bad
> partition and rebuild it with the recovered files.
>
> If you see problems with the data then try fsck (file system check).
> 	fsck /dev/sda1
> Do this for each *linux* *data* (not swap) partition. Look up the man page 
> for fsck
> to see some important options (like ask to fix everything).
>
> Avoid touching any windows partitions.
>
> Good luck
> 	Eyal
>
> On 02/01/14 16:51, Wesley Bruce wrote:
>> I'm back. And I've blown up my computer again.lol.
>> Windows messed with a empty partition the linux side of my dual boot uses
>> so I get a debug message when trying to start the linux. I thought I had a
>> full backup but there a problem with that too. Either that Or I've lost the
>> flash it was all on.
>> 
>> I get this :
>> Dropping to debug shell.
>> 
>> sh: can't access tty; job control turned off
>> 
>> I've been told to run fsck but can't decipher the instructions even though
>> I have a full book of linux code.
>> Any help would be appreciated including a house call if needed.
>> I don't think I've lost the data but if I have it puts me back about 2
>> years thanks to the botched backup.
>> 
>
> -- 
> Eyal Lebedinsky (eyal at eyal.emu.id.au)
> -- 
> linux mailing list
> linux at lists.samba.org
> https://lists.samba.org/mailman/listinfo/linux
>

Peter Barker                          |   Programmer,Sysadmin,Geek.
pbarker at barker.dropbear.id.au	      |   You need a bigger hammer.
:: It's a hack! Expect underscores! - Nigel Williams