User:Skierpage/Disk recovery
Disaster!
I followed rawhide-XO FIXLINK instructions to create a bootable SD card,
zcat blah.bootable.gz > /dev/sdX
This is dangerous because it overwrites the partition, but I had done it before, I knew there was nothing on my SD card and /dev/sda is my SD card.
But /dev/sda is my hard drive. The whole thing.
I checked with df and the size looked wrong, then I read my notes (should have done that first) and I was overwriting the wrong disk. Ctrl-C!
Then I tested the .gz file and it was corrupt, so I thought nothing had been written. My computer worked fine.
The next day I got an error coming out of standby about not reading C:\$MFT or something. So I decided to reboot. Big mistake, I should have read partition tables, backed up some key files, and prepared for disaster.
- Rule 1: do what you can while it's working.
Errors shutting down, then could not reboot, bad disk.
Failed recovery
I couldn't find my Windows XP CD-ROM, even though Falcon Northwest make a big deal. Of course my Windows XP is so dramatically different thanks to all the updates and service packs that the original disk has been useless for System File Checking and file recovery and such. I had always meant to follow instructions to slipstream a new boot CD-ROM, where you make a fresh Windows CD-ROM that contains the latest files, but never did.
- Rule 2 You need a boot disk around.
Falcon Northwest provided me a personalized Recovery Disk, I inserted this and nothing happened. Zero feedback.
Into Kubuntu Live CD
I had built a Kubuntu Live CD. That booted fine.
The Kubuntu Live CD startup menu has "check disk" menu choice is useless, it just checks the CD-ROM. BUG: it is badly named.
So I ran the Live CD environment, and that worked fine. I'm updating this web page from the Live CD. Hooray for free software that is happy for the world to make bootable CDs.
Create a recovery disk/USB?
There are lots of dedicated "recovery CD" distributions. Distrowatch lists dozens, and the search leaves out the GParted distribution.
The problem is, I'm running from my only CD drive, so I can't burn another CD. Besides, I don't want to. I have gigabytes of space on my USB flash drive and SD memory card.
BUG: All the distributions I checked have crap guides to creating a bootable USB. Some even talk about making a floppy. The functionality and documentation for making a bootable USB needs to be separated from all these distributions.
Use what I have
But I'm already running Linux. Kubuntu has the parted partition editor and the NTFS tools.
BUG: all the online web recovery instructions are crap. They tell you how to make a recovery CD or floppy or whatever, tell you to stick it in the machine and reboot, but fail to tell you what to do next. I guess they assume you'll walk through their beautiful menu system. It is stupid and short-sighted not to mirror help and guidelines on a web site. You should never have to create physical media and boot from it just to read documentation.
The first four pages of Google results for "linux partition recovery tutorial" are either sites trying to sell me something or yet another guide to creating a recovery CD. I gave up finding any explanation of what to do.
Find your hard drive
You have to find the UNIX device name for your disk, like hdb ("hard disk B") or sda ("SCSCI disk A" but also "Secure Digital" memory card). Then tools can access your disk using its entry in the special /dev directory. That's how I was able to scribble all over my hard drive in the first place.
Unfortunately, the /dev directory has lots of devices in it.
Another approach is to look for boot messages where the Linux kernel finds hardware devices. In a Linux console, enter
dmesg | grep disk dmesg | grep drive
one of those should identify promising disk devices, or enter
dmesg | less
to read the whole boot thing (which might have hints about the state of the drive).
The best approach I've found is the somewhat undocumented one of looking in the special file /proc/partitions:
cat /proc/partitions
This identifies the partitions on the various devices, and their blocks. I guess if your hard drive was really badly trashed, it wouldn't have any partitions.
All these confirmed my hunch that /dev/sda is my poor hard drive. The good news is /proc/partitions showed my sda1 and sda2
Run parted
Now start parted. I should probably start this as the root user, using sudo
$ parted Using /dev/sdb
that's wrong, I need to select /dev/sda.
(parted) help ... lots of commands (parted) select /dev/sda Error: Error opening /dev/sda: Permission denied
so I do have to be root.
$ parted GNU Parted 1.8.8 Using /dev/sda (good, now I'm root it picks sda as I can write to it) Welcome to GNU Parted! Type 'help' to view a list of commands. (parted) check Partition number? 1 Error: \8. is 512k, but it has 15994 clusters (63976k). Ignore/Cancel? i Fatal: Bad FAT: cluster 12 is cross-linked for \0.8. You should run dosfsck or scandisk.
there you go! Let's see if the Linux partition is OK at least.
(parted) check Partition number? 1 Error: Partition doesn't exist.
Damn.
(parted) print Model: ATA ST3120026AS (scsi) Disk /dev/sda: 120GB Sector size (logical/physical): 512B/512B Partition Table: msdos Number Start End Size Type File system Flags 1 17.4kB 2031MB 2031MB primary fat32 boot, lba
damn. That's completely wrong, I should have an enormous Windows partition. My original destructive zcat bootable scribbled a new partition table on the front of my disk that's completely wrong.
How bad is it
So as a result of scribbling over the front of the disk I have
- probably trashed the special loader (called grub? maybe) that let me boot from Windows or Linux
- probably trashed the Windows boot code, I'm not sure if it's in the first partition or somewhere else (the MBR "Master Boot Record" ?)
- probably trashed a big chunk of my NTFS Windows partition
- somehow completely messed up my Linux setup. With firefishe's advice I had set up the second half of the disk with root, swap, and home, now it's nowhere to be seen :-(
parted has a rescue command that will try to locate and revive partitions, but I thought there's a backup somewhere on the disk with partition information. The "MBR" again?? But since the first partition table looks OK, the program trusts it.
Recovering partitions
So now I'm back to trying to find out more about disk repair.
- http://sysblogd.wordpress.com/2008/01/05/data-recovery-with-linux-from-hard-drives-cd-roms-or-dvds/ seems useful, has other links.
Fortunately I made notes when I created the partition setup.
/dev/sda1 ntfs Size 90025 MB (83.8 GB) hopefully untouched /dev/sda2 ext3 Mount / Format? checked Size 20003 MB Used 495 MB /dev/sda3 ext4 Mount /home Format? checked Size 8003 MB Used unknown /dev/sda4 swap Mount [blank] Format? [blank] Size 1998 MB Used unknown
Rather than guess at partitions with parted's rescue, testdisk sounded promising. But it's not on the Kubuntu live CD.
I tried using aptitude to install it, but that didn't work on the LiveCD. So I downloaded it. There's a Ubuntu package available, navigate to the Jaunty version, get the URL of the amd64-bit version. I have no idea how you can install new software to a read-only CD-ROM, so I did this in the temporary directory
cd /tmp wget http://ubuntu.cs.utah.edu/ubuntu/pool/universe/t/testdisk/testdisk_6.10-1_amd64.deb
then
sudo dpkg -i testdisk_6.10-1_amd64.deb
to install.
OK, now what.