Data recovery
 

hey,



*I have* a problem, i decided to try kubunto 8.10 yesterday...i made it right in a pc with 2 hd sata...in the installation procces apeared a question something like if i want to recognaize raid...i answered yes...cause i'm silly...and now i think kubuntu made a kind of raid...i think there are a copy of hd1 in hd2...someone knows how can i recover the data which hd2 had before?


thanks

Data recovery
 

On Fri, Nov 14, 2008 at 10:48 AM, Jesus arteche <chechu.linux@gmail.com> wrote:

hey,


*I have* a problem, i decided to try kubunto 8.10 yesterday...i made it right in a pc with 2 hd sata...in the installation procces apeared a question something like if i want to recognaize raid...i answered yes...cause i'm silly...and now i think kubuntu made a kind of raid...i think there are a copy of hd1 in hd2...someone knows how can i recover the data which hd2 had before?


thanks


Less likely.

Data recovery
 

On Fri, Nov 14, 2008 at 09:48:03AM +0100, Jesus arteche wrote:
> I have a problem, i decided to try kubunto 8.10 yesterday...i made it
> right in a pc with 2 hd sata...in the installation procces apeared a
> question something like if i want to recognaize raid...i answered
> yes...cause i'm silly...and now i think kubuntu made a kind of raid...i
> think there are a copy of hd1 in hd2...someone knows how can i recover the
> data which hd2 had before?

sure, from the backups you did before you installed an OS.

You did do backups, didn't you?



--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Data recovery
 

Douglas A. Tutty wrote:

On Fri, Nov 14, 2008 at 09:48:03AM +0100, Jesus arteche wrote:

I have a problem, i decided to try kubunto 8.10 yesterday...i made it
right in a pc with 2 hd sata...in the installation procces apeared a
question something like if i want to recognaize raid...i answered
yes...cause i'm silly...and now i think kubuntu made a kind of raid...i
think there are a copy of hd1 in hd2...someone knows how can i recover the
data which hd2 had before?


sure, from the backups you did before you installed an OS.

You did do backups, didn't you?





And of the entire hd2, that is?


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

data recovery
 

Hi,

Need help on data recovery.

Suddenly my disk device's geometry has been changed to something that
doesnot make any sense. Its a 1.8TB in size and had only one single
partition. Now I can see 3 partitions sde1, sde2 and sde2 of sizes
130M, 140GB and 10GB.

Is there any way to recover data from these newly created disk devices?

Thanks
Paras.
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

data recovery
 

On Thu, 22 Sep 2011, Paras pradhan wrote:

> To: CentOS mailing list <centos@centos.org>
> From: Paras pradhan <pradhanparas@gmail.com>
> Subject: [CentOS] data recovery
>
> Hi,
>
> Need help on data recovery.
>
> Suddenly my disk device's geometry has been changed to
> something that does not make any sense. Its a 1.8TB in
> size and had only one single > partition. Now I can see 3
> partitions sde1, sde2 and sde2 of sizes 130M, 140GB and
> 10GB.
>
> Is there any way to recover data from these newly created
> disk devices?

Hi Paras.

AFAIK disks don't get partitioned out of the blue.

They need some sort of intervention to make this happen.

What have you done just before this happened?

Did you try to do an installation of Linux, or something
else?

Also, is it possible for a trojan program to do this to your
HDD?

Kind Regards,

Keith Roberts

-----------------------------------------------------------------
Websites:
http://www.karsites.net
http://www.php-debuggers.net
http://www.raised-from-the-dead.org.uk

All email addresses are challenge-response protected with
TMDA [http://tmda.net]
-----------------------------------------------------------------
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

data recovery
 

On Fri, Sep 23, 2011 at 12:07 PM, Keith Roberts <keith@karsites.net> wrote:
> On Thu, 22 Sep 2011, Paras pradhan wrote:
>
>> To: CentOS mailing list <centos@centos.org>
>> From: Paras pradhan <pradhanparas@gmail.com>
>> Subject: [CentOS] data recovery
>>
>> Hi,
>>
>> Need help on data recovery.
>>
>> Suddenly my disk device's geometry has been changed to
>> something that does not make any sense. Its a 1.8TB in
>> size and had only one single > partition. Now I can see 3
>> partitions sde1, sde2 and sde2 of sizes 130M, 140GB and
>> 10GB.
>>
>> Is there any way to recover data from these newly created
>> disk devices?
>
> Hi Paras.
>
> AFAIK disks don't get partitioned out of the blue.

Yes true. We are trying to find the out how it happened when nobody
did anything to this server.

>
> They need some sort of intervention to make this happen.
>
> What have you done just before this happened?
>
> Did you try to do an installation of Linux, or something
> else?

No. This is a production server and nobody logs in. Very very restricted.

>
> Also, is it possible for a trojan program to do this to your
> HDD?

Are there any know trojan that can change the disk layout?



>
> Kind Regards,
>
> Keith Roberts


Thanks
Paras.

>
> -----------------------------------------------------------------
> Websites:
> http://www.karsites.net
> http://www.php-debuggers.net
> http://www.raised-from-the-dead.org.uk
>
> All email addresses are challenge-response protected with
> TMDA [http://tmda.net]
> -----------------------------------------------------------------
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

data recovery
 

On 09/22/11 3:48 PM, Paras pradhan wrote:
> Hi,
>
> Need help on data recovery.
>
> Suddenly my disk device's geometry has been changed to something that
> doesnot make any sense. Its a 1.8TB in size and had only one single
> partition. Now I can see 3 partitions sde1, sde2 and sde2 of sizes
> 130M, 140GB and 10GB.
>
> Is there any way to recover data from these newly created disk devices?
>

Can you share the output of ...

fdisk -l /dev/sde

be interesting to see just what these partitions look like in terms of
the disk layout. those sizes sort of correlate with a typical /boot /
and swap partition


--
john r pierce N 37, W 122
santa cruz ca mid-left coast

_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

data recovery
 

On Fri, 23 Sep 2011, Paras pradhan wrote:
*snip*

> No. This is a production server and nobody logs in. Very
> very restricted.

Have you checked all your logs? What ports are open?
What CLI tools to format a HDD do you have on the server?

>
>>
>> Also, is it possible for a trojan program to do this to your
>> HDD?
>
> Are there any know trojan that can change the disk layout?

I don't know of any. What applications do you have running
on that server?

You say a production server. What type of server - a web
hosting provider?

What scripting languages do you have running on the server,
if any?

If you give me an email directly, I might be able to do a
remote login for you, and some forensics, as that is one of
my many interests.

Kind Regards,

Keith Roberts

-----------------------------------------------------------------
Websites:
http://www.karsites.net
http://www.php-debuggers.net
http://www.raised-from-the-dead.org.uk

All email addresses are challenge-response protected with
TMDA [http://tmda.net]
-----------------------------------------------------------------
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

data recovery
 

Keith Roberts wrote:
> On Fri, 23 Sep 2011, Paras pradhan wrote:
> *snip*
>
>> No. This is a production server and nobody logs in. Very
>> very restricted.
>
> Have you checked all your logs? What ports are open?
> What CLI tools to format a HDD do you have on the server?
<snip>
And then there's the other question: who has *access*, physically, to the
server? Staff? Have any staff recently been let go? Cleaning people?

mark

_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos