Sunday 2 October 2011

Recovery


Recovery in Linux

1. Repairing Linux ext2 or ext3 file system

            1. File system must be unmounted, we cannot repair it while it is running. Take system down to runlevel one (make sure to run all command as root user):
# init 1
            2. Unmount file system, for example if it is /home (/dev/sda3) file system then type command:
# umount /home     or
# umount /dev/sda3
            3. Now run fsck on the partition:
# fsck /dev/sda3
            However be sure to specify the file system type using -t option.
# fsck -t ext3 /dev/sda3     or
# fsck.ext3 /dev/sda3
            If we don't know our file system type then typing mount command will display file system type.
# mount
            The fsck will check the file system and ask which problems should be fixed or corrected. If we don't want type “y” every time then we can use pass -y option to fsck.
# fsck -y /dev/sda3
            Please not if any files are recovered then they are placed in /home/lost+found directory by fsck command.
            4. Once fsck finished, remount the file system:
# mount /home
            5. Go to multiuser mode
# init 3
            Read man page of fsck for more information. Make sure we replace “/dev/sda3” with our actual device name which filesystem is curupted.


2. Recover Root filesystem

            1. Try the fsck /dev/hda2 command to check the filesystem out.

            If that doesn't work. Try mke2fs -S /dev/hda2 which should write a new superblock without writing new inodes.
            Warning: Depending upon what the damage is, this (mkefs) command may make the missing data unsalvagable.

            2. We can try running this command that will run a check of your filesystem.

# /sbin/fsck -C -a /dev/hda2

            3. Open a terminal window.
# su -                                      (To switch to the root user)
# init 1                                                (To bring the system down to run level one)
            This only allows root access with no network access or daemons running.
# umount /dev/sda2                       (Unmount “/dev/sda2" file system, or partition, that we want to repair)
            Replace "/dev/sda2" with the correct device name for the partition. If the partition contains a single file system such as "/home", we can type the command "umount /home".
# fsck -y /dev/sda2             (To repair the file system)
# fsck -y -t ext3 /dev/sda2 (To repair the ext3 file system)
            This will ensure the file system is not corrupted by using the wrong file system type. The "-y" option will cause fsck to automatically fix any problems that are found.
            Repeat the "fsck" command until no more errors are reported.
# mount /dev/sda2             (To remount the file system)
# init 3                                                (To bring the system back to multi user mode)


3. Recover grub.conf boot loader file

            Step1: Insert Linux installer disk and boot with it. Go to Linux Rescue mode by firing this command.
boot: linux rescue

            Press Enter twice then select No and press Enter, then again press Enter for continue and finally press Enter for OK.  The sh prompt has appear.
sh-3.1# chroot /mnt/sysimage                (For make system the root environment)

            Step2: If we don’t know which is the boot directory, then fire bellow command? This will search and show the devices which contain the file.
sh-3.1# grub
grub> find /boot/grub/stage1 or,
grub> find /grub/stage1
            (hd0,0)
grub> root (hd0,0)
grub> setup (hd0)
grub> quit
           
Step3: Creating grub.conf file:
sh-3.1# ls /boot/ > /boot/grub/grub.conf
sh-3.1# vi /boot/grub/grub.conf

            Delete all lines except vmlinuz-x.x.xx-x.xxx and initrd-x.x.xx-x.xxx.img also add and edit some lines. Here we add only minimum and necessary entries for booting Linux OS.

title Red Hat Enterprise Linux (2.6.18-8.el5)
            root (hd0,0)
            kernel /boot/vmlinuz-2.6.18-8.el5 ro root=LABEL=/ rhgb quiet
            initrd /boot/initrd-2.6.18-8.el5.img

:wq
Descriptions:
            First line: This is the title which display during booting. You may change any title name.
            Second line: This is the boot directory. It includes hdd and its partition number.
            Third line: This is the kernel file path with its version number.  It include “ro” means read only, “root=LABLE=/” set / lable for root partition, rhgb means Red Hat Graphical Boot.

sh-3.1#          exit
            Remove Installer disk and boot system normally.


          Second Method
            You may boot Red Hat Linux which are Corrupted or Deleted grub.conf file without installere disk and also recovergrub.conf.
            Follow these steps:
            Boot the system normally.
grub> root (hd0,0)
grub> kernel /boot/vmlinuz-2.6.18-8.el5 ro root=LABEL=/ rhgb quiet
grub> initrd /boot/initrd-2.6.18-8.el5.img
grub> boot

            After fire boot command the system is going to boot. After that create or edit the grub.conf file with vi editor.


4. Reinstall Grub in Linux Using a Live CD

            "Grub" is the bootloader most commonly used by Linux operating systems, allowing the loading of both the Linux OS as well as Windows and Mac-based systems. If the Grub bootloader becomes corrupted or the boot file is otherwise damaged, Linux or any other operating systems loaded by Grub will not be able to launch. Fortunately, a Grub bootloader installation is easy to fix if it becomes damaged; all we need is a "live CD" of the Linux installation that installed Grub, which is a special version of the operating system that is designed to run directly from a CD or DVD.

            Instructions:
            1. Insert the Linux live CD in our computer's CD or DVD drive, then reboot the computer. When the first BIOS page appears, press the key indicated to access the "Boot Menu" or "Boot Options."
            2. Select the drive that contains our Linux live CD. When prompted, press a key to allow computer to boot from the disc.
            3. Wait while the live CD loads the version of Linux that is installed on it. Once it has loaded, access the terminal (this is done in Linux distros such as Ubuntu by opening the "Applications" menu, selecting the "Accessories" folder, then choosing "Terminal" from the list of accessories.)
            4. Type "sudo grub" and press "Enter" key. This will set the operating system to "Grub mode" so that it can edit the bootloader.
            5. Type "find /boot/grub/stage1" and press "Enter" to locate the hard drive and partition where bootloader is located. Once we have find this information, type "root (hdX,Y)" and press "Enter" to access that partition; "X" should be the number of the hard drive and "Y" should be the number of the partition for the bootloader.
            6. Type "setup (hdX)" with "X" being the hard drive number and press "Enter." This will set up a new copy of the Grub bootloader in the partition. Once this is finished, type "quit" and press the "Enter" key again to quit the terminal.
            7. Remove the live CD from our computer and reboot it. The Grub bootloader should load as normal without the need for the live CD.


5. ext3 Filesystem Bad Superblock Recovery

            First, obtain the size of the damaged filesystem. If our system still has df functioning, we can run df and grab the filesystem size that way. The output reports the number of 1K (1,024 bytes) blocks the filesystem is using.
            Next, find a working system if the box with the broken filesystem has lost its root filesystem. Now, invoke the magic of dd. For example, my filesystem showed up as using 101,086 blocks. So I used the following command:
# dd if=/dev/zero of=/tmp/temp bs=1024 count=101086
            Now, we’re nearly finished. Finally, build an ext3 filesystem on our new file.
# mkfs.ext2 /tmp/temp
mke2fs 1.32 (09-Nov-2002)
/tmp/temp is not a block special device.
Proceed anyway? (y,n) y
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
25272 inodes, 101086 blocks
5054 blocks (5.00%) reserved for the super user
First data block=1
13 block groups
8192 blocks per group, 8192 fragments per group
1944 inodes per group
Superblock backups stored on blocks:
        8193, 24577, 40961, 57345, 73729
            (Not here I used “mkfs.ext2”, but the results are the same.)
            Look, our missing superblocks are revealed!
            Now, to recover, call fsck.ext3 on the damaged system.
# /sbin/fsck.ext3 -b 57345 /dev/sda1
            Carefully evaluate the prompts and decide if we want to allow fsck to proceed with filesystem repairs. If the backup superblock is also invalid, try another or follow the steps above again and double check the numbers.
            But what if we don’t have enough space to create a file as big as our lost partition? If that is the case or the partition is so huge we don’t want to wait that long for dd to complete, there is another option. The superblock locations vary depending on the blocksize used. The ext3 filesystem varies between 1024, 2048, and 4096 bytes depending on the size of the filesystem. Since the locations are neither magic or random, we can create, say, a 500MB partition and force the blocksize to match that of the damaged filesystem.
# /sbin/mkfs.ext3 -j -b 4096 /tmp/temp
            The presence or absence of a journal does not effect the location of the backup superblocks.

6. Recovering deleted /etc/shadow file

Boot system in single user mode.
sh-3.1# pwconv                              (It create shadow file from passwd file)
sh-3.1# passwd                              (For change root password)
            Enter new root password twice.
sh-3.1# startx                                   (Start system in run level 5)
            After that restore original shadow file from the backup.

No comments:

Post a Comment

Boot to UEFI Mode or legacy BIOS mode

Boot to UEFI Mode or legacy BIOS mode Choose UEFI or legacy BIOS modes while installing Windows. After Windows is installed, if you nee...