Drive recovery using Linux??

Bart Silverstrim bsilver at chrononomicon.com
Wed Mar 5 20:18:36 UTC 2008


Andrew Zajac wrote:
>>  The problem I'm wondering about (the image from dd is almost done) is
>>  the filesystem...the mount example is trying ext3, when I tried mounting
>>  the drive physically fdisk couldn't determine the existence of a
>>  partition table, and no filesystem.
>>
>>  Any way to extract if there was a filesystem and it's just damaged?
> 
> If dd completed without error, then that's pretty good.  Tools like
> rr_rescue and dd-rhelp (or the even better gnu dddrescue) are used to
> make an image of a failing drive while ignoring read errors.  If dd
> completed on its own, then the drive is probably okay.  

DD completed.  I was totally mistaken on the size, though; it was a 160 
gig drive.  Took awhile to get done...

>Why it's
> partition table is gone is a mystery.  Could the DVR have gone haywire
> and formatted itself?

No idea.  I was just handed the drive and asked to look at it.  I was 
then told that it wasn't worth my time to keep looking at it, so if it 
was nothing obvious then they were writing it off.

> If you are confident that the image you made is intact, you can try
> working on the physical drive to fix the partition table.  I say this
> because you imaged the whole device.  You cannot mount the whole
> device, but only the filesystem on the first partition of the device.
> I don't know what kind of partition table or filesystem your DVR uses.

No partitions were found.  I did a dd if=/dev/hda 
of=/mnt/win/myshare/driveimage.img and it had completed fine (I'm never 
sure when to dig through finding what blocksize to use, but since it 
didn't thrown an error I didn't worry about it).

The utility testdisk found 2 HFS partitions, but i suspected they were 
false positives:
a) it said they were unrecoverable
b) the sizes were in the terabyte range, thus throwing another error 
about being too darn large for the size of the drive
c) HFS on a Panasonic DVR device? (this DVR is recording security 
cameras, not episodes of LOST)

So...I doubt it.

> Testdisk or parted can detect and add partitions found on the disk
> that are not part of the partition table.  You can try that.

Whoops, replied too soon :-)

> If you are unable to detect or guess what partition goes where, you
> can always try to data-carve the files from the raw image or device.
> Photorec and foremost are very good at doing that.   You can data
> carve a lot of the data on a disk even after it has been formatted.

I tried foremost with the "all" switch handed to it...nothing found.

There's something on the device, because strings /dev/hda |more found 
patterns to report on the dd image.

I guess the higher up doesn't want more time spent on recovering it, though.

-Bart




More information about the ubuntu-users mailing list