Ask Klaus!

Recovering Data on ReiserFS Partition

Question:

Hello Klaus: I am a regular reader of Linux Magazine, and I always find some interesting problems in the "Ask Klaus!" section. I consider myself "intermediate" when it comes to Linux. I also hope my English is understandable, because I am Swedish. You are probably my last hope of solving my problem.

A few days ago, I logged in (using ssh) to my "backup" PC and accidentally removed about 180GB of data with the command rm -r /folder1/ & instead of rm -r /folder1/folder2/ &. I call it my backup PC, but I also keep some things on it that need to be burned as backup. In my defense, I know I should be careful with rm -r, but I have been doing this for years now and nothing like this has happened before. I hope you understand what happened here.

The parent folder or most of the underlying folders got removed by the time I realized that the command was taking too long to execute and killed the process to prevent it from removing the rest of the underlying folders. The Linux version I am using is SUSE 10.3, and that hard drive is formatted as a ReiserFS partition.

I was using the same Linux version (SUSE 11.0) on my own PC, and I have tried to do the same thing there by copying some data onto a partition and using the same "bad" command. The idea was to recover the data there before trying the same thing on the backup PC with the lost 180GB. But the hard drive on my PC crashed (the famous click of death), and now I am not sure how to approach this.

So, my questions to you are: Is it possible to recover the removed 180GB of data and, if so, how? With what tools? Are there any free tools I can use? I would hate to buy some program that claims it can restore data from ReiserFS and then find out it could not do the job. I searched for info on Google and some Linux forums but found no solution to my problem. I also have read that ReiserFS and any other journaled partitions make it hard to restore data in some situations. This is not me trying to be an expert, but just what I have read on the Internet when searching for how to recover my accidentally removed data.

I hope you can help me with this as you are my last hope in trying to recover 180GB of lost data. I must also add that I have tried a couple of suggestions from the Internet [1] [2], but I didn't get my data back. Regards, Nik

Answer:

Things like rm -rf in the wrong folder or with a bad filename wildcard can happen, and actually it's worse on the graphical desktop when there is no way to interrupt the program quickly.

Depending on how "intelligently" the filesystem in question behaves, it might make sense to switch off the computer immediately with NO shutdown to prevent the file deletions from being executed and written back to disk. This is because Linux usually conducts filesystem changes in RAM first and writes them to disk only every now and then (in intervals between five and 30 seconds).

If file deletions have already been written back to disk, then the files are removed from the filesystem index, but the content is still there. Unless a program starts writing to "unused" disk space, chances are good that you can still recover the old content, but the name of the files can't be restored.

Some filesystems feature an "undelete" using the filesystem journal or some other means of rollback. But the majority of filesystems do not support this because of increased CPU- and disk-consuming overhead.

To recover a file, or rather its content, there is a utility called foremost, which is also present on most Live rescue systems. Foremost scans for some common file headers like pictures, videos, and some document formats. From each file type header found, Foremost deducts the file size. Then it creates a copy of what it THINKS is the correct content in a directory that should NOT be located on the same disk (to avoid physically overwriting old "deleted" content). Of course, this can only work for file types that have a searchable header. For others, like simple text files, Foremost has no way to know where the file starts and ends.

These must be recovered manually or, if their content is known, semi-automatically by scripts that search for known bytes at the beginning and end of the file in question. The command

foremost -o /media/disk -i /dev/sda2

will scan /dev/sda2 for known file types and recover them to a partition on an external disk mounted at /media/disk.

If you add option -a, foremost also searches for partly corrupted or overwritten files and tries to restore as much as possible, resulting in a LOT more output data. If you plan to use recovery or data reorganizing tools that modify the original partition, please create a backup image of the partition first. To save some space, you can do this with compression. For a filesystem holding the backups mounted at /media/disk, you will most likely need to use something that can hold files larger than 4GB, which is not possible with FAT32 [3]:

gzip -1c /dev/sda2 > /media/disk/sda2.img.gz

For restoring the backup, you can use:

gzip -dc /media/disk/sda2.img.gz > /dev/sda2

This is just an example. Please make sure that you specify the right partition.

Printers and VirtualBox

Question:

Dear Klaus: I am a complete newbie to Linux, but I am trying hard to find my way. I do have many years experience with the Windows operating system, currently with XP.

My first problem is my Canon Pixma MP 620 printer. I like it, and it works well with my Windows OS via a wireless router, but I am unable to get it to work with my Linux OS (on a second laptop) either wirelessly or through a USB connection.

The difficulty appears to be the lack of a driver. Canon told me they are unable to help, although they do have Linux drivers for other models of their printers. The local Linux community says they are sure someone has developed a driver for the MP 620, but I can't find one. Can you give me any help or direction? I would be most grateful.

My second problem relates to a Sun Microsystem VirtualBox, which I have loaded onto my Linux machine, and on the VB I have loaded Windows XP. Now I want to load Quicken onto Windows XP, but I don't know how to go about it.

I participated in an online seminar on virtual boxes, during which I was told that not only was it possible but that to do so was the whole purpose of virtual boxes, but they were not able to tell me how to go about it. I am at my wits' end, so I hope you can help me. Sincerely, Dennis Young

Answer:

It looks like your printer is supported by CUPS/Gutenprint 5.0.2 as "Pixma MP610," which is also the driver name in CUPS. Therefore, just installing the most current CUPS package with Gutenprint will allow you to add the printer through the web interface on your computer at http://localhost:631/ via the USB interface.

For configuring the printer in WLAN mode, you will most likely need to configure a "LPR/LPD" type of printer instead of a "USB printer," because this is what most network printers provide as network protocol.

It does not matter whether the printer is connected to a LAN or shared via WLAN through an access point; just make sure you know its network address (IP address) when adding it. The remaining steps - selecting the driver and paper type - will be the same as configuring a local USB printer with the CUPS software.

About your VirtualBox question: Once you get Windows running in VirtualBox, you should be able to install your Windows software (i.e., Quicken) normally using the same procedure that you would have used without VirtualBox. If the license key of your software was only valid for a special hardware configuration, you would need to order a new license key for the computer simulated by VirtualBox.

Most software running on Windows without VirtualBox should also run inside VirtualBox, because VirtualBox just simulates a complete computer. Thus, Windows should not even notice that Linux is running as the host system for VirtualBox. The installation steps are exactly the same as those you performed when first installing Quicken under Windows.

Big Windows on Small Screen

Question:

I'm having trouble on my Eee PC with some programs that have a window which exceeds the physical screen size. Because I cannot move them up more than grabbing and dragging the titlebar allows on the screen and the window is not resizable, I never reach the buttons on the lower part of the window.

Answer:

I understand the problem of having a small-sized screen. Luckily, almost every window manager in Linux supports the ability to grab a window at an arbitrary point (not only the title bar) by pressing the left Alt key on your keyboard while clicking inside the window and then moving the window around freely until you can reach the lower buttons. It's the only way to move the titlebar outside of the visible screen.

RAM Flush

Question:

Hello Klaus: Is it possible to tweak the way RAM is used by the OS? I noticed that Linux tends to flush the RAM very quickly. For example, when I open a program - say an OpenOffice document - it takes five seconds. If I close the document and reopen it immediately, it will take the same amount of time as the first time (five seconds).

To me, this indicates that the RAM is cleared immediately and that the second time I open the program everything has to be reloaded from the disk. Is it possible to tweak the way the information is cached so that the system will be more reactive when repeating the same operation multiple times? Thanks in advance. Francesco

Answer:

Usually, Linux uses all "unused" RAM as read cache for programs and documents. Especially when reading from and writing to block devices such as hard disks, the RAM cache can exceed the size of memory used for running programs, so the program free will tell you that there is no more "free memory" after a while, simply because of the RAM cache.

Output of free on my Eee PC (2GB of RAM) is shown in Listing 1. The line relevant for actively used RAM is the one prefixed with -/+ buffers/cache, which shows that really only 386MB are in use, whereas the first line shows that 1GB of data originally read from the flash disk is now cached in RAM.

01 knopper@eeepc:~$ free
02              total       used       free     shared    buffers     cached
03 Mem:       2065312    1506448     558864          0      21468    1098928
04 -/+ buffers/cache:     386052    1679260
05 Swap:            0          0          0

This can be especially obvious when you start a large program like OpenOffice for the second time. Although it takes about 20 seconds to load the program from flash disk or hard disk, if you quit OpenOffice and start it again immediately, it needs only two seconds to reach the main window, a speed gain of a factor of 10.

Now, the reason for documents or, in general, data from disk to load slowly can be a forced "forget" of the RAM cache. Certain system calls in Linux allow a program explicitly to avoid caching, which does make sense in some cases, such as for videos that should not clutter the RAM cache when played just once. Also, you can enforce synchronous access for some filesystems (usually for writing) by adding the sync mount option.

Some distributions might choose sync as the default mount option because it ensures that on each write, data are written immediately instead of being stored in a RAM cache until the file is really closed or a system sync occurs.

This might be useful for users who tend to unplug flash disks without remembering to unmount them first. Please check your mount options for sync.

Of course, some kernel options also can influence the way the RAM cache works. Each option relates to a file in /proc, so you can set the value contained by using sysctl or just echoing to the file in /proc, as you choose (Table 1).

Adriane and Knoppix on Flash

Question:

Hello Mr. Klaus Knopper: In the May 2009 issue of Linux Pro Magazine, I received a DVD disc with Knoppix 6.1. I installed it on a 4GB flash drive, which I boot on my Toshiba laptop. I would like to compliment you on your outstanding Linux distro. Your choice of programs are amazing - everything I need is there. I am 87 years old, and I find myself using Adriane as well, for which I want to thank you.

What website can I visit to see all the commands for using Adriane in English? How can I make the flash drive persistent with Knoppix 6.1?

I copied Knoppix 6.1 to a 4GB flash drive and have about 800MB free. When I boot from it, a screen opens requesting that I input a number for files or leave it blank. I put in 700MB and continued with the booting. I eventually logged out and did not save anything to the flash drive.

The next time I tried to boot from the drive, it failed to boot - I reformatted the flash drive, copied Knoppix 6.1 to it, booted it, and it loaded correctly. What is the solution for this problem? Many, many thanks for your help. Edward Wozniak

Answer:

Thanks for testing Adriane; the fact that you felt comfortable with the menu system assures me that we are on the right track toward creating an easy-to-use, accessible system, and we rely on your feedback to improve the system to make it even better. :-)

About your questions:

1. Adriane documentation: This has always been a weak point because Adriane consists, apart from the menus, of many programs - such as ELinks, Mutt, and Nano - each with its own configuration. Therefore, documenting Adriane means also documenting about 10 different programs, each with its own set of hotkeys.

For the web browser ELinks, you will find an overview of hotkeys and configuration options by pressing the F9 key while working inside the browser. The editor Nano has some help in its menu, and Mutt features a help command by pressing the ? key.

For the screenreader, you can find a comprehensive overview, which is also the main keyboard configuration file, in the text file /etc/sbl/keymap/keyboard.map (sbl 3.5 in Knoppix 6.2; in earlier versions, this was /usr/lib/suse-blinux/keymap/keyboard.map). This shows the active hotkeys for speech synthesis, speed, voice, and languages, as well as navigation.

Of course, I would be happy to receive some documentation contributions, because our development priority is more toward improving and extending the software than documentation. Currently, we have no real handbook or manual for the complete system.

A long-term goal for Adriane is having several vendors and user groups provide installation support and training for the system, not just printed or electronic documentation that would still require spending time for self-support and research.

2. Persistent image: This feature exists starting from Knoppix 6.0, and it will be called automatically once you start Knoppix from a writable medium that has more than 200MB of free space. At boot time, or alternatively from the Adriane settings menu, you will be asked if you would like to add a file for persistent storage of settings, additional programs, or personal data, and you can enter a number between 200 and (for FAT32-formatted USB flash disks) up to 4000 for such a persistent file.

Please do NOT enter MB in this field, just the numbers that indicate the desired number of megabytes to be allocated for this purpose. If you enter anything other than a number, the option will be ignored silently. Your machine will continue to boot normally without persistent storage, and it will probably occur so fast that you will not even be able to see the error message about wrong input or lack of sufficient space. Remember that at least 200MB of free space must be available.

I don't know what happened when you entered a wrong number (you might have added MB after the number, which should be left out), but maybe the failure to boot after not creating the persistent image was just by chance (BIOS boot menu, USB flash disk not recognized fast enough by the BIOS, or similar).

Usually, the boot system does not break unless it's really formatted or changed manually. I have seen some USB flash drives that you have to pull out and reinsert after reboot for them to be recognized as bootable media by the BIOS again.

File initrd Not Found

Question:

Hi Klaus: I would like to install Knoppix on a 16GB USB formatted as Ext3. I am working from Knoppix Live DVD 5.1.1, which came with the magazine. I ran the knoppix-installer script found on the DVD, which ran okay, except at the very end, when two messages came up that said something like: cannot find file: initrd. I looked on the DVD, and that file is not there.

Please tell me what to do next or do differently. Please keep writing. Thanks, Harvey Nice

Answer:

I would recommend trying with version 6.2, which does not require an initial ramdisk. But in any case, for USB media, please add the following option to GRUB's configuration file /boot/grub/menu.lst in the KERNEL section:

rootwait

This delays mounting the USB hard disk until the USB device becomes available.

To see whether the kernel has found the right device, also change the quiet option to debug, so you will see the full error message if mounting the root partition fails.

You might need to exchange /dev/sdc1 with /dev/sdb1 (both in /boot/grub/menu.lst and /etc/fstab) to get the correct device mounted. Ext3 is compiled statically into the kernel, so the initrd line of GRUB's config is really unnecessary.

"3" Mobile Broadband Stick

Question:

Dear Klaus: I have a netbook installed with Linux Ubuntu version 8.04 that was issued in April 2008. I have been unsuccessful so far in getting online with a "3" mobile broadband USB stick, whether using a 3GB or 12GB version from the "3" Starter Pack versions.

On my other computers, which are Windows PCs, there is no problem with Internet connection using the mobile broadband stick and installed SIM card. I bought the computer with Linux Ubuntu mainly as an experiment to see how Linux worked.

Are you able to help me with some advice on how to connect to the Internet using Linux Ubuntu with this mobile broadband system? Frederick Lloyd

Answer:

Most mobile broadband USB sticks just work like a regular modem, so it's more a matter of determining which modem commands to send to them than of finding a "driver" for a specific USB stick - they all work with the standard Linux USB serial driver.

In Linux Magazine issue 111 (February 2010), I gave a more detailed answer to your question [4]. Figure 1 shows an example of how to configure a USB mobile broadband modem with the NetworkManager utility.

Figure 1: Configure a USB modem with NetworkManager.

You will need to find the correct APN name for your Internet provider. If, as you said, you have already configured Windows to use the modem and it works successfully, the APN name should be present somewhere in the Windows configuration.

A GPRS/UMTS-capable cellphone with the SIM card inserted and connected to the computer by Bluetooth or a USB cable should do the same job that the USB broadband modem does, in the unlikely event that the USB modem is really not correctly recognized by the system.

DVD Will Not Boot

Question:

I recently downloaded Knoppix 6.2 then burned it to DVD. But it will not boot. I downloaded it again three more times, but none will boot. Can you give me any suggestions? Need help badly.

Horace O'Hare

Answer:

Please make sure that the program you use to burn your DVD does not add a file to a DVD, which would mean that it rebuilds a .iso image containing a single file, rather than burning the .iso file directly to the DVD. The .iso file of Knoppix is already bootable; you don't need to take special precautions.

But please, after downloading it, check the file size and the MD5sum of the images.

You cannot write files larger than 4GB to a FAT32 filesystem [3], which is one source of possible problems.

The md5sum or sha1 files that come with the Knoppix ISOs can be checked with the command

md5sum -c *.iso.md5

or

sha1sum -c *.iso.sha1

to see whether the calculated checksum matches that of the corresponding .iso file.

Check: If you look at the contents of the already-burned DVD, you should at least see a folder named boot and a folder named KNOPPIX, both containing several files or directories and subdirectories. If this is true, the DVD should also boot fine. On the other hand, if the only file you see on the DVD is the file that you downloaded, your burning program has just ruined another recordable medium instead of writing the bootable ISO image to it.

With GNU/Linux, I usually use

cdrecord -v dev=/dev/scd0 -pad -dao DVD-image.iso

or

growisofs -Z /dev/scd0=DVD-image.iso

to burn .iso files to DVD.