[clug] bebug puzzel

[Eyal Lebedinsky]

Excuse the long document. It is a hot, slow day and writing beats doing the walk around
the lake.

What follows is how I approach such a situation. No promises, no guarantees, I take
no responsibility yada yada yada... It is so much fun taking risks at someone else's
expense :-)

First) get your hands off the keyboard. At first do nothing. Am I too late?
Then) seems that the data on the disk is precious so you should try and *not* edit a thing.

Executive summary:
- copy the disk to somewhere else
- investigate, recover and fix things in the copy. Repeat as much as you need.
- finally apply what you learnt to the broken machine.

BTW, there normally is an earlier message saying why you dropped to the debug shell. It
will be good to find it, the problem may be minor. What follows assumes there is a major
problem with the data partition. Some time a second boot will work fine (when the first
boot corrected some minor fs issues).

Finally, is this an SSD? I had cases where it disappeared on me. I needed to power cycle
the machine, go to the BIOS settings and reinstate the correct disk in the boot order.

While you can do the investigation from the debug shell, assuming there are disk problems
I suggest you do not do so.

- Boot from recovery media (CD, USB).
- Attach another disk to the machine (usb, sata). Or, if you know how, use a network attached
fs (nfs) or computer (ssh).

Alternatively, if this is an option, remove the disk and attach it to another computer
and do the copying there.

If you can tell that the whole disk is good except for the one partition then you can
copy out just the bad partition rather than the whole disk.

- copy the whole computer disk to a file on the external disk, e.g.
	dd if=/dev/sda of=/MyMountedDisk/sda.dd bs=16M
(replace /dev/sda with the correct device name, and /MyMountedDisk with the mount point
of the external disk).
Or, using ssh as 'user' to computer 'host':
	dd if=/dev/sda bs=16M | ssh user at host 'cat >/SomeDirWithEnoughRoom/sda.dd'
- If the data is REALLY important then copy it to a second external disk too (from
the broken machine again or from the first copy).

Hopefully there are no media errors or the above may not work, in which case you will
need to work harder.

Now you can start playing with your computer knowing that you can always restore from
the copy. If you have another good computer then you can loop mount the copied partition
and do the investigation in an environment you are familiar with (and leave the broken
machine alone, a good thing).

Try to mount the partition read-only. See what you have and what you lost.
Copy away whatever you can to an external disk.

If you recovered all that you need then you can cut your losses and reformat the bad
partition and rebuild it with the recovered files.

If you see problems with the data then try fsck (file system check).
	fsck /dev/sda1
Do this for each *linux* *data* (not swap) partition. Look up the man page for fsck
to see some important options (like ask to fix everything).

Avoid touching any windows partitions.

Good luck
	Eyal

On 02/01/14 16:51, Wesley Bruce wrote:
> I'm back. And I've blown up my computer again.lol.
> Windows messed with a empty partition the linux side of my dual boot uses
> so I get a debug message when trying to start the linux. I thought I had a
> full backup but there a problem with that too. Either that Or I've lost the
> flash it was all on.
>
> I get this :
> Dropping to debug shell.
>
> sh: can't access tty; job control turned off
>
> I've been told to run fsck but can't decipher the instructions even though
> I have a full book of linux code.
> Any help would be appreciated including a house call if needed.
> I don't think I've lost the data but if I have it puts me back about 2
> years thanks to the botched backup.
>

-- 
Eyal Lebedinsky (eyal at eyal.emu.id.au)