On 08/21/2016 03:11 PM, J.M. Porup wrote:
> On Sat, Aug 20, 2016 at 07:05:10PM -0400, Chris Laprise wrote:
>>> * Download the Equation Group files from Mega to report on them
>>> * qvm-copy-to-vm --> new fedora 23 based appvm
>>> * open terminal in new vm, files are there
>>> * shutdown, reboot--files are gone
>> One avenue to investigate is to reproduce the problem and then see if
>> another vm can manually mount that filesystem and access the files:
>>
>> 1. Start the appvm in question ("VM1") - private data files do not appear
>> 2. Pause VM1
>> 3. Start a testing appvm ("VM2").
>> 4. Use qvm-block in dom0:
>> $ qvm-block -A --ro VM2 dom0:/var/lib/qubes/appvms/VM1/private.img
>> 5. In VM2, run:
>> $ mkdir data
>> $ sudo mount /dev/xvdi data
>> $ ls data/home/user
>> 6. Look for your data files
>>
> Thanks for this suggestion. I tried last night, but mounting
> /dev/xvdi gave me a fs/superblock error, and non-useful output in dmesg.
> I tried again this morning, and was able to mount /dev/xvdd (not xvdi,
> although that probably doesn't make a difference).
For that test, you are definitely interested in xvdi not xvdd.
> Taking a good look around the 4.1.24-10.pvops.qubes.x86_64/ dir, but not
> finding anything that looks like a home directory, much less my files.
> I'm probably doing something wrong.
>
> Perhaps related: Last week my .bash_history disappeared in dom0,
> replaced, bizarrely, by the attached text. Difficult to avoid the
> suspicion this is someone trolling.
>
> jmp
The error you got does indicate the vm filesystem got corrupted--and
that is probably because your dom0 root filesystem was corrupted,
considering what happened to your dom0 .bash_history. I would say the
level of corruption, which resembles file cross-linking errors, is great
enough to consider dom0 isolation to be degraded and the OS damaged in
general.
The best course of action would be to start with Andrew's suggestion:
Most recent laptops have disk and memory tests built into the firmware,
accessible from the power-on screen. On completion you should see a
short assessment as to whether your memory and drive are healthy or not.
You could also use 'smartctl -a' on your drive to look for specific
failure indicators.
After addressing any hardware problems (such as replacing RAM modules or
SSD), I suggest reinstalling Qubes and restoring from your backups. You
may wish to first try backing up what's left of your current data before
reinstalling and restoring from an older backup, in case you want to try
recovering your most recent data later on.
If you have specific questions I'd be happy to try answering them for you.
Chris