topic Re: INDEXF.SYS corrupted.. in Operating System - OpenVMS

INDEXF.SYS corrupted..

KW — Sun, 12 Nov 2006 17:20:02 GMT

Hi All,

Anyone encounter below error before? Tried the anal/disk/repair, no luck.. Need help..

PMAX01> dir /sec

Directory PMAX01$DKB200:[000000]

000000.DIR;1 file identification number check
BACKUP.SYS;1 file identification number check
BADBLK.SYS;1 file identification number check
BADLOG.SYS;1 file identification number check
BITMAP.SYS;1 file identification number check
CIM0.DIR;1 file identification number check
CIMCOMMON.DIR;1 file identification number check
CONTIN.SYS;1 file identification number check
CORIMG.SYS;1 file identification number check
INDEXF.SYS;1 file identification number check
JSS$V10.DIR;1 file identification number check
SECURITY.SYS;1 file identification number check
SYS0.DIR;1 file identification number check
SYSLOST.DIR;1 file identification number check
VOLSET.SYS;1 file identification number check

Total of 15 files.
PMAX01> anal/disk /repair pmax01$dkb200:
%ANALDISK-F-OPENINDEX, error opening INDEXF.SYS, RVN 1
-SYSTEM-W-FILENUMCHK, file identification number check

Re: INDEXF.SYS corrupted..

Hein van den Heuvel — Sun, 12 Nov 2006 18:48:33 GMT

- Sound like BAD corruption. Possibly a program with LOGIO priv overwriting the first few blocks of the disk.

- Since you can still do a dir/sec, I guess it is still mounted. This may help you find some data in in-memory structures, but not too likely.
I would $MOUNT/FOR and DUMP/BLO=COUN=10.
See if you can recognize the data at all.

- Dust of, or quickly aquire a "VMS File System Internals" book by Kirby McCoy ISBN 1-55558-056-4

- Go locate a recent backup, you are likely to need it. If lucky you will not need the actual data, just the basic layout. Restore the backup to a 'spare' disk and dump the first few blocks to see what they should look like.

Cluster 1, almost always starting at LBN 0 of the drive, starts with a boot block and a home block, followed by more homeblocks.
The homeblock (any homeblock copy), in the longword at offset 8 points to an alternate indexf.sys file header. This is potentially a key to volume recovery. You may be able to use that to reconstruct the real header... but I suspect the damage is bigger.

I'm sure there are folks out there who are willign to help you recover the data, for a fee.
Your main assignment now is to figure out how good your backup is, and to get an impression of the extent of the damage.

Good luck!
Hein van den Heuvel
HvdH Performance Consulting.

Re: INDEXF.SYS corrupted..

Jeroen Hartgers_3 — Tue, 14 Nov 2006 04:17:35 GMT

the tool DFU (from the freeware cd) can repair a lot more, and you get better messages about the problems.

Re: INDEXF.SYS corrupted..

Ian Miller. — Tue, 14 Nov 2006 04:56:10 GMT

Latest DFU is at

http://www.digiater.nl/dfu.html

However I think it may be time to test your recovery strategy,

Re: INDEXF.SYS corrupted..

Robert Gezelter — Tue, 14 Nov 2006 05:53:42 GMT

KW,

As has been noted, this can get VERY tricky, VERY VERY fast.

The First Step (and most important rule): DO NOT DO ANYTHING that will write to the disk. And I do mean ANYTHING. Do a SHOW DEV/FULL on the device and save all of the output.

The Second Step: Immediately copy any critically important files BEFORE dismounting the disk.

Third Step: Make a PHYSICAL backup of the drive. From this point on, treat the original drive as if it were evidence in a criminal case: Remove it from active use, and take steps to ensure that it is not accidentilly used.

Then restore the PHYSICAL backup that was taken to a scratch drive, and take a look at what data is in the HOME BLOCK (LBN 1) and the BOOT BLOCK (LBN 0). As I believe Hein mentioned, somebody with LOGIO probably overwrote the disk, it is important to identify how this was done to prevent a recurrence.

Then, it is a matter of recreating enough of the disk structure to attempt recovery of the files, if the data is still intact.

Having done this process during my career, it can be done, but it does take time. If the actual data is intact, and the damage does not extend too far, excellent results are possible, but there are no guarantees.

In terms of recovery, the most important question is: How valuable is the data, as compared to restoring the volume to a new disk from the most recent backup. In any event, I still strongly recommend identifying how this happened to prevent a repeated incident.

- Bob Gezelter, http://www.rlgsc.com

Re: INDEXF.SYS corrupted..

KW — Tue, 14 Nov 2006 06:41:35 GMT

All masters,

I never got the opportunity to try out all the useful steps, the production had put on pressure to receovery everything within few hours. I worked through the night, directly replaced a new disk and restore all the data from the backup tape - at least tested the backup and recovery steps works :)
"Possibly a program with LOGIO priv overwriting the first few blocks of the disk." This is very useful info, the next steps need to find out why this happended and how to present it. Any clue how to investicate this?

Re: INDEXF.SYS corrupted..

Volker Halle — Tue, 14 Nov 2006 06:53:00 GMT

KW,

without the data from the corrupted disk, which you could look at by dumping the blocks and trying to draw conclusions from the contents to guess about which application might have written that data, it won't be possible to make an educated guess at what might have happened.

You could still dig through .LOG files from the relevant period of time (minutes or hours before the problem has been first detected) to try to spot anything unusual.

Volker.

Re: INDEXF.SYS corrupted..

Robert Gezelter — Tue, 14 Nov 2006 07:29:29 GMT

KW,

From your followup posting "... directly replaced a new disk and restore all the data from the backup tape - ..."

If there is not a miscommunication here, and you retained the original corrupted disk unaltered, then it may be possible to identify what happened.

Please confirm that the original disk is preserved.

- Bob Gezelter, http://www.rlgsc.com