Results 1 to 3 of 3
  1. tfj
    tfj is offline
    tfj's Avatar
    Posts
    36 Posts
       #1  
    Subtitle: </dev/mapper/store-media> - what's up with that?

    I accidentally (but partially?) deleted a hidden or dotted 'USB drive' folder, "/media/internal/.Mystuff/",
    containing perhaps thousands of files adding up to about 10 GB, using Tegi's Commander (which gave no prompt or any indication at all,
    very dangerous). I may have tossed Tegi's Commander soon after hitting the <delete> button, possibly interrupting the
    deletion process. Using rooted xxcommander, the folder displays in the root directory ("/.Mystuff"), but with size
    "undefined" and date "NaN/NaN/NaN" (note: this display might be due to symlinks).

    The usual recovery procedure is to unmount the partition (or at least re-mount it read-only), and preferably
    make a dd-image and then undelete the folder by fixing this image. I have some partly Webos-related questions:

    1. Does a premature ending of the deletion process help or hurt recovery? In other words, once you realize your
    mistake, should you try to stop the process, or let it run to completion?

    2. Does the folder's 'hidden' attribute raise recovery complications?

    3. Does the Logical Volume Management complicate recovery?

    The <mount> command shows the following for the USB drive:

    /dev/mapper/store-media on /media/internal type vfat (rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,
    codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)

    Apparently, this same </dev/mapper/store-media> device is concurrently mounted at eight other places (in
    /var/palm/jail) ...

    4. Is this device being used as a blank template of sorts? However, does it contain whatever filesystem was last
    mounted, and is it wiped clean just before each new use?

    5. To unmount the USB drive, should I use "umount /media/internal"?

    6. What about using "umount /dev/mapper/store-media"? With this device being multi-mounted, what happens there?
    Does the <mount> listing always show the mountings in correct chronological order? If you repeatedly performed
    "umount /dev/mapper/store-media", would the USB and other filesystems be irretrievably lost, unless you copied them
    elsewhere each time (I'm guessing they would still exist in the flash drive somewhere)? Is the answer to question 5 "yes"?

    7. Instead of unmounting the USB drive, what about remounting it read-only ("mount -oro,remount" etc.), is that
    a safer way to capture the USB filesystem? And again, is "/media/internal" or "/dev/mapper/store-media" the better
    <mount> argument?

    Any additional tips for the best ways to undelete ".Mystuff" would also be appreciated.

    P.S at the moment, I can't seem to get the TP into usb mode - it will start, and show the usb symbol, but in a few moments fails, and Windows says please insert a disk into drive E: ... [UPDATE] This was solved, apparently by removing a background app (Brightness Unlinked)

    Thanks,

    tfj
    Last edited by tfj; 12/31/2012 at 03:55 PM. Reason: corrected name
  2. #2  
    1. Files are deleted individually, so to cancel it before complete deleting is better than after.
    2. It shouldn't. To FAT a .file is the same thing as a regular file. FAT uses attributes instead of file name to determine visibility. In any case, it doesn't matter.
    3. Don't think so. The mapped partition is sort of like a device on its own.
    4.No. It's set up by the LVM at boot, but is otherwise persistent.
    5. You'll also need to send SIGUSR1 to cryptofs. See script at /etc/storaged/pre_msm.d/05_suspend_cryptofs
    6. Won't work, because /dev/mapper/store-media is not a mount point.
    7. Potentially better. Mount it at /media/internal.

    My suggestion is to use a commercially available file recovery tool to do it. Doing it under Linux without automounting will give you better control. dding the entire partition sounds like it would take forever, and isn't good for the flash when you're writing it back. Preferably, you'll also do this with the installer ramdisk instead of a live system.
  3. tfj
    tfj is offline
    tfj's Avatar
    Posts
    36 Posts
       #3  
    Quote Originally Posted by GMMan View Post
    1. Files are deleted individually, so to cancel it before complete deleting is better than after.
    2. It shouldn't. To FAT a .file is the same thing as a regular file. FAT uses attributes instead of file name to determine visibility. In any case, it doesn't matter.
    3. Don't think so. The mapped partition is sort of like a device on its own.
    4.No. It's set up by the LVM at boot, but is otherwise persistent.
    5. You'll also need to send SIGUSR1 to cryptofs. See script at /etc/storaged/pre_msm.d/05_suspend_cryptofs
    6. Won't work, because /dev/mapper/store-media is not a mount point.
    7. Potentially better. Mount it at /media/internal.

    My suggestion is to use a commercially available file recovery tool to do it. Doing it under Linux without automounting will give you better control. dding the entire partition sounds like it would take forever, and isn't good for the flash when you're writing it back. Preferably, you'll also do this with the installer ramdisk instead of a live system.
    So far I've mounted /media/internal as read-only, and am trying testdisk (on a Public Library Windows machine, about all I've got, except for a 32 GB Nokia N900); testdisk thinks the USB drive has no partition - does the USB drive have unusual C:H:S geometry (something other than 3592:255:63)? I'm pretty sure testdisk can succeed, because during one trial I was starting to see some of the missing files copying out (but it's slow).

Posting Permissions