System Rescue with Knoppix

Link

Repairing Filesystems
ext2/ext3

* ext2/ext3:
knoppix@tty1[knoppix]$ sudo fsck /dev/hda1

Repairing Filesystems (cont.)
ReiserFS

1. Check for errors:
knoppix@tty1[knoppix]$ sudo reiserfsck --check /dev/hda1
2. Repair errors:
* If it reports fixable errors:
knoppix@tty1[knoppix]$ sudo reiserfsck --fix-fixable /dev/hda1
* If it reports fatal corruptions (ouch), image the partition, then:
knoppix@tty1[knoppix]$ sudo reiserfsck --rebuild-tree /dev/hda1

Repairing Filesystems (cont.)
XFS

1. Check for errors:
knoppix@tty1[knoppix]$ sudo xfs_check /dev/hda1
2. If it finds errors:
knoppix@tty1[knoppix]$ sudo xfs_repair /dev/hda1

Imaging Drives

* Disk to disk:
$ sudo dd if=/dev/hda of=/dev/hdb
* Partition to partition:
$ sudo dd if=/dev/hda1 of=/dev/hdb1
* Partition to file:
$ sudo dd if=/dev/hda1 of=/mnt/hdb1/hda1_drive_image.img
* Partition to file over ssh:
$ sudo dd if=/dev/hda1 | ssh username@host "cat > /home/username/hda1_drive_image.img"
* Restore from a file to a partition:
$ sudo dd if=/mnt/hdb1/hda1_drive_image.img of=/dev/hda1

Imaging Damaged Drives
Why use dd_rescue and dd_rhelp?

* dd doesn't handle bad blocks well (even with noerror)
* dd_rescue retries bad blocks and writes a zero otherwise
* dd_rhelp uses dd_rescue, but skips bad block clusters until later
* dd_rhelp can be resumed easily

Imaging Damaged Drives (cont.)
Get dd_rescue and dd_rhelp

* dd_rescue binaries at http://www.garloff.de/kurt/linux/ddrescue
* extract dd_rescue binary from tarball
* dd_rhelp source at http://www.kalysto.ath.cx/utilities/dd_rhelp/index.en.html
* untar, configure, make dd_rhelp source
* copy dd_rescue and dd_rhelp binaries to ~/.dist/bin

Imaging Damaged Drives (cont.)
Use dd_rhelp

1. mount the destination drive
knoppix@tty1[knoppix]$ sudo mount -o rw /dev/hdb1 /mnt/hdb1
2. run dd_rhelp
knoppix@tty1[knoppix]$ sudo dd_rhelp /dev/hda1 /mnt/hdb1/hda1_rescue.img
3. fsck the image
knoppix@tty1[knoppix]$ sudo fsck -y /mnt/hdb1/hda1_rescue.img
4. mount the image loopback, or reimage to another drive