HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

INDEXF.SYS corrupted..

 
SOLVED
Go to solution
KW
Occasional Contributor

INDEXF.SYS corrupted..

Hi All,


Anyone encounter below error before? Tried the anal/disk/repair, no luck.. Need help..


PMAX01> dir /sec

Directory PMAX01$DKB200:[000000]

000000.DIR;1 file identification number check
BACKUP.SYS;1 file identification number check
BADBLK.SYS;1 file identification number check
BADLOG.SYS;1 file identification number check
BITMAP.SYS;1 file identification number check
CIM0.DIR;1 file identification number check
CIMCOMMON.DIR;1 file identification number check
CONTIN.SYS;1 file identification number check
CORIMG.SYS;1 file identification number check
INDEXF.SYS;1 file identification number check
JSS$V10.DIR;1 file identification number check
SECURITY.SYS;1 file identification number check
SYS0.DIR;1 file identification number check
SYSLOST.DIR;1 file identification number check
VOLSET.SYS;1 file identification number check

Total of 15 files.
PMAX01> anal/disk /repair pmax01$dkb200:
%ANALDISK-F-OPENINDEX, error opening INDEXF.SYS, RVN 1
-SYSTEM-W-FILENUMCHK, file identification number check
7 REPLIES
Hein van den Heuvel
Honored Contributor
Solution

Re: INDEXF.SYS corrupted..

- Sound like BAD corruption. Possibly a program with LOGIO priv overwriting the first few blocks of the disk.

- Since you can still do a dir/sec, I guess it is still mounted. This may help you find some data in in-memory structures, but not too likely.
I would $MOUNT/FOR and DUMP/BLO=COUN=10.
See if you can recognize the data at all.


- Dust of, or quickly aquire a "VMS File System Internals" book by Kirby McCoy ISBN 1-55558-056-4

- Go locate a recent backup, you are likely to need it. If lucky you will not need the actual data, just the basic layout. Restore the backup to a 'spare' disk and dump the first few blocks to see what they should look like.

Cluster 1, almost always starting at LBN 0 of the drive, starts with a boot block and a home block, followed by more homeblocks.
The homeblock (any homeblock copy), in the longword at offset 8 points to an alternate indexf.sys file header. This is potentially a key to volume recovery. You may be able to use that to reconstruct the real header... but I suspect the damage is bigger.

I'm sure there are folks out there who are willign to help you recover the data, for a fee.
Your main assignment now is to figure out how good your backup is, and to get an impression of the extent of the damage.

Good luck!
Hein van den Heuvel
HvdH Performance Consulting.

Jeroen Hartgers_3
Frequent Advisor

Re: INDEXF.SYS corrupted..

the tool DFU (from the freeware cd) can repair a lot more, and you get better messages about the problems.
Ian Miller.
Honored Contributor

Re: INDEXF.SYS corrupted..

Latest DFU is at

http://www.digiater.nl/dfu.html

However I think it may be time to test your recovery strategy,
____________________
Purely Personal Opinion
Robert Gezelter
Honored Contributor

Re: INDEXF.SYS corrupted..

KW,

As has been noted, this can get VERY tricky, VERY VERY fast.

The First Step (and most important rule): DO NOT DO ANYTHING that will write to the disk. And I do mean ANYTHING. Do a SHOW DEV/FULL on the device and save all of the output.

The Second Step: Immediately copy any critically important files BEFORE dismounting the disk.

Third Step: Make a PHYSICAL backup of the drive. From this point on, treat the original drive as if it were evidence in a criminal case: Remove it from active use, and take steps to ensure that it is not accidentilly used.

Then restore the PHYSICAL backup that was taken to a scratch drive, and take a look at what data is in the HOME BLOCK (LBN 1) and the BOOT BLOCK (LBN 0). As I believe Hein mentioned, somebody with LOGIO probably overwrote the disk, it is important to identify how this was done to prevent a recurrence.

Then, it is a matter of recreating enough of the disk structure to attempt recovery of the files, if the data is still intact.

Having done this process during my career, it can be done, but it does take time. If the actual data is intact, and the damage does not extend too far, excellent results are possible, but there are no guarantees.

In terms of recovery, the most important question is: How valuable is the data, as compared to restoring the volume to a new disk from the most recent backup. In any event, I still strongly recommend identifying how this happened to prevent a repeated incident.

- Bob Gezelter, http://www.rlgsc.com
KW
Occasional Contributor

Re: INDEXF.SYS corrupted..

All masters,

I never got the opportunity to try out all the useful steps, the production had put on pressure to receovery everything within few hours. I worked through the night, directly replaced a new disk and restore all the data from the backup tape - at least tested the backup and recovery steps works :)
"Possibly a program with LOGIO priv overwriting the first few blocks of the disk." This is very useful info, the next steps need to find out why this happended and how to present it. Any clue how to investicate this?

Volker Halle
Honored Contributor

Re: INDEXF.SYS corrupted..

KW,

without the data from the corrupted disk, which you could look at by dumping the blocks and trying to draw conclusions from the contents to guess about which application might have written that data, it won't be possible to make an educated guess at what might have happened.

You could still dig through .LOG files from the relevant period of time (minutes or hours before the problem has been first detected) to try to spot anything unusual.

Volker.
Robert Gezelter
Honored Contributor

Re: INDEXF.SYS corrupted..

KW,

From your followup posting "... directly replaced a new disk and restore all the data from the backup tape - ..."

If there is not a miscommunication here, and you retained the original corrupted disk unaltered, then it may be possible to identify what happened.

Please confirm that the original disk is preserved.

- Bob Gezelter, http://www.rlgsc.com