Recovering a MySQL database from a corrupted ext3 filesystem

[Irazmus]

Last week one of our servers decided to delete the entirety of /var, including all it's logs and our helpdesk's MySQL database. To make matters worse, although the backups live on a separate machine, they also appear to be missing /var and are thus useless.

I have tried a few different recovery utilities in an attempt to recover the database, the most successful being photorec [http://www.cgsecurity.org/wiki/PhotoRec], which has recovered 200+ frm (table definition) and MYI (MYISAM compressed data) files, but none of the MYD files which actually hold the data (it seems PhotoRec doesn't support recovering MYDs [http://www.cgsecurity.org/wiki/File_...ed_By_PhotoRec]).

Can anyone please point me to a tool/method for recovering MYD's from a corrupt ext3 filesystem. Assuming that's possible, a method of linking the MYD to it's appropriate frm and MYI (since the recovered files have random file names) would also be appreciated.



*Next task, review the backup verification procedure.

[Irazmus]

Does anyone have any ideas?

[Irazmus]

Thanks for the info.
We've managed to recover most of the database using the above link, the one table we couldn't recover held the helpdesk tickets, which we've (mostly) reconstructed using the helpdesk's e-Mail notifications.
I think it's safe to say we were lucky this time.

[techzilla]

this has got to be one of the worst things to have happen,

catastrophic data loss!!!!

god i'm going to be skinned alive, if I can't come up with something.
photorec does only do .frm and .MYI but not the important .MYD.

is there anything i can do?

[nathanfriend]

techzilla, what file system are you using?

[z80]

Thanks for the info.
We've managed to recover most of the database using the above link, the one table we couldn't recover held the helpdesk tickets, which we've (mostly) reconstructed using the helpdesk's e-Mail notifications.
I think it's safe to say we were lucky this time.

Hello - I'm in a similar position (needing to recover .myd files). Can you let me know the process you used?

thanks.

[Irazmus]

Unfortunately I can't remember the exact process (and it didn't get logged since it was the helpdesk database we were trying to recover), but I'm sure it was ext3grep which saved my skin.
There was more info in this thread but it seems to have gone AWOL, however the most important item was a link to the ext3grep documentation, which I believe can be found here: HOWTO undelete removed files and directories on an ext3 file system

That's assuming you're using an Ext3 file system as I was, if you're using a different file system you'll probably need to look for other tools. For recovering files from NTFS volumes I've found ntfsundelete to be useful. I've not (yet) had need to recover from any other file systems so can't advise if you're using a file system other than those two.
And in case it wasn't obvious, both those recovery operations were performed in Linux (Debian 5.0.8 to be exact).

As mentioned above, we didn't manage to recover every MYD file, we lost the printers and tracking tables, but we did manage to recover most of them.

I wish you luck in your recovery efforts. Let us know how you get on.