Naturally the best starting point for data recovery is a recent, good backup. In the absence of a restorable backup, it may be possible to retrieve data from a damaged hard disk drive. These pages describe some useful tools that might just help you recover your data
Use fsck to check and repair Linux filesystems. Filesystems can be specified by partition name (e.g. /dev/hda1, /dev/sdb2) or mount point (e.g. /, /home). fsck without options will check filesystems in order as listed in /etc/fstab. Options to fsck:
- run fsck on filesystems in serial order, that is, one by one
- -t fslist
- Specify a comma seperated list of filesystems types and options specifiers to check. For instance to check read-only ext4 filesystems use: fsck -t ext4,opts=ro
- check filesystems in /etc/fstab in one run. If the sixth field in fstab (fs_passno) is set to zero for an fstab entry, that filesystem will not be checked. Otherwise filesystems will be checked in order of fs_passno (lowest numbers first. Runs checks in parallel unless -s specified.
- Skip root partition if -A is specified
- Do not execute just show what would be done
- Verbose output
- Automatically repair filesystem - maps to e2fsck's -p option
- Do not repair, simply report. On reiserfs does not even report.
- Interactively repair the filesystem
- automatically attempt to fix detected filesystem corruptions
Use mkfs to build a Linux file system on a device. Options:
- Verbose output
- -t fstype
- Specify the type of filesystem. Types of filesystems supported will
correspond to the mkfs.* executables installed on the system (usually in sbin).
find / -name mkfs.* -print 2> /dev/nullto list available file system types
- Check for bad blocks before building the filesystem
Use mke2fs to build a Linux file system on a device. Options:
- Use this option to rewrite superblocks and group descriptors only. Useful if all the superblocks on a disk have become corrupted. The correct filesystem blocksize must also be specified for this option to work. Run e2fsck immeadiately afterwards - no guarantees that this any data will be salvaged this way.
- -b blocksize
- Specify the blocksize.
- Cause mke2fs to take no action: only display what it would do. Useful for listing superblock locations
fdisk -l /dev/sda
to list the partitions on the first SCSI/SATA disk on a systemTop Bottom
Create the Partition Table, add a partition and format it
fdisk /dev/sdb o # create an empty dos partition table n # create a partition p # make it a primary partition t # set type for partition 83 # set type to Linux w # write changes and exit mkfs -t ext3 -c /dev/sdb1Top Bottom
Create the Partition Table, add a FAT32 partition and format it
fdisk /dev/sdb o # create an empty dos partition table n # create a partition w # write the partition table and exit mkdosfs -F32 -v -c /dev/sdb1
The root directory of each file system will contain a 'lost+found' directory where files whose inodes have become disconnect from their filenames (i.e. recovered files) can be found. Use cat to list the contents of the file, or try executing the file to determine what it is
Use dumpe2fs to dump file system information. This information is stored in the superblock (block 1) of the file system, and a copy is kept at 'blocks per group + 1'. The 'block size' provided by dumpe2fs can be used in the -b option of badblocks
Use badblocks to search a device for bad blocks. Output can be fed to e2fsck or mke2fs. Options:
- -o filename
- print output to filename
- DESTROYS ALL DATA ON DISK! Writes a test pattern to every block on the device (overwriting existing data) as part of the testing
- Used to specify block size on device. Normally, badblocks should be able to work this out: otherwise use dumpe2fs to determine correct value.
- non-destructive read-write mode
Use debugfs for debugging a file system
Use ddrescue to create an image of a bad device:
ddrescue -n /dev/sdb6 sdb6image.img sbb6log ddrescue -d -r3 /dev/sdb6 sdb6image.img sbb6log fsck -y sdb6image.img mount -o loop sdb6image.img /mount/image # now copy files al gusto