[chuug] Fwd: Linux filesystem recovery

[Pat Murphy]

Whups, thought I sent this to the list, not just to Patrick...

---------- Forwarded message ----------
From: Pat Murphy <ppmurphy at gmail.com>
Date: Jul 9, 2007 10:05 AM
Subject: Re: [chuug] Linux filesystem recovery
To: Patrick Reynolds <reynolds at cs.duke.edu>


On 7/8/07, Patrick Reynolds <reynolds at cs.duke.edu> wrote:

> On Sun, 8 Jul 2007, Ben Taitelbaum wrote:

> > I've found to do this is with dd, piped through ssh onto another *nix
> > box, so that you have an image file on that box that you can run
> > recovery tools against.

> > dd if=/dev/hda | ssh user at dst dd of=/path/to/image.img

> A good suggestion of course.  But I have sort of a side question.  Why
> does everyone advocate 'dd' where 'cat' or 'cp' will suffice?

It may not be the case now, but in times past there was quite a bit of
inefficiency in using "cat" which used to fetch a single character at
a time.  With dd, the I/O is blocked, and with bs= (or ibs=, obs=) the
blocksize can be optimally configured for efficiency.

Block reads of, say, 10k, go a lot faster than reading each byte
individually.  If you tune the blocksize to what you're dumping, I'll
bet the transfer would go a lot faster than with "cat".

 - Pat