[chuug] Linux filesystem recovery

[Patrick Reynolds]

On Sun, 8 Jul 2007, Ben Taitelbaum wrote:

> I've found to do this is with dd, piped through ssh onto another *nix
> box, so that you have an image file on that box that you can run
> recovery tools against.
>
> dd if=/dev/hda | ssh user at dst dd of=/path/to/image.img

A good suggestion of course.  But I have sort of a side question.  Why
does everyone advocate 'dd' where 'cat' or 'cp' will suffice?  For
example, the above command is equivalent to:
   cat /dev/hda | ssh user at dst 'cat > /path/to/image.img'

dd is nice if you want to read from or write to the middle of a file, or
if block size matters for some reason, but for reading/writing an entire
file, keep it simple, right?

To contribute something semi-meaningful to the discussion... take a look
at debugfs.  I think it can read backup superblocks if you hosed the main
one (at the start of the filesystem).  debugfs wants a filesystem (i.e., a
partition), not a whole disk, so you'll need a working partition table.
If you wrecked the partition table, parted can sometimes find it if you
know roughly which block offsets your Linux partition used to be.

Run debugfs and parted on an imaged copy (seconding Ben's suggestion) so
you don't risk making matters worse.

--Patrick