[nSLUG] Data Recovery...

Daniel Morrison draker at gmail.com
Thu Jan 29 22:22:30 AST 2009

2009/1/29 Stephen Gregory <nslug at kernelpanic.ca>:
> Daniel Morrison wrote:
>> dd conv=noerror bs=4096 if=/dev/sda of=/dev/sdb

> It is just as easy to read the partitions individually and write the
> data to a file. That way you don't need a free hard drive. Just lots of
> drive space. You can fsck and mount the file later.

Yes, you're right.

> But I don't recommend using dd. If the drive is bad dd will likely
> stress the drive and make it worst.

Can you explain?  I always figure that dd will read each bit on the
disk exactly once, whereas mounting it, even read-only, will cause
repeated accesses to key portions (e.g. root directory inode,
superblock, etc.).

> You can use the sb= option with mount to specify an alternate
> superblock. See the mount manpage under the ext2 specific options. This
> may allow you to recover some data. If only some of the drive is damaged.

That's a good idea, but... mounting an unclean filesystem is a bad
idea (although read-only is less dangerous).  If someone has imaged a
copy as I suggested, then fsck on the alternate superblock will repair
the original, making it possible to mount without this option.

> I would mount the filesystem readonly with the -r argument for mount.

And then?  How to find and copy data without stressing the disk or
(worst case) crashing your system?


More information about the nSLUG mailing list