[nSLUG] Data Recovery...
draker at gmail.com
Thu Jan 29 22:22:30 AST 2009
2009/1/29 Stephen Gregory <nslug at kernelpanic.ca>:
> Daniel Morrison wrote:
>> dd conv=noerror bs=4096 if=/dev/sda of=/dev/sdb
> It is just as easy to read the partitions individually and write the
> data to a file. That way you don't need a free hard drive. Just lots of
> drive space. You can fsck and mount the file later.
Yes, you're right.
> But I don't recommend using dd. If the drive is bad dd will likely
> stress the drive and make it worst.
Can you explain? I always figure that dd will read each bit on the
disk exactly once, whereas mounting it, even read-only, will cause
repeated accesses to key portions (e.g. root directory inode,
> You can use the sb= option with mount to specify an alternate
> superblock. See the mount manpage under the ext2 specific options. This
> may allow you to recover some data. If only some of the drive is damaged.
That's a good idea, but... mounting an unclean filesystem is a bad
idea (although read-only is less dangerous). If someone has imaged a
copy as I suggested, then fsck on the alternate superblock will repair
the original, making it possible to mount without this option.
> I would mount the filesystem readonly with the -r argument for mount.
And then? How to find and copy data without stressing the disk or
(worst case) crashing your system?
More information about the nSLUG