User Tools

Site Tools


data_recovery

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
data_recovery [2018/08/22 17:02]
peek [Data Recovery]
data_recovery [2018/08/22 17:22] (current)
peek
Line 26: Line 26:
 ====== Data Recovery ====== ====== Data Recovery ======
  
-If the hardware is suspect, then the first thing to do is get a byte-for-byte copy of the drive's contents into a disk image file.  The less time spent using possibly faulty hardware the better.+If the hardware is suspect, then the first thing to do is get a byte-for-byte copy of the drive's contents into a disk image file.  The less time spent using possibly faulty hardware the better.  For this, use ''ddrescue'' instead of ''dd'', as ''ddrescue'' will repeatedly try to recover from errors as it tried to salvage data, whereas dd will simply fail.
  
-<code>ddrescue -A -f /dev/sd<X> broken.img</code>+<code> 
 +apt-get install gddrescue 
 +ddrescue -A -f /dev/sd<X> broken.img 
 +</code>
  
 This copy will remain unchanged while we work.  Make a copy of this file, and only alter the copy.  This way, if anything goes awry then we can go back to square one without having to rely on possibly faulty hardware again. This copy will remain unchanged while we work.  Make a copy of this file, and only alter the copy.  This way, if anything goes awry then we can go back to square one without having to rely on possibly faulty hardware again.
Line 36: Line 39:
 Use testdisk to search for and repair disk partitions. Use testdisk to search for and repair disk partitions.
  
-<code>testdisk work.img</code>+<code> 
 +apt-get install testdisk 
 +testdisk work.img 
 +</code>
  
 Using testdisk involves using the arrow, escape, and enter keys. Using testdisk involves using the arrow, escape, and enter keys.
Line 91: Line 97:
   - Attempt to fix the partition:\\ <code>fsck -y /dev/loop0 2>&1 | tee fsck.log</code>\\    - Attempt to fix the partition:\\ <code>fsck -y /dev/loop0 2>&1 | tee fsck.log</code>\\ 
   - Mount the fixed partition read-only:\\ <code>mount -o ro /dev/loop0 /mnt</code>\\    - Mount the fixed partition read-only:\\ <code>mount -o ro /dev/loop0 /mnt</code>\\ 
-  - Copy files into 'RECOVERY/RECOVERED'':\\ <code>cd RECOVERY/RECOVERED ; (cd / && tar -cvf - mnt) | tar -xvBpf - 2>&1 | tee ../tar.log</code>\\ +  - Copy files into ''RECOVERY/RECOVERED'':\\ <code>cd RECOVERY/RECOVERED ; (cd / && tar -cvf - mnt) | tar -xvBpf - 2>&1 | tee ../tar.log</code>\\ 
   - Optional: Get a list of files for which tar failed:\\ <code>grep ^tar: ../tar.log</code>\\    - Optional: Get a list of files for which tar failed:\\ <code>grep ^tar: ../tar.log</code>\\ 
   - Optional: Find a list of files of size 0 bytes:\\ <code>find . -size 0 -ls 2>&1 | tee ../zero-size.log</code>\\    - Optional: Find a list of files of size 0 bytes:\\ <code>find . -size 0 -ls 2>&1 | tee ../zero-size.log</code>\\ 
Line 97: Line 103:
   - Detach the loopback file:\\ <code>losetup -d /dev/loop0</code>\\    - Detach the loopback file:\\ <code>losetup -d /dev/loop0</code>\\ 
  
-Final contents of ''RECOVERY/'' directory:+Final contents of ''RECOVERY'' directory:
   * ''RECOVERY/DELETED'' -- Files recovered that the filesystem previously thought had been deleted.   * ''RECOVERY/DELETED'' -- Files recovered that the filesystem previously thought had been deleted.
   * ''RECOVERY/RECOVERED'' -- Files that could be copies off of the disk image.  Some files may be corrupt though.   * ''RECOVERY/RECOVERED'' -- Files that could be copies off of the disk image.  Some files may be corrupt though.
data_recovery.1534957369.txt.gz · Last modified: 2018/08/22 17:02 by peek