[gentoo-user] Recovering MySQL Database from EXT4 Formatted Hard Disk ...

Christopher Kurtis Koeber

unread,

Feb 7, 2012, 6:40:02 PM2/7/12

to

Hello,

I am trying to recover MySQL databases (which were properly shut down)
from an EXT4 formatted hard disk. I loaded the SystemRescueCD distro
that you can get online and when running TestDisk I can see the
partitions but I cannot recover said partitions because it tells me the
structure is bad (any options here, by the way?)

With PhotoRec, I can recover parts of the MySQL Database but I cannot
get the important *.MYD files because I guess PhotoRec doesn't have the
signatures for that type of file.

So, any options I have at this point?

Thank you for your time.

Michael Mol

unread,

Feb 8, 2012, 6:10:02 AM2/8/12

to

On Tue, Feb 7, 2012 at 6:28 PM, Christopher Kurtis Koeber
<cko...@gmail.com> wrote:
> Hello,
>
> I am trying to recover MySQL databases (which were properly shut down) from
> an EXT4 formatted hard disk.

What happened to require the recovery? Which parts of the database
server shut down properly, and which didn't?

> I loaded the SystemRescueCD distro that you can
> get online and when running TestDisk I can see the partitions but I cannot
> recover said partitions because it tells me the structure is bad (any
> options here, by the way?)

What kind of partition table was it?

>
> With PhotoRec, I can recover parts of the MySQL Database but I cannot get
> the important *.MYD files because I guess PhotoRec doesn't have the
> signatures for that type of file.
>
> So, any options I have at this point?

Probably.

>
> Thank you for your time.
>

--
:wq

Hinnerk van Bruinehsen

unread,

Feb 8, 2012, 6:40:02 AM2/8/12

to

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You could try Autopsy & sleuthkit[1].
Before you do anything to the drive it would be wise to copy it via dd
so that no accidental write makes anythoing worse...

[1] http://www.sleuthkit.org/autopsy/desc.php

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPMl2WAAoJEJwwOFaNFkYcOx8IALYF9e7/HkxpZtbMzpZUkb7x
UNMDkTcZdcQi0mlJqL6Al97nHpgPkm2tZyInFgNdWVEu1qIafxtLEcIrbzFgP4yX
iuxsFRFHIY10NcU/3PcHvgtUBdyOoHQqztzwxW1nJ8zpqqyc9U3p/xAam72kHrb0
90ip0sQnj+wdxnpzLbBdws4AMUYV3IUAo0vaOOMCdqPKQL7NE+HUCMUBgfXXCYX4
fVBukukMBKnKgECKI7BlZRvfuINJ19d3RG75bIzm3xIspwfIy3OxvO64nSco/Dkl
yswGa/258cNC/Q6RaypDaWBRVh1R928/2qSJl6hOaxa/UQDXen1SKLJ46VZ8ZmE=
=vIdQ
-----END PGP SIGNATURE-----

Neil Bothwick

unread,

Feb 8, 2012, 6:40:02 AM2/8/12

to

On Tue, 07 Feb 2012 18:28:50 -0500, Christopher Kurtis Koeber wrote:

> With PhotoRec, I can recover parts of the MySQL Database but I cannot
> get the important *.MYD files because I guess PhotoRec doesn't have the
> signatures for that type of file.

AFAIR Photorec will recover any type of file ans it just follows block
pointers. However, files it does not recognise are given meaningless
names, so you would have to trawl through all the files it recovered
looking for some indication that they are the files you need.

--
Neil Bothwick

If we aren't supposed to eat animals, why are they made of meat?

signature.asc

Mick

unread,

Feb 8, 2012, 4:40:01 PM2/8/12

to

On Wednesday 08 Feb 2012 11:33:42 Hinnerk van Bruinehsen wrote:
> On 08.02.2012 12:02, Michael Mol wrote:
> > On Tue, Feb 7, 2012 at 6:28 PM, Christopher Kurtis Koeber
> >
> > <cko...@gmail.com> wrote:
> >> Hello,
> >>
> >> I am trying to recover MySQL databases (which were properly shut
> >> down) from an EXT4 formatted hard disk.
> >
> > What happened to require the recovery? Which parts of the database
> > server shut down properly, and which didn't?
> >
> >> I loaded the SystemRescueCD distro that you can get online and
> >> when running TestDisk I can see the partitions but I cannot
> >> recover said partitions because it tells me the structure is bad
> >> (any options here, by the way?)

> You could try Autopsy & sleuthkit[1].
> Before you do anything to the drive it would be wise to copy it via dd
> so that no accidental write makes anythoing worse...
>
>
>
> [1] http://www.sleuthkit.org/autopsy/desc.php

Definitely create an image of the partition first, rather than keep accessing
the real thing. At this moment you don't know what caused the corruption - it
could well be a warning of worse things to come as far as this drive is
concerned ... ;-)

It is much better if you create the image with dd-rescue/ddrescue (can't
recall which of the two packages is claimed to be better). You may also want
to make a backup copy of the image in case you embark on any destructive
operations on it.

Multiple passes with ddrescue may recover more bits/bytes so hopefully you'll
have a more complete set of data to work with.

> >> With PhotoRec, I can recover parts of the MySQL Database but I
> >> cannot get the important *.MYD files because I guess PhotoRec
> >> doesn't have the signatures for that type of file.
> >>
> >> So, any options I have at this point?

You can use dd or hexdump to pick up some blocks at the start of a known good
*.MYD file, create a signature for PhotoRec and add it on the list of files to
check for.

See the instruction of how to go about this here:

http://www.cgsecurity.org/wiki/Add_your_own_extension_to_PhotoRec
--
Regards,
Mick

signature.asc

Christopher Koeber

unread,

Feb 29, 2012, 5:20:01 PM2/29/12

to

Never had a chance to reply back but this was very helpful.

Now to search online to see if people created signatures for "IBD" files (where the actual data for a MySQL database lives) as the headers are different for every sample "IBD" I tried from working databases.

Regards,
Christopher Koeber