The positive thing is that it was an old Ubuntu 8.04 and we wanted to update it.
So here was the time to do it.
On the machine, there was 2 hard drives in RAID 1 (mirror). So we removed them and put 2 new drives. We installed Ubuntu 14.04 and all the necessary packages.
Then it was time to copy data from the old disks to the new ones.
I didn't want to lose any more data, so I wanted to connect only 1 hard drive.
The problem is that this hard drive was part of a RAID, it is not a normal hard drive that we can mount as usual.
If you try, you will get error like:
mount: unknown filesystem type 'linux_raid_member'
mount: /dev/sdc2 already mounted or /mnt/recovery busy
Solution
Here are the steps to do:
1) create a mount point
mkdir /mnt/recovery
2) list the disk information
fdisk -l Disk /dev/sdc: 1000.2 GB, 1000204886016 bytes 255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x000abbde Device Boot Start End Blocks Id System /dev/sdc1 * 32 62500863 31250416 fd Linux raid autodetect /dev/sdc2 1937904885 1953520064 7807590 fd Linux raid autodetect /dev/sdc3 62500864 1937899519 937699328 fd Linux raid autodetect
I want to mount /dev/sdc3. The important information that we need in the next step:
- sectors: 512
- start: 62500864
3) finally run these commands:
$ losetup --find --show --read-only --offset $((62500864*512)) /dev/sdc /dev/loop3 $ fsck.ext3 -n -v /dev/loop3 e2fsck 1.42.9 (4-Feb-2014) Warning: skipping journal recovery because doing a read-only filesystem check. $ file -s /dev/loop3 /dev/loop2: Linux rev 1.0 ext3 filesystem data, UUID=dbf4-...-9a98a (needs journal recovery) (large files) $ mount -t ext3 -o ro,noload /dev/loop3 /mnt/recoverynote: I'm using loop3, but it can be a different number in your case.
And that's it! you can now access your files.
If you have an error like:
mount: wrong fs type, bad option, bad superblock on ....It probably means you have entered a wrong offset.
In case of error, use the following command to see the log:
dmesg | tail
Another solution on a computer without any RAID
On my desktop, I have no RAID disk, so I could run the following command:
mdadm --examine --scan
And that's it!
Here are 2 links that helped me a lot to find the solution!
http://digital-forensics.sans.org/blog/2011/06/14/digital-forensics-mounting-dirty-ext4-filesystems
http://unix.stackexchange.com/questions/72279/how-do-i-recover-files-from-a-single-degraded-mdadm-raid1-drive-not-enough-to
