my server - a haunted place?

[michaelz71]

Hello all,

yesterday I found my dedicated server offline and after bringing it up in recovery mode (network boot at my provider) the partition tables of both harddrives are missing.

Does anyone have any idea how such s*** can happen?

It is for sure that I did not do anything to change partitions or filesystems, I am the only one to have regular access via ssh with 2048 bit keys and the smart logs of the drives do not show any errors at all.

So why could partition tables of 2 independently mounted drives vanish suddenly?

Any ideas?

Kind regards
Michael

[atreyu]

Hello and welcome!

So is this machine remote? Does anyone have local access to the system?

The first thing I'd do is go through /var/log/messages (or /var/log/syslog, or wherever your distro puts your kernel messages log file). Look for login attempts from ip addresses you do not recognize.

Also look through the output of "ps auxww" for processes that you do not recognize or understand.

You can also run a root-kit detection program, like rkhunter. It is likely already packaged for your distro and would be an easy command to install ("yum install rkhunter", "sudo apt-get install rkhunter", etc.).

[michaelz71]

Hello atreyu,

yes it is a remote dedicated server and there is no one (I really trust) there to login locally.
I am logged in via network boot and have access to the harddisks.
The partition tables of both disks are empty, so there is no filesystem and no log anymore.
Any idea if there is recovery software for linux, which can scan the drives for files?

Regards
Michael

[atreyu]

yes it is a remote dedicated server and there is no one (I really trust) there to login locally.

That's not what I meant. What I meant was, "Could anybody have logged into the machine locally, whether you trust them or no?"

I am logged in via network boot and have access to the harddisks.
The partition tables of both disks are empty, so there is no filesystem and no log anymore.

There is a log file on the Linux system that you are logged into, that is the log I mean. What is your distro?

Any idea if there is recovery software for linux, which can scan the drives for files?

There are many, to name a few:

TestDisk

PhotoRec

ddrescue

These are all available on the SystemRescueCD but you should be able to find packages for your distro.