[linux-lvm] dd of a used part of a logical volume?

[Greg Freemyer]

On Fri, 2004-05-28 at 02:45, Alexy Khrabrov wrote:
> I cross-post a part of my ReiserFS list message, as it
> concernes copying of a used part of a filesystem running
> on top of LVM.
> 
> I'd like to recover some files from a huge reiserfs file system.  It is
> created above an LVM volume, which in its turn sits on a RAID.  The LVM
> volume is the only one in a group which consists of the sole RAID device.
> I just deleted two files in a directory I know by name, the directory is
> still there.  No writing was done after the rm, except all files copied
> elsewhere and diff -r'ed checked, hope that does not alter the originals.
> 
> Now I'd like to play with the dd copying of the whole reiserfs (I'm
> avoiding the word partition since it covers the whole logical volume
> which spans the whole RAID device).  I simply do not have space to copy
> the whole RAID, but the size of the used space on this reiserfs volume was
> under about 9 GB.  I wonder how can I copy just about that -- I assume it
> fills the logical volume contiguously, so I can dd the first 9 GB and then
> try the loopback mount/rebuild.  Now that I'm running it, it scrolls lines
> 
> pass0: reading block 20626210 failed
> 
> like crazy, perhaps up to the whole 150 GB original size declared
> somewhere...
> 
> Then is quits, saying something about invalid argument to lseek,
> not surprisingly as I cut dd short.
> 
> Are there LVM methods to shrink it/copy just the used blocks in
> conjunction with reiserfs, such as resize_reiserfs?

Personally, if the files are valuable I would spend $400 on a 200GB
drive and a ATA133 controller.  Then you can make dd copy of the whole
filesystem.  If you put that into a single large file, then you can use
the loopback driver to mount it read-only, or to search, etc.

If there is a chance there are some bad blocks on the original disks,
then be sure to use the "conv=noerror,sync" argument to dd.

You can find an interesting primer on how to do this at
http://www.linux-forensics.com/linuxintro-LEFE-2.0.5.pdf

I would also want to see if I could find any "computer forensic" tools
for working with reiser. 

In particular, the penguin sleuth CD
http://www.linux-forensics.com/downloads.html may be able to help you.

I don't know what filesystems it supports, but the concept is you boot
off of the penguin sleuth CD (based on Knoppix), then use either basic
tools like dd, grep, etc. to recover your files.  Or they also have some
true recovery tools on the CD like autopsy.  

The above primer talks about how to do much of this.

Assuming you know linux you can skim the first half of this, but the
second half may be of more interest.

Commercial note: We do this professionally, and thus have a couple of
commercial packages, but I don't know if they support reiser or not.  If
you would consider outsourcing your recovery, let me know and I can
check.

HTH
Greg
-- 
Greg Freemyer