1

We have a RAID6 array with 12 disks on a 3ware 9650SE-12ML controller. An engineer of our server provider issued this command by mistake: sudo dd if=/dev/zero of=/dev/sde bs=1M count=500; sync;

/dev/sde is the linux device of the raid array.

This wiped the first 500MB of that device. There was no partition on it, device was configured as ext4 file system.

tw-cli show no errors. I haven't tried anything yet. The device is still mounted on the mount point but all the files are gone and it became "Read-only file system".

What information is gone and how can it be recovered?

Unit  UnitType  Status         %RCmpl  %V/I/M  Stripe  Size(GB)  Cache  AVrfy
------------------------------------------------------------------------------
u0    RAID-6    OK             -       -       256K    27939.6   RiW    ON

VPort Status         Unit Size      Type  Phy Encl-Slot    Model
------------------------------------------------------------------------------
p0    OK             u0   2.73 TB   SATA  0   -            TOSHIBA DT01ACA300
p1    OK             u0   2.73 TB   SATA  1   -            TOSHIBA DT01ACA300
p2    OK             u0   2.73 TB   SATA  2   -            TOSHIBA DT01ACA300
p3    OK             u0   2.73 TB   SATA  3   -            TOSHIBA DT01ACA300
p4    OK             u0   2.73 TB   SATA  4   -            TOSHIBA DT01ACA300
p5    OK             u0   2.73 TB   SATA  5   -            TOSHIBA DT01ACA300
p6    OK             u0   2.73 TB   SATA  6   -            TOSHIBA DT01ACA300
p7    OK             u0   2.73 TB   SATA  7   -            TOSHIBA DT01ACA300
p8    OK             u0   2.73 TB   SATA  8   -            TOSHIBA DT01ACA300
p9    OK             u0   2.73 TB   SATA  9   -            TOSHIBA DT01ACA300
p10   OK             u0   2.73 TB   SATA  10  -            TOSHIBA DT01ACA300
p11   OK             u0   2.73 TB   SATA  11  -            TOSHIBA DT01ACA300

Name  OnlineState  BBUReady  Status    Volt     Temp     Hours  LastCapTest
---------------------------------------------------------------------------
bbu   On           Yes       OK        OK       OK       0      xx-xxx-xxxx

UPDATE: We used e2fsck and it recovered superblock information from an alternate location. Device became mountable again. However when we mounted it, there was no file on it.

refik
  • 193
  • 6

1 Answers1

1

The best way is to restore the latest backup.

Otherwise, one can try tools mentioned in Ubuntu's Data recovery article. To be safe, you should create an image of the current state of the RAID volume, and operate on the image.

Tero Kilkanen
  • 36,796
  • 3
  • 41
  • 63
  • 1
    I don't think Ubuntu's data recovery article is relevant because those are for cases when data is still intact on disk. Our problem is that certain bytes are set to 0 on the device, so data and filesystem information is gone. – refik Aug 18 '14 at 14:32
  • 2
    ext4 stores its superblock in several locations around the disk, and the recovery software should be able to locate a backup copy of the superblock to enable access to filesystem information. http://www.ufsexplorer.com/rdr_ext23.php could be another option. – Tero Kilkanen Aug 18 '14 at 15:51
  • Operating on a duplicate image would be the right way to do this, but it's understandable that the array might be too large to take a snapshot of it within budget. Thing is, you probably *can* recover a lot from this volume. If you screw up the recovery, you can't. If the budget is really too constrained, use another machine, reproduce a similar configuration and reproduce the problem. You might be able to just give the mount command an alternate superblock. http://www.cyberciti.biz/tips/mounting-with-an-alternative-superblock.html – mgjk Aug 19 '14 at 12:09