The System Administrator Notebook

Pages in the Data Recovery section


Protecting and Recovering Data from Hard Disk Drives

Page Contents

Naturally the best starting point for data recovery is a recent, good backup. In the absence of a restorable backup, it may be possible to retrieve data from a damaged hard disk drive. These pages describe some useful tools that might just help you recover your data


Top Bottom

Use fsck to check and repair Linux filesystems. Filesystems can be specified by partition name (e.g. /dev/hda1, /dev/sdb2) or mount point (e.g. /, /home). fsck without options will check filesystems in order as listed in /etc/fstab. Options to fsck:

run fsck on filesystems in serial order, that is, one by one
-t fslist
Specify a comma seperated list of filesystems types and options specifiers to check. For instance to check read-only ext4 filesystems use: fsck -t ext4,opts=ro
check filesystems in /etc/fstab in one run. If the sixth field in fstab (fs_passno) is set to zero for an fstab entry, that filesystem will not be checked. Otherwise filesystems will be checked in order of fs_passno (lowest numbers first. Runs checks in parallel unless -s specified.
Skip root partition if -A is specified
Do not execute just show what would be done
Verbose output
Automatically repair filesystem - maps to e2fsck's -p option
Do not repair, simply report. On reiserfs does not even report.
Interactively repair the filesystem
automatically attempt to fix detected filesystem corruptions


Top Bottom

Use mkfs to build a Linux file system on a device. Options:

Verbose output
-t fstype
Specify the type of filesystem. Types of filesystems supported will correspond to the mkfs.* executables installed on the system (usually in sbin). Use
find / -name mkfs.* -print 2> /dev/null
to list available file system types
Check for bad blocks before building the filesystem


Top Bottom

Use mke2fs to build a Linux file system on a device. Options:

Use this option to rewrite superblocks and group descriptors only. Useful if all the superblocks on a disk have become corrupted. The correct filesystem blocksize must also be specified for this option to work. Run e2fsck immeadiately afterwards - no guarantees that this any data will be salvaged this way.
-b blocksize
Specify the blocksize.
Cause mke2fs to take no action: only display what it would do. Useful for listing superblock locations


Top Bottom


fdisk -l /dev/sda

to list the partitions on the first SCSI/SATA disk on a system

Create a EXT3 Partition

Top Bottom

Create the Partition Table, add a partition and format it

fdisk /dev/sdb
o # create an empty dos partition table
n # create a partition
p # make it a primary partition
t # set type for partition
83 # set type to Linux
w # write changes and exit
mkfs -t ext3 -c /dev/sdb1

Create a FAT32 Partition

Top Bottom

Create the Partition Table, add a FAT32 partition and format it

fdisk /dev/sdb
o # create an empty dos partition table
n # create a partition
w # write the partition table and exit
mkdosfs -F32 -v -c /dev/sdb1


Top Bottom

The root directory of each file system will contain a 'lost+found' directory where files whose inodes have become disconnect from their filenames (i.e. recovered files) can be found. Use cat to list the contents of the file, or try executing the file to determine what it is


Top Bottom

Use dumpe2fs to dump file system information. This information is stored in the superblock (block 1) of the file system, and a copy is kept at 'blocks per group + 1'. The 'block size' provided by dumpe2fs can be used in the -b option of badblocks


Top Bottom

Use badblocks to search a device for bad blocks. Output can be fed to e2fsck or mke2fs. Options:

-o filename
print output to filename
DESTROYS ALL DATA ON DISK! Writes a test pattern to every block on the device (overwriting existing data) as part of the testing
Used to specify block size on device. Normally, badblocks should be able to work this out: otherwise use dumpe2fs to determine correct value.
non-destructive read-write mode


Top Bottom

Use debugfs for debugging a file system


Top Bottom

Use ddrescue to create an image of a bad device:

ddrescue -n /dev/sdb6 sdb6image.img sbb6log
ddrescue -d -r3 /dev/sdb6 sdb6image.img sbb6log
fsck -y sdb6image.img
mount -o loop sdb6image.img /mount/image
# now copy files al gusto