WARNING!! Mageia LIVE appears to have wiped my hard drive

This forum is dedicated to basic help and support :

Ask here your questions about basic installation and usage of Mageia. For example you may post here all your questions about getting Mageia isos and installing it, configuring your printer, using your word processor etc.

Try to ask your questions in the right sub-forum with as much details as you can gather. the more precise the question will be, the more likely you are to get a useful answer

WARNING!! Mageia LIVE appears to have wiped my hard drive

Postby shaney » May 19th, '13, 16:28

I say "appears" because this may be some sort of corruption related to this thread: viewtopic.php?f=7&t=4255

Anyway, here's the full story:

I downloaded the live DVD iso and dumped it on to a USB stick using DD. Something I have done countless times without issues and I am 100% sure I have made no errors.

I booted from the USB stick and selected the live boot from the, poked around and generally checked out Mageia for a bit.
Shutdown the computer and removed the USB stick.
About 20 minutes later I turned on the computer to boot into my regular install (kubuntu) and found myself faced with the Live grub menu as seen on the USB stick.
I double-checked the USB wasn't still inserted and sure enough it wasn't and Mageia was booting up and indeed finished at the desktop... with no USB!!
I assumed that somehow the MBR had been corrupted so I tried chrooting into my old partition but the konsole told me there was no partition so I looked at the disk partitioner and sure enough, it showed all my partitions had gone. No more Windows, no more linux partitions (there were 5) and no more data partition with all my music, videos, photos etc.
All the is left is a 1.46GB partition, presumably containing this Mageia image?

I have no idea where to go from here. At best there is some corruption and it only appears that the drive is wiped out. At worst it IS wiped out and I have lost EVERYTHING.

I should point out that at no time whilst running from the live USB did I launch the partition manager or installer or anything at all that should have touched the hard drive.
Just connected to the internet, made sure things were working and stuff.

Where do I go from here?
shaney
 
Posts: 8
Joined: May 19th, '13, 16:18

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby spiky001 » May 19th, '13, 16:34

Hi

Sorry to hear that did you download the Live dvd or the full dvd? I think the full dvd dosn,t run as a live version
Various Ubuntu, Centos 6, Debain, LFS, Fedora, Mageia 3, Pcbsd
spiky001
 
Posts: 37
Joined: May 9th, '13, 22:37
Location: surrey,uk

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby shaney » May 19th, '13, 16:54

I downloaded the Live DVD from the Distrowatch home page: http://ftp.tku.edu.tw/Linux/Mageia/iso/ ... 64-DVD.iso

Which of course should not have touched the hard drive in any way, shape or form.
shaney
 
Posts: 8
Joined: May 19th, '13, 16:18

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby spiky001 » May 19th, '13, 16:58

correct I have used the live dvd from the mageia site and used it numerous times as a live cd. What size gig was the download
the live dvd I used is 1.7gig
Various Ubuntu, Centos 6, Debain, LFS, Fedora, Mageia 3, Pcbsd
spiky001
 
Posts: 37
Joined: May 9th, '13, 22:37
Location: surrey,uk

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby spiky001 » May 19th, '13, 17:05

Downloading I will try it see what happens post results later
Various Ubuntu, Centos 6, Debain, LFS, Fedora, Mageia 3, Pcbsd
spiky001
 
Posts: 37
Joined: May 9th, '13, 22:37
Location: surrey,uk

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby ghmitch » May 19th, '13, 17:36

This is REALLY weird. I have NEVER had this kind of experience with Mageia or any other distro for that matter, but it has got to be anyone's worst nightmare. Given that you apparently have a pretty large drive, I doubt if it would have had time to overwrite a whole lot in the short interval of time you were using it. It is more likely that it just deleted your partitions in which case they usually can be recovered. But, whatever you do, don't write anything else to the drive until you have been able to fully examine it. There are a number of potential utilities out there that can be helpful in situations like this, probably the one I have found most useful is "testdisk" (http://en.wikipedia.org/wiki/TestDisk) which can look at an "empty" drive and find unlinked partitions and relink them, thus rebuilding the partition table so that it, once again, identifies all the partitions on the drive. Then you can simply boot up as normal and everything will be back. But the ONLY safe way to do that is externally from a clean system. At this point you really don't know what did get loaded on to your drive. It is probably a case of something just going haywire, but there is always the possibility that if you linked this from distrowatch, there could be malware involved as there is the remote possibility that the image you downloaded could be bogus. And unfortunately, the only way at this point to rulle that out would be to identify that image, which, of course, was probably among the stuff lost on your drive. So the safe way to go about this would be to attach this drive to a good system and examine it with testdisk or some similar utility and also to have some technically adept helper around, someone you know or someone from your local linux group, to carefully and non-destructively investigate this mess. What you want to do first, of course, is extract your data, before actually doing any writing to the drive or mounting it in a live setting. Once you have your data back, you can start having fun again. So sorry this happened to you. Hope that all goes well and that you get everything back intact! - George
ghmitch
 
Posts: 325
Joined: Mar 30th, '11, 03:05
Location: Eureka California USA

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby shaney » May 19th, '13, 18:07

It is indeed very strange.
I have probably installed over 50 distros at some time or another and never had anything like this.
I did have an issue on a Mandriva install a long time ago which caused some corruption but that was on an installed system and directly after making some alterations to partitions.

I can't remember much about the image I downloaded, I figure it was around a gig and a half, though I did check the MD5 after install as I generally do.
Testdisk got me nowhere and I am currently following a guide using gpart so I will have to see how that goes.

I wasn't running Mageia long enough to think it could have actually deleted a whole drive (about 500GB) but if Mageia has written itself to disk as it appears to have, I will have lost part of my Windows partition at the very least.

Still, no point speculating til i know what the actual damage is.
Will be interested to hear from anyone else who has tried using the live (KDE, 64-bit) iso and if there are any problems, though I doubt there will be.
shaney
 
Posts: 8
Joined: May 19th, '13, 16:18

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby shaney » May 19th, '13, 18:11

Actually, looks like it IS worst case scenario after all.

Before, there was the windows partiton and it's recovery.
Then an extended partiton containing swap, the data partition and 5 linux partitions.

The scan by gpart tells me there are just 4 empty partitions of zero size :(
shaney
 
Posts: 8
Joined: May 19th, '13, 16:18

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby ghmitch » May 19th, '13, 18:37

shaney, DON'T use a partitioning tool or you will just make matters worse. The partitioning tool is reading the partition table which is what is corrupted. You need to be reading the drive itself and REBUILDING the partition table. Partitioning tools like gpart CANNOT do that. - George
ghmitch
 
Posts: 325
Joined: Mar 30th, '11, 03:05
Location: Eureka California USA

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby shaney » May 19th, '13, 18:41

Note I am using "gpart", NOT gparted. The tutorial I read suggests that amongst other things gpart is for rescuing just such a situation.
shaney
 
Posts: 8
Joined: May 19th, '13, 16:18

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby spiky001 » May 19th, '13, 18:44

I am burning a dvd to try now
Various Ubuntu, Centos 6, Debain, LFS, Fedora, Mageia 3, Pcbsd
spiky001
 
Posts: 37
Joined: May 9th, '13, 22:37
Location: surrey,uk

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby spiky001 » May 19th, '13, 19:03

I have run that dvd and all works out ok, so dont know what went wrong there, Sorry it dosn,t help much
Various Ubuntu, Centos 6, Debain, LFS, Fedora, Mageia 3, Pcbsd
spiky001
 
Posts: 37
Joined: May 9th, '13, 22:37
Location: surrey,uk

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby ghmitch » May 19th, '13, 22:42

shaney wrote:Note I am using "gpart", NOT gparted. The tutorial I read suggests that amongst other things gpart is for rescuing just such a situation.


Sorry, my mistake.
ghmitch
 
Posts: 325
Joined: Mar 30th, '11, 03:05
Location: Eureka California USA

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby jkerr82508 » May 19th, '13, 23:14

shaney wrote:I downloaded the live DVD iso and dumped it on to a USB stick using DD.

All the is left is a 1.46GB partition, presumably containing this Mageia image?

The logical explanation is that you dumped the image on the hard drive instead of the USB stick. 1.4GB is about the size of the live DVD's.

I would have suggested TestDisk, http://www.cgsecurity.org/wiki/TestDisk, but you say that it didn't work out for you. Good luck with gpart.

Jim
jkerr82508
 
Posts: 946
Joined: Mar 26th, '11, 01:34
Location: Fife, Scotland

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby doktor5000 » May 19th, '13, 23:34

First step: Make an image of the whole harddrive and only work on that image, not on the real drive.

Best use dd, but you should be really watchful what you're writing where with dd. So if you want to backup /dev/sda to /media/somemountpoint/backups/brokendrive.img use something like this:
Code: Select all
dd if=/dev/sda of=/media/somemountpoint/backups/brokendrive.img bs=2M

When you have done the backup, disconnect the real drive for safety reasons.

Only second comes testdisk, working directly on the image, which should be mounted read-only.
Cauldron is not for the faint of heart!
Caution: Hot, bubbling magic inside. May explode or cook your kittens!
----
Disclaimer: Beware of allergic reactions in answer to unconstructive complaint-type posts
User avatar
doktor5000
 
Posts: 18066
Joined: Jun 4th, '11, 10:10
Location: Leipzig, Germany

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby ghmitch » May 20th, '13, 01:19

I would also add that testdisk has an option that is not really obvious which causes it to hunt for GPT partitions rather than DOS partitions. You want to make sure you do BOTH types of searches. Testdisk takes some getting used to, but it is hands down the most powerful utility I have found to recover data from drives with trashed partitions. But Doktor is correct, you really need to be careful not to do any writes to the screwed up drive since that can only make matter worse. The slower and more methodically you do this with advice from experts like Doktor, the more the chance of recovering your data. I would bet that your data is still intact on that drive somewhere, your system just can't find it. Things like this can happen so easily for a number of reasons which is why I now keep EIGHT complete backup copies of everything on separate drives at all times + BluRay copies of the most important stuff. But I HAVE been in your shoes before and it with a Reiserfs partitioned drive and it required help from Hans Reiser himself to get my data back, in my case with fsck, but with that help I recovered 100% of it intact, 40GB worth. It can be done but it requires patience and tenacity. Hans Reiser's first advice to me was exactly as you recieved from Doktor. That is "dd the drive to another drive and don't write anything to it until you are sure you have your data back intact. I did that and it worked for me. I don't know if it will work for you but you won't know till you try. If you are SURE you have a complete backup on hand, you can resort to that, but even then I would not touch the original drive just in case things don't work out.

As to how this happened, I agree with Jim's line of thinking, that the live image got dumped onto the hard drive instead of the USB drive. That would account for the bahavior all the way thru. In that case the first 1.7Gig of the hard drive is toast. But the rest of it should be intact and it is just a matter of figuring out how to extract it. If its on ext3 or ext4 partitions, I know there are ext tools to recover data in addition to partition recovery tools like testdisk. But Doctor is the one with the most experience around here and he is he one that shaney should be listening to at this point.
ghmitch
 
Posts: 325
Joined: Mar 30th, '11, 03:05
Location: Eureka California USA

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby shaney » May 21st, '13, 00:20

jkerr82508 wrote:The logical explanation is that you dumped the image on the hard drive instead of the USB stick. 1.4GB is about the size of the live DVD's.

I would have suggested TestDisk, http://www.cgsecurity.org/wiki/TestDisk, but you say that it didn't work out for you. Good luck with gpart.

Jim


I figured the same myself as it was the only logical explanation. However, when I got my kubuntu install back (see below) the first thing I did was check the konsole history and found only 2 "dd" commands. One to burn an openSuse iso to USB the day before and the command I used to burn the Mageia iso. Both commands very definitely pointed to the USB stick.
Code: Select all
sudo dd if=Mageia-3-LiveDVD-KDE4-x86_64-DVD.iso of=/dev/sdb
The hard drive is sda.

Must have done something wrong with testdisk before because I tried again and it did eventually find all my partitions.
So restored everything as best I could and although I got all the data back and re-installed grub back to mbr, things still weren't right.
I could boot my main kubuntu install but not boot windows.
All partitions were mountable and I could browse them and write to them but if I ran a partition manager, it still showed no partitions. Clearly the partition table was just messed up.

So in the end just went ahead and nuked the hard drive completely to start from scratch. My most important stuff was backed up anyway and testdisk at least allowed me to get anything else I wanted off the drive first.

I would still so love to know what went wrong though... :)
shaney
 
Posts: 8
Joined: May 19th, '13, 16:18

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby tom_ » May 21st, '13, 01:45

I have used the live DVD KDE without this kind of problem,
however I have seen that at "Grub menu time" if you hit F6 to change some kernel parameter
the focused choise change from "run live version" to "install live version"

I haven't seen what happens when booting with that option,
but I guess it will touch the hard drive.

Could this be the cause of your trouble?
tom_
 
Posts: 423
Joined: Sep 3rd, '11, 12:26
Location: Porto Ercole, Italy

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby ghmitch » May 21st, '13, 02:33

Shaney, A really important factor when using multiple distros especially is that different partition managers are not always compatible. A change made by one can render another inoperative, since they use different approaches to formating and read existing formated drives differently. But congratulations on saving your data. That is the one most important thing in the whole story. The rest is all a learning experience and we can all use those now and then even though they are often not pleasant. As for your Windows install, Windows ALWAYS installs on the first partition and it is pretty clear the Mageia Live somehow overwrote the first part of that partition. That essentially means bye-bye Windows, since it is not just the partition table that got wacked, Its everything in the first 1.7GB which would be a fatal blow with now way of fixing it. Testdisk can only find what is actually on the drive and right now that would be the Mageia Live Image and then the remainder of the Windows partition which Testdisk would likely see as just junk.

Tom, Interesting you should mention the issues regarding live optical disks that are capable of installing. That whole issue has always troubled me. The reason I use a live disc is precisely because I do NOT want to install and often because I do not want ANYTHING writing to the drive in question in any way. On more than one occasion I have been blind sided by the focus shifting or the select wheel spinning all for no apparent reason and when I reflexively hit the return key all hell breaks loose as a result. I really hate to get tangled in these programming glitches. That is why I would like to see a line of distinction between an "install" disk and a "live" disk. Certainly I would REALLY be interested to know if Mageia DID install to Shaney's USB key, becauese if it did, then it certainly appears that something went terribly wrong with the boot of the live disk. But I can't imagine even in that case that the Mageia Live didn't through up a very clear warning "DO YOU REALLY WANT TO INSTALL ... etc" and " .... is about to write to your hard drive." I can't imagine that it would just be done in the background as that would seem to be very dangerous. It would seem that it would go to the drive partitioner and all that stuff which would be a dead give away.
ghmitch
 
Posts: 325
Joined: Mar 30th, '11, 03:05
Location: Eureka California USA

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby martinw » May 22nd, '13, 00:04

shaney wrote:Both commands very definitely pointed to the USB stick.
Code: Select all
sudo dd if=Mageia-3-LiveDVD-KDE4-x86_64-DVD.iso of=/dev/sdb

The hard drive is sda.

I stand ready to be corrected here, but I do know that the allocation of drives to device names (sda, sdb, etc.) depends on the order in which the drives are found when the OS boots. If you had your USB stick inserted when you booted up, it's just possible it was found first and allocated to sda, which would mean the hard drive would get allocated to sdb. I've certainly seen this behaviour with USB devices - if I insert my USB stick before booting it appears as sdb, if I insert it after booting it appears as sdf.
martinw
 
Posts: 608
Joined: May 14th, '11, 10:59

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby doktor5000 » May 22nd, '13, 23:40

Exactly because of those reasons it's best to always ensure that the device you're trying to write to is really the one which you believe it is.
Best use blkid or fdisk -l - or maybe journalctl -f before you plugin the usb drive to see which device name it gets assigned ...
Cauldron is not for the faint of heart!
Caution: Hot, bubbling magic inside. May explode or cook your kittens!
----
Disclaimer: Beware of allergic reactions in answer to unconstructive complaint-type posts
User avatar
doktor5000
 
Posts: 18066
Joined: Jun 4th, '11, 10:10
Location: Leipzig, Germany

Re: WARNING!! Mageia LIVE appears to have wiped my hard driv

Postby shaney » May 23rd, '13, 00:02

Another logical suggestion but afraid that's not the problem.

Firstly, I plugged in the USB stick just after I downloaded the iso and it is always sdb (though of course that in itself doesn't rule out the possibility).
Secondly, Mageia WAS on the USB stick (in fact it was still on there til about an hour ago when I formatted the stick).

<EDIT>
Removed nonsense part of the post caused by hands being able to type faster than my brain can think :)
shaney
 
Posts: 8
Joined: May 19th, '13, 16:18


Return to Basic support

Who is online

Users browsing this forum: No registered users and 1 guest