[NCLUG] file system damage from dd with of=<a drive in my file system>

[Bob Proulx]

Stephen Warren wrote:
> To find out exactly which physical volumes contain (various parts of)
> your logical volumes, you can do a couple of things:
> 
> a) Run the command: "lvdisplay --maps".
>
> This will list all the LVs in your system, and for each, a list of
> segments showing where those segments are stored.

That will hopefully show that all of the data was on the first PV and
none of it was on the sdb PV.  Hopefully.

I will mention pvdisplay for completeness but you already displayed
the info using the vgdisplay command in your previous message.

  # pvdisplay

> You might be lucky; even though your VG includes PVs from both physical
> disks, unless your LV is large enough not to fit into the first PV, it's
> possible the second PV isn't used yet.

I am hoping this is a lucky incident and that none of the file system
data was pushed into the sdb PV.  In which case it can be removed and
no data will have been lost.

This apparently happens enough (I think ejecting complete disks from a
multidisk lvm composite) that there is a command specifically for this
task.  (I had to do this at a client site once this year already.)

  vgreduce --removemissing

That command will check to see if there was any live data stored on
the missing PV before removing the missing PV.  This is a good safety
check.  Hopefully in your case none was stored there and it will
report such and require the confirmation and then you will be okay.

After that operation the sdb device will not be associated as a
Physical Volume (PV) in the LVM Volume Group (VG) anymore.  Meaning
that you will then be free to either do something else to it or add it
back into the VG again.  Your choice at that time.  If you don't need
it in the VG for space I would be inclined to say simpler is better
and remove it entirely from the system to avoid this type of confusion
again in the future.  But after this I doubt you are likely to forget
about it now. :-)

If on the other hand there was data from a Logical Volume (LV) on the
missing Physical Volume (PV) then it will have been destroyed by the
dd overwriting that PV.  I doubt it will be possible to recover it by
any method other than prior backups of the LV.  Because the dd
overwrite will have overwritten too much.  Eventually you will be
forced to 'vgreduce --removemissing' forcefully (because it will warn
about the required data and require force to execute) and that will
force all LVs dependent upon that data to also be removed.  Which just
finishes the coffin because if that is the case then the data has
already been overwritten by the dd and was already gone.  Let's hope
that isn't the case for you.

Good luck!

Bob