recovering data off failing/failed hard drive
Hello people, As the linux fan at work I was offered an old machine to set up a wiki at work. I migrated much of the data off a private wiki I kept on my home machine and set up the wiki using Kubutu Server 6.06 LTS. The wiki is phpwiki and uses mysql as the backend. The machine stopped serving webpages yesterday and although I could ssh into it it was complaining that it couldn't write to the access logs when I stopped and started apache. I elected to reboot the machine but the machine no longer boots linux although it will be boot the Windows partition if you wait long enough. (i suspect Windows is running scandisk.exe 'cause it thinks something is wrong) I put in the Kubutu 6.06 server CD and tried to start a rescue session. Althought it boots it wouldn't boot of any of the partitions (my knowledge getting a little fuzzy here). At one point I tried starting the partitioner but the machine seemed to lock up so I had to switch the power button. So I put in a Damn Small Linux Live CD (kernel 2.4.26) and it boots ups fine, sets up X windows etc. I can mount /dev/hda8 fine which is my home partition but it won't mount /dev/hda7 which is the root partition and inconveniently containing the data I wish to recover. When I run e2fsck /dev/hda7 it exits early saying its a short session and asks is it a zero length partition? I run fdisk and the stop and start segments, sectors? seem in proportion to the partition size (about 10G). I've tried running fsck.ext2 -b 8913 /dev/hda7 but it still complains that it can't find the superblock and makes ominous suggestions that the partition might be corrupt. I have been running badblocks /dev/hda7 for the past hour or so but nothing salient seems to be reported. My plan was to image the partition and mount on another machine to recover the database but this now seems hopeful. Do the sys admin guru's out there have any suggestions? Thanks Chris
Hi Chris. First off, I'm no guru, but here goes: Use 'dd' or similar to create an image of the failed/failing drive. Do a google and install/download/research the following programs: Foremost Scalpel etc. I ended up using Foremost, and recovered a lot of data - not as much as I had hoped, but better than none. For Win32 OS - PC Inspector File Recovery - was free? last time I used it. HTH. Elroy.
Hello, Thanks for that advice. Foremost looks intesting. I've booted up using Damn small linux, plugged in a USB harddrive 160G. tried dd= if=/dev/hda7 of=/mnt/sda1/wikiimage/wikiimage.dat bs=4k Damn small linux returns "Input/Output" error if I try dd= if=/dev/hda8 of=/mnt/sda1/wikiimage/wikiimage.dat bs=4k where /dev/hda8 is a healthy partition, an image gets made on my USB hard drive. looks like I'll have to mount the failing drive in a working machine and see if Foremost can recover anything. Thanks for the help Elroy. If other people have other thoughts I'd appreciate your comments. Cheers Chris On 17/07/07, elroy <elroy(a)ihug.co.nz> wrote:
Hi Chris.
First off, I'm no guru, but here goes:
Use 'dd' or similar to create an image of the failed/failing drive.
Do a google and install/download/research the following programs:
Foremost
Scalpel
etc.
I ended up using Foremost, and recovered a lot of data - not as much as I had hoped, but better than none.
For Win32 OS - PC Inspector File Recovery - was free? last time I used it.
HTH.
Elroy.
_______________________________________________ wlug mailing list | wlug(a)list.waikato.ac.nz Unsubscribe: http://list.waikato.ac.nz/mailman/listinfo/wlug
On 7/17/07, Michael McDonald <mikencolleen(a)gmail.com> wrote:
On 17/07/07, Chris O'Halloran <cmoman(a)gmail.com> wrote:
If other people have other thoughts I'd appreciate your comments.
You could try a stand-alone version of gparted and copy the partition to you USB drive. That's one of my backup methods.
Michael
It's on this Live CD which also has some useful tools potentially: http://clonezilla.sourceforge.net/ -- Web: http://wand.net.nz/~iam4/ Blog: http://iansblog.jandi.co.nz WAND Network Research Group
Hi Chris. Another few comments: I think the name for those tools I mentioned are referred to as 'data carving'/'file carving' tools. Also, re: I/O errors with 'dd' - do a 'man dd' and see what retry/'force'/keep-going-on-errors-encountered options it has - I'm sure there is one there to tell it to retry xxx times, if no luck, move on to the next block, etc. HTH. Elroy. Chris O'Halloran wrote:
tried dd= if=/dev/hda7 of=/mnt/sda1/wikiimage/wikiimage.dat bs=4k
Damn small linux returns "Input/Output" error
Chris
Also, re: I/O errors with 'dd' - do a 'man dd' and see what retry/'force'/keep-going-on-errors-encountered options it has - I'm sure there is one there to tell it to retry xxx times, if no luck, move on to the next block, etc.
GNU ddrescue seems to be fairly useful. It has helped me rescue data off damaged CDs before. See http://www.gnu.org/software/ddrescue/ddrescue.html -- Sam
participants (5)
-
Chris O'Halloran -
elroy -
Ian McDonald -
Michael McDonald -
Sam Douglas