extundelete on ext4 volume in RAID5 setup

[zenith]

Hi,

I accidentally deleted some stuff of my DS1511+ and I am now trying to recover it.

Found extundelete to be really helpful and I made some headway but then I got stuck:
I built extundelete on Ubuntu 10.10 and then I booted up my NAS using a USB live image, and proceeded with installing mdadm to use the RAID5.
I basically used this guide to get my system partition mounted: http://forum.synology.com/wiki/index.ph ... tibay_NASs
And this guide:
http://webcache.googleusercontent.com/s ... google.com

And then this to get my "volume1" RAID5 mounted as /dev/md/2: mdadm --assemble --scan

However, when running extundelete, it fails with a strange error:
root@ubuntu:/home/zenith/extundelete# ./src/extundelete /dev/md2 --restore-all
./src/extundelete: failed to read-only open device "/dev/md2": Error code 2133571395
It seems like this error code means: EXT2_ET_UNSUPP_FEATURE

Mount says this:
root@ubuntu:/home/zenith/extundelete# mount
aufs on / type aufs (rw)
none on /proc type proc (rw,noexec,nosuid,nodev)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
none on /dev type devtmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
/dev/sdb1 on /cdrom type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/loop0 on /rofs type squashfs (ro,noatime)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
gvfs-fuse-daemon on /home/ubuntu/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=ubuntu)
/dev/sdh4 on /media/d43a567b-78ab-4e40-8a2d-e3a94379ae87 type ext3 (rw,nosuid,nodev,uhelper=udisks)

(Booted off a 10.10 Live CD created on a USB stick)

cat /proc/mdstats has:
Personalities : [raid6] [raid5] [raid4] [raid1]
md2 : active raid5 sdc3[0] sdf3[4] sdg3[5] sde3[3] sdd3[1]
7795173120 blocks super 1.1 level 5, 64k chunk, algorithm 2 [5/5] [UUUUU]

md0 : active raid1 sdc1[0] sdg1[4] sdf1[3] sde1[2] sdd1[1]
2490176 blocks [5/5] [UUUUU]

unused devices: <none>

I am running DSM 3.0, unsure of which version, though. From running dumpe2fs I get this:
dumpe2fs 1.41.12 (17-May-2010)
Filesystem volume name: 1.41.10-1358

Does that mean that the filesystem var generated using e2fsprog from 1.41.10, DSM 3.0 rev1358?

Also, I see that md2 has these flags:
Filesystem features: has_journal ext_attr resize_inode filetype extent 64bit flex_bg sparse_super large_file huge_file uninit_bg dir_nlink extra_isize
It has 64bit, whereas md0 does not.

extundelete works on md0, but not md2:
root@ubuntu:/home/zenith/extundelete# sudo ./src/extundelete --journal --superblock /dev/md0
WARNING: Extended attributes are not restored.
Journal Super Block:
Signature: 0xc03b3998
Block type: Superblock version 2
Sequence Number: 0
Journal block size: 4096
Number of journal blocks: 16384
Journal block where the journal actually starts: 1
Sequence number of first transaction: 13890
Journal block of first transaction: 0
Error number: 0
Compatible Features: 0
Incompatible features: 1
Read only compatible features: 0
Journal UUID: 0x91b44588103f41a5bb7dd08d493b0903
Number of file systems using journal: 1
Location of superblock copy: 0
Max journal blocks per transaction: 0
Max file system blocks per transaction: 0
IDs of all file systems using the journal:
1. 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

root@ubuntu:/home/zenith/extundelete# sudo ./src/extundelete --journal --superblock /dev/md2
./src/extundelete: failed to read-only open device "/dev/md2": Error code 2133571395

It seems like e2fsprogs has done something that extundelete does not like/are not able to read.

Any suggestions besides pinging the extundelete author?

Cheers

[zenith]

More progress I think.

Have a friend who did some more digging, and it seems like Synology patched their version 1.41.10 of e2fsprogs to enable 64 bit support.

The Synology 1.41.10 version of e2fsprogs has patched this file: lib/ext2fs/ext2fs.h defines EXT2_LIB_FEATURE_INCOMPAT_SUPP to have EXT4_FEATURE_INCOMPAT_64BIT, usually this is not there, so that is why EXT2_ET_UNSUPP_FEATURE is returned, and extundelete fails.

So to use extundelete properly, I need to use a locally compiled version of 1.41.10 which has this modified header. I then need to run extundelete with LD_LIBRARY_PATH=. ./src/extundelete to use the locally modified lib in the folder, instead of the system one provided by my Ubuntu Live USB stick, which does not have this modification.
Alternatively, he suggested that I used the one on the NAS' system disk which already has these changes, so "LD_LIBRARY_PATH=syn_sys_disk/lib/ ./src/extundelete ...." - but this requires that the lib is not folded into busybox.

So, after much expert digging by my new bestest friend evah I might be close to being able to run extundelete on my RAID5

I will write a summarized version if all of this actually works

Any comments and/or suggestions are still more than welcome!

[maxxfi]

I sense that this '64bit' thing must be somehow connected with the custom Synology workaround for the 16TB volume limit...

[zenith]

Very, very likely.

I just wanted to give a heads up as to my troubles and woes, and ultimately, success(!?) so that others may have an easier time to do the same.

I am off in another 2-3 hours, and should be able to test this relatively quickly. Do you have the chance to see if /libt/e2fs* exists?

If not, I will build my own version from Synology's source code.

[pht]

Hi zenith (and everyone)
Last week, after a crappy handling, I just erased a huge bunch of data of my Synology NAS.
Since I persist in trying to recover data

I have already succeeded in remount my RAID on an another hardware Linux config.
Like magic, "mdadm" assembled the 6 HDD in SHR (RAID5 + 1 redundant disk) to form the existing device in the NAS /dev/dm-0
I even could mount this device and see the 6Tb volume and some directories (those I did not yet deleted...)
Then I launched "photorec" and manage to save plenty of file (...)
But, "photorec" is not convenient for large directories and can not recover filenames.

So I try to launch "extundelete" that return an error.
>extundelete /dev/dm-0 --restore-all
>extundelete: failed to read-only open device "/dev/dm-0": Error code 2133571395

And now, here I am !

As Synology has patched "e2fsprogs" to enable 64 bit support (and pass 16Tb limitation), I downloaded "synogpl-1747-x64" and "gcc420_glibc236_pineview" on Synology website, but I did not manage to compile "e2fsprogs" patched by Synology.

Multiples errors appear during «make» processing.
I'm far to compile "extundelete" with "e2fsprogs" Synology patch.

Someone could please tell me if a compiled version of "extundelete" for Synology
patch is existing somewhere or give me advice for compiling "e2fsprogs" from synology sources.
Thanks

[fluxmedia]

Has anyone got any further on this? I am in the same position and was going to try and build extundelete as an installer for everyone but alas, I am only a beginner.

Can anyone help?

I know you need the toolchain, extundelete and this from their website:
"To compile and install this program, you must first install the binary and development packages for e2fsprogs and e2fslibs"

[zenith]

Ugh - I'm really sorry guys - with some expert help I managed to cross-compile extundelete - but since then (2 years) I deleted the toolchain and the binary.

I think a ton of other people would already have setup the proper toolchain for building packages and so, so if we manage to get them to see this topic (or create a new topic with a request!) it should be fairly straightforward for them to build the executable.

[pht]

For my part, after several weeks trying to compile extundelete, i had managed to do it but when I executed it, it was still reporting errors unable reading...
After these unsuccessful attempts and at this point, I just forgot my datas and restarted with a brand new formated unit :-/
However, extundelete could be a very good tool for synology NAS users. If any linux experts could study the case and publish the executable built with the «Synology 64bit patch» of e2fsprogs, I think it would be very appreciated.