The System Administrator Notebook

Pages in the Data Recovery section

SMART LVM2

Protecting and Recovering Data from Hard Disk Drives

Page Contents

Naturally the best starting point for data recovery is a recent, good backup. In the absence of a restorable backup, it may be possible to retrieve data from a damaged hard disk drive. These pages describe some useful tools that might just help you recover your data

fsck

Top Bottom

Use fsck to check and repair Linux filesystems. Filesystems can be specified by partition name (e.g. /dev/hda1, /dev/sdb2) or mount point (e.g. /, /home). fsck without options will check filesystems in order as listed in /etc/fstab. Options to fsck:

-s
run fsck on filesystems in serial order, that is, one by one
-t fslist
Specify a comma seperated list of filesystems types and options specifiers to check. For instance to check read-only ext4 filesystems use: fsck -t ext4,opts=ro
-A
check filesystems in /etc/fstab in one run. If the sixth field in fstab (fs_passno) is set to zero for an fstab entry, that filesystem will not be checked. Otherwise filesystems will be checked in order of fs_passno (lowest numbers first. Runs checks in parallel unless -s specified.
-R
Skip root partition if -A is specified
-N
Do not execute just show what would be done
-V
Verbose output
-a
Automatically repair filesystem - maps to e2fsck's -p option
-n
Do not repair, simply report. On reiserfs does not even report.
-r
Interactively repair the filesystem
-y
automatically attempt to fix detected filesystem corruptions

mkfs

Top Bottom

Use mkfs to build a Linux file system on a device. Options:

-V
Verbose output
-t fstype
Specify the type of filesystem. Types of filesystems supported will correspond to the mkfs.* executables installed on the system (usually in sbin). Use
find / -name mkfs.* -print 2> /dev/null
to list available file system types
-c
Check for bad blocks before building the filesystem

mke2fs

Top Bottom

Use mke2fs to build a Linux file system on a device. Options:

-S
Use this option to rewrite superblocks and group descriptors only. Useful if all the superblocks on a disk have become corrupted. The correct filesystem blocksize must also be specified for this option to work. Run e2fsck immeadiately afterwards - no guarantees that this any data will be salvaged this way.
-b blocksize
Specify the blocksize.
-n
Cause mke2fs to take no action: only display what it would do. Useful for listing superblock locations

fdisk

Top Bottom

Use:

fdisk -l /dev/sda

to list the partitions on the first SCSI/SATA disk on a system

Create a EXT3 Partition

Top Bottom

Create the Partition Table, add a partition and format it

fdisk /dev/sdb
o # create an empty dos partition table
n # create a partition
p # make it a primary partition
t # set type for partition
83 # set type to Linux
w # write changes and exit
mkfs -t ext3 -c /dev/sdb1

Create a FAT32 Partition

Top Bottom

Create the Partition Table, add a FAT32 partition and format it

fdisk /dev/sdb
o # create an empty dos partition table
n # create a partition
w # write the partition table and exit
mkdosfs -F32 -v -c /dev/sdb1

lost+found

Top Bottom

The root directory of each file system will contain a 'lost+found' directory where files whose inodes have become disconnect from their filenames (i.e. recovered files) can be found. Use cat to list the contents of the file, or try executing the file to determine what it is

dumpe2fs

Top Bottom

Use dumpe2fs to dump file system information. This information is stored in the superblock (block 1) of the file system, and a copy is kept at 'blocks per group + 1'. The 'block size' provided by dumpe2fs can be used in the -b option of badblocks

badblocks

Top Bottom

Use badblocks to search a device for bad blocks. Output can be fed to e2fsck or mke2fs. Options:

-o filename
print output to filename
-w
DESTROYS ALL DATA ON DISK! Writes a test pattern to every block on the device (overwriting existing data) as part of the testing
-b
Used to specify block size on device. Normally, badblocks should be able to work this out: otherwise use dumpe2fs to determine correct value.
-n
non-destructive read-write mode

debugfs

Top Bottom

Use debugfs for debugging a file system

ddrescue

Top Bottom

Use ddrescue to create an image of a bad device:

ddrescue -n /dev/sdb6 sdb6image.img sbb6log
ddrescue -d -r3 /dev/sdb6 sdb6image.img sbb6log
fsck -y sdb6image.img
mount -o loop sdb6image.img /mount/image
# now copy files al gusto