|12/26/2012, 11:47 AM||#1 (permalink)|
Subtitle: </dev/mapper/store-media> - what's up with that?
I accidentally (but partially?) deleted a hidden or dotted 'USB drive' folder, "/media/internal/.Mystuff/",
containing perhaps thousands of files adding up to about 10 GB, using Tegi's Commander (which gave no prompt or any indication at all,
very dangerous). I may have tossed Tegi's Commander soon after hitting the <delete> button, possibly interrupting the
deletion process. Using rooted xxcommander, the folder displays in the root directory ("/.Mystuff"), but with size
"undefined" and date "NaN/NaN/NaN" (note: this display might be due to symlinks).
The usual recovery procedure is to unmount the partition (or at least re-mount it read-only), and preferably
make a dd-image and then undelete the folder by fixing this image. I have some partly Webos-related questions:
1. Does a premature ending of the deletion process help or hurt recovery? In other words, once you realize your
mistake, should you try to stop the process, or let it run to completion?
2. Does the folder's 'hidden' attribute raise recovery complications?
3. Does the Logical Volume Management complicate recovery?
The <mount> command shows the following for the USB drive:
/dev/mapper/store-media on /media/internal type vfat (rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,
Apparently, this same </dev/mapper/store-media> device is concurrently mounted at eight other places (in
4. Is this device being used as a blank template of sorts? However, does it contain whatever filesystem was last
mounted, and is it wiped clean just before each new use?
5. To unmount the USB drive, should I use "umount /media/internal"?
6. What about using "umount /dev/mapper/store-media"? With this device being multi-mounted, what happens there?
Does the <mount> listing always show the mountings in correct chronological order? If you repeatedly performed
"umount /dev/mapper/store-media", would the USB and other filesystems be irretrievably lost, unless you copied them
elsewhere each time (I'm guessing they would still exist in the flash drive somewhere)? Is the answer to question 5 "yes"?
7. Instead of unmounting the USB drive, what about remounting it read-only ("mount -oro,remount" etc.), is that
a safer way to capture the USB filesystem? And again, is "/media/internal" or "/dev/mapper/store-media" the better
Any additional tips for the best ways to undelete ".Mystuff" would also be appreciated.
P.S at the moment, I can't seem to get the TP into usb mode - it will start, and show the usb symbol, but in a few moments fails, and Windows says please insert a disk into drive E: ... [UPDATE] This was solved, apparently by removing a background app (Brightness Unlinked)
Last edited by tfj; 12/31/2012 at 02:55 PM. Reason: corrected name
|12/26/2012, 12:53 PM||#2 (permalink)|
1. Files are deleted individually, so to cancel it before complete deleting is better than after.
2. It shouldn't. To FAT a .file is the same thing as a regular file. FAT uses attributes instead of file name to determine visibility. In any case, it doesn't matter.
3. Don't think so. The mapped partition is sort of like a device on its own.
4.No. It's set up by the LVM at boot, but is otherwise persistent.
5. You'll also need to send SIGUSR1 to cryptofs. See script at /etc/storaged/pre_msm.d/05_suspend_cryptofs
6. Won't work, because /dev/mapper/store-media is not a mount point.
7. Potentially better. Mount it at /media/internal.
My suggestion is to use a commercially available file recovery tool to do it. Doing it under Linux without automounting will give you better control. dding the entire partition sounds like it would take forever, and isn't good for the flash when you're writing it back. Preferably, you'll also do this with the installer ramdisk instead of a live system.
Contact: @GMMan_BZFlag (me on Twitter)
webOS Releases: Change your App Catalog country: TouchPad/PC | TouchPad/webOS Resources | Search suggestion patch for browser | Cycling Email Notifications | Don't Doctor! Make a good support request. | How to post logs | webOS Charge Monitor
|12/31/2012, 03:04 PM||#3 (permalink)|