webOS Nation Forums >  webOS Devices >  HP TouchPad > Unmount the USB drive, and undelete a 'USB drive' directory
Unmount the USB drive, and undelete a 'USB drive' directory
  Reply
 
Thread Tools Display Modes
Old 12/26/2012, 12:47 PM   #1 (permalink)
tfj
Member
 
Posts: 36
Subtitle: </dev/mapper/store-media> - what's up with that?

I accidentally (but partially?) deleted a hidden or dotted 'USB drive' folder, "/media/internal/.Mystuff/",
containing perhaps thousands of files adding up to about 10 GB, using Tegi's Commander (which gave no prompt or any indication at all,
very dangerous). I may have tossed Tegi's Commander soon after hitting the <delete> button, possibly interrupting the
deletion process. Using rooted xxcommander, the folder displays in the root directory ("/.Mystuff"), but with size
"undefined" and date "NaN/NaN/NaN" (note: this display might be due to symlinks).

The usual recovery procedure is to unmount the partition (or at least re-mount it read-only), and preferably
make a dd-image and then undelete the folder by fixing this image. I have some partly Webos-related questions:

1. Does a premature ending of the deletion process help or hurt recovery? In other words, once you realize your
mistake, should you try to stop the process, or let it run to completion?

2. Does the folder's 'hidden' attribute raise recovery complications?

3. Does the Logical Volume Management complicate recovery?

The <mount> command shows the following for the USB drive:

/dev/mapper/store-media on /media/internal type vfat (rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,
codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)

Apparently, this same </dev/mapper/store-media> device is concurrently mounted at eight other places (in
/var/palm/jail) ...

4. Is this device being used as a blank template of sorts? However, does it contain whatever filesystem was last
mounted, and is it wiped clean just before each new use?

5. To unmount the USB drive, should I use "umount /media/internal"?

6. What about using "umount /dev/mapper/store-media"? With this device being multi-mounted, what happens there?
Does the <mount> listing always show the mountings in correct chronological order? If you repeatedly performed
"umount /dev/mapper/store-media", would the USB and other filesystems be irretrievably lost, unless you copied them
elsewhere each time (I'm guessing they would still exist in the flash drive somewhere)? Is the answer to question 5 "yes"?

7. Instead of unmounting the USB drive, what about remounting it read-only ("mount -oro,remount" etc.), is that
a safer way to capture the USB filesystem? And again, is "/media/internal" or "/dev/mapper/store-media" the better
<mount> argument?

Any additional tips for the best ways to undelete ".Mystuff" would also be appreciated.

P.S at the moment, I can't seem to get the TP into usb mode - it will start, and show the usb symbol, but in a few moments fails, and Windows says please insert a disk into drive E: ... [UPDATE] This was solved, apparently by removing a background app (Brightness Unlinked)

Thanks,

tfj

Last edited by tfj; 12/31/2012 at 03:55 PM. Reason: corrected name
tfj is offline   Reply With Quote
Old 12/26/2012, 01:53 PM   #2 (permalink)
Member
 
GMMan's Avatar
 
Posts: 2,136
1. Files are deleted individually, so to cancel it before complete deleting is better than after.
2. It shouldn't. To FAT a .file is the same thing as a regular file. FAT uses attributes instead of file name to determine visibility. In any case, it doesn't matter.
3. Don't think so. The mapped partition is sort of like a device on its own.
4.No. It's set up by the LVM at boot, but is otherwise persistent.
5. You'll also need to send SIGUSR1 to cryptofs. See script at /etc/storaged/pre_msm.d/05_suspend_cryptofs
6. Won't work, because /dev/mapper/store-media is not a mount point.
7. Potentially better. Mount it at /media/internal.

My suggestion is to use a commercially available file recovery tool to do it. Doing it under Linux without automounting will give you better control. dding the entire partition sounds like it would take forever, and isn't good for the flash when you're writing it back. Preferably, you'll also do this with the installer ramdisk instead of a live system.
__________________
Contact: @GMMan_BZFlag (me on Twitter)
webOS Releases: Change your App Catalog country: TouchPad/PC | TouchPad/webOS Resources | Search suggestion patch for browser | Cycling Email Notifications | Don't Doctor! Make a good support request. | How to post logs | webOS Charge Monitor
GMMan is offline   Reply With Quote
Thanked By: tfj
Old 12/31/2012, 04:04 PM   #3 (permalink)
tfj
Member
 
Posts: 36
Quote:
Originally Posted by GMMan View Post
1. Files are deleted individually, so to cancel it before complete deleting is better than after.
2. It shouldn't. To FAT a .file is the same thing as a regular file. FAT uses attributes instead of file name to determine visibility. In any case, it doesn't matter.
3. Don't think so. The mapped partition is sort of like a device on its own.
4.No. It's set up by the LVM at boot, but is otherwise persistent.
5. You'll also need to send SIGUSR1 to cryptofs. See script at /etc/storaged/pre_msm.d/05_suspend_cryptofs
6. Won't work, because /dev/mapper/store-media is not a mount point.
7. Potentially better. Mount it at /media/internal.

My suggestion is to use a commercially available file recovery tool to do it. Doing it under Linux without automounting will give you better control. dding the entire partition sounds like it would take forever, and isn't good for the flash when you're writing it back. Preferably, you'll also do this with the installer ramdisk instead of a live system.
So far I've mounted /media/internal as read-only, and am trying testdisk (on a Public Library Windows machine, about all I've got, except for a 32 GB Nokia N900); testdisk thinks the USB drive has no partition - does the USB drive have unusual C:H:S geometry (something other than 3592:255:63)? I'm pretty sure testdisk can succeed, because during one trial I was starting to see some of the missing files copying out (but it's slow).
tfj is offline   Reply With Quote
Reply

 

Thread Tools
Display Modes



 


Content Relevant URLs by vBSEO 3.6.0