Disk Recovery
Recovering data from failed Hard Drives
Contents
fsck
Top BottomUse fsck to check and repair Linux filesystems. Filesystems can be specified by partition name (e.g. /dev/hda1, /dev/sdb2) or mount point (e.g. /, /home). fsck without options will check filesystems in order as listed in /etc/fstab. Options to fsck:
- -s
- run fsck on filesystems in serial order, that is, one by one
- -t fslist
- Specify a comma seperated list of filesystems types and options specifiers to check. For instance to check read-only ext4 filesystems use: fsck -t ext4,opts=ro
- -A
- check filesystems in /etc/fstab in one run. If the sixth field in fstab (fs_passno) is set to zero for an fstab entry, that filesystem will not be checked. Otherwise filesystems will be checked in order of fs_passno (lowest numbers first. Runs checks in parallel unless -s specified.
- -R
- Skip root partition if -A is specified
- -N
- Do not execute just show what would be done
- -V
- Verbose output
- -a
- Automatically repair filesystem - maps to e2fsck's -p option
- -n
- Do not repair, simply report. On reiserfs does not even report.
- -r
- Interactively repair the filesystem
- -y
- automatically attempt to fix detected filesystem corruptions
mkfs
Top BottomUse mkfs to build a Linux file system on a device. Options:
- -V
- Verbose output
- -t fstype
- Specify the type of filesystem. Types of filesystems supported will
correspond to the mkfs.* executables installed on the system (usually in sbin).
Use
find / -name mkfs.* -print 2> /dev/null
to list available file system types - -c
- Check for bad blocks before building the filesystem
mke2fs
Top BottomUse mke2fs to build a Linux file system on a device. Options:
- -S
- Use this option to rewrite superblocks and group descriptors only. Useful if all the superblocks on a disk have become corrupted. The correct filesystem blocksize must also be specified for this option to work. Run e2fsck immeadiately afterwards - no guarantees that this any data will be salvaged this way.
- -b blocksize
- Specify the blocksize.
- -n
- Cause mke2fs to take no action: only display what it would do. Useful for listing superblock locations
fdisk
Top BottomUse:
fdisk -l /dev/sda
to list the partitions on the first SCSI/SATA disk on a system
Create a EXT3 Partition
Top BottomCreate the Partition Table, add a partition and format it
fdisk /dev/sdb o # create an empty dos partition table n # create a partition p # make it a primary partition t # set type for partition 83 # set type to Linux w # write changes and exit mkfs -t ext3 -c /dev/sdb1
Create a FAT32 Partition
Top BottomCreate the Partition Table, add a FAT32 partition and format it
fdisk /dev/sdb o # create an empty dos partition table n # create a partition w # write the partition table and exit mkdosfs -F32 -v -c /dev/sdb1
lost+found
Top BottomThe root directory of each file system will contain a 'lost+found' directory where files whose inodes have become disconnect from their filenames (i.e. recovered files) can be found. Use cat to list the contents of the file, or try executing the file to determine what it is
dumpe2fs
Top BottomUse dumpe2fs to dump file system information. This information is stored in the superblock (block 1) of the file system, and a copy is kept at 'blocks per group + 1'. The 'block size' provided by dumpe2fs can be used in the -b option of badblocks
badblocks
Top BottomUse badblocks to search a device for bad blocks. Output can be fed to e2fsck or mke2fs. Options:
- -o filename
- print output to filename
- -w
- DESTROYS ALL DATA ON DISK! Writes a test pattern to every block on the device (overwriting existing data) as part of the testing
- -b
- Used to specify block size on device. Normally, badblocks should be able to work this out: otherwise use dumpe2fs to determine correct value.
- -n
- non-destructive read-write mode
debugfs
Top BottomUse debugfs for debugging a file system
ddrescue
Top BottomUse ddrescue to create an image of a bad device:
ddrescue -n /dev/sdb6 sdb6image.img sbb6log ddrescue -d -r3 /dev/sdb6 sdb6image.img sbb6log fsck -y sdb6image.img mount -o loop sdb6image.img /mount/image # now copy files al gusto
