recommendations on how to recover a corrupted, LVM-based hard drive?

[Chris Murphy]

On Feb 14, 2014, at 7:52 AM, Robert P. J. Day <rpjday at crashcourse.ca> wrote:

> On Wed, 12 Feb 2014, Chris Murphy wrote:
> 
>> 
>> On Feb 12, 2014, at 1:08 PM, Robert P. J. Day <rpjday at crashcourse.ca> wrote:
>> 
>>> 
>>> it was 2G that was overwritten, not just 2M. so i'm quite willing to
>>> believe that it's unrecoverable. but that "testdisk" utility claims to
>>> be finding *something*, so i'll just let it finish and post what it
>>> reports.
>> 
>> Ok well the PV and VG metadata aren't super important if we're
>> talking about one PV and one VG and conventional (not thinp) LVM.
>> The LV should have linearly allocated logical extents to physical
>> extents to disk sectors. So baring some extra VG metadata copies
>> that could cause PEs to not be contiguous, the file system might be
>> found as if it were on a regular partition and totally intact.
> 
>  following up on my challenge to recover a single logical volume from
> a hard drive whose first 2G was overwritten, i now have in hand the
> laptop that it happened on and the drive has been reinserted back into
> the laptop as /dev/sdb (which is where it was when the overwriting
> happened), and i have the backup file /etc/lvm/backup/vg1 which
> represents the "vg1" volume group that encompassed that drive (and
> *only* that drive, so that's convenient.)
> 
>  so ... what now? i can see the detailed definition of the volume
> group, and all of the logical volumes that were/are(?) still there,
> and the only LV i care about is "home" which is the fifth one down in
> the list of LVs, suggesting it's far enough down to have escaped the
> overwriting unscathed.
> 
>  so what would be the proper recipe to simply reactivate that volume
> group and single logical volume within that group? thanks.

Well I haven't looked at the backup file before so I don't know what's in it. But the critical information I think is the start LBA for the PV, and its size (or end LBA). From that you create a new partition entry, which in theory will be identical to the old partition entry. And then use pvcreate to recreate the pv metadata in the first 4 sectors. You'll need the PV's UUID from the backup file, and the pvcreate command supports specifying that UUID. If you don't specify it, the PV gets a new UUID and the existing VG metadata won't recognize the PV so… it won't work.

http://linux.die.net/man/8/pvcreate

There are a lot of options in here. --restorefile ? Maybe this backup file can be directly consumed by the pvcreate command.

The other thing is testdisk might find the file system even without LVM being involved at all. So long as the LV containing the file system you want restored has a contiguous LE to PE relationship it should just appear. But of course any discontinuity means that won't work.

Chris Murphy