Re: Bonehead Move
On 2/13/07, Tod <tod(a)stthomasepc.org> wrote:
> I love cutting and pasting to and from my xterm. This time
however I
> cut and pasted a preceding space from the directory name I was trying to
> rm -fr. Thus I ended up doing rm -fr ./ mydir. Goodbye home dir.
>
> I quickly shut down and imaged the hard drive onto another server.
> Doing a little research I discovered I could mount the image using a
> loopback device. I wanted to try running foremost or some other tool to
> see what I could recover.
>
> I got the loopback working and can see all the partitions in the image.
> Since its a volume managed device I'm now stuck. I can see the
> partitions but I can't think of how to get around the lvm part to mount
> them and see the actual contents. I'm not that lvm proficient quite yet.
It may be as simple as making the vg and lv available. Do a pvscan and lvscan. When
you see the volume group, do a "vgchange -a your_vol_groupname". This will make
the
lv available in /dev/your_vol_groupname/your_lv_name. You can then mount it or use
forensic tools to try to extract. Make sure to mount it read-only.
--
* The Digital Hermit http://www.digitalhermit.com
* Unix and Linux Solutions kwan(a)digitalhermit.com