| 1 |
Stroller wrote: |
| 2 |
[snip] |
| 3 |
> |
| 4 |
> I would try running fsck on a copy of the image. |
| 5 |
> |
| 6 |
|
| 7 |
I did try and thought I would post here some final info just for the |
| 8 |
record. I proceeeded with the command |
| 9 |
|
| 10 |
root@sysresccd /root % ddrescue -r 1 /dev/sda /dev/sdc rescued.log |
| 11 |
|
| 12 |
which took ~50 hours to finish with the message: |
| 13 |
|
| 14 |
Press Ctrl-C to interrupt |
| 15 |
Initial status (read from logfile) |
| 16 |
rescued: 58811 MB, errsize: 48909 kB, errors: 95 |
| 17 |
Current status |
| 18 |
rescued: 77815 MB, errsize: 2210 MB, current rate: 0 B/s |
| 19 |
ipos: 66589 MB, errors: 598, average rate: 56872 B/s |
| 20 |
opos: 66589 MB, time from last successful read: 18.5 m |
| 21 |
Trimming failed blocks... |
| 22 |
ddrescue: write error: Input/output error |
| 23 |
|
| 24 |
Again the same error message. I did not care about it and moved forward |
| 25 |
to mount the /dev/sdc drive. Enabled the LVM volume groups with vgchange |
| 26 |
-a y (all this under the systemrescuecd boot), mounted the partition of |
| 27 |
interest under LVM control and did a |
| 28 |
|
| 29 |
reiserfsck --check /dev/myvg/mylv |
| 30 |
|
| 31 |
It ended with |
| 32 |
|
| 33 |
1 found corruptions can be fixed only when running with --rebuild-tree |
| 34 |
########### |
| 35 |
reiserfsck finished at Fri Jan 15 11:46:23 2010 |
| 36 |
########### |
| 37 |
|
| 38 |
The next step was then |
| 39 |
|
| 40 |
reiserfsck --rebuild-tree --logfile rebuild.log /dev/myvg/mylv |
| 41 |
|
| 42 |
I was then able to mount the partition and inspect the newly created |
| 43 |
lost+found/ directory. Surprisingly I was able to find the file I was |
| 44 |
looking for!! |
| 45 |
|
| 46 |
It was the first time I tried this kind of HDD forensics and was |
| 47 |
surprised with the time that it took to recover data from a relative low |
| 48 |
storage drive: 80GB. The rebuild.log file had over 8000 lines. |
| 49 |
|
| 50 |
Stroller, thanks for all your comments and suggestions. Yes having extra |
| 51 |
disk space is a must to be able to recover data. |
| 52 |
|
| 53 |
-- |
| 54 |
Valmor |
| 55 |
|
| 56 |
> |
| 57 |
> I hope this makes sense. I'm by no means an expert, but I'm glad to |
| 58 |
> help in any way possible. Having lots of disk space helps a lot. |
| 59 |
> |
| 60 |
> Stroller. |
| 61 |
> |
| 62 |
> |
| 63 |
> |
Archives