Linux File System / Data Recovery

Recently encountered a kernel panic issue caused by ‘fsck -y’ and reboot, which caused the partition table missing. Tried some tools to recovery the file system as well as the data. Generally, we should never run into data recovery as we should always have data backup. However, sometimes it just happens – broken file system and no data backup.

0. Data backup before ‘fsck’
‘fsck’ is helpful and dangerous. Even Read-Only file system happens, we should try to backup all the data before we run ‘fsck’ trying to repair the file system!

1. File System recovery
Either hardware failure, like bad blocks, or software failure, like partition table missing, will cause the file system crash. When it happens, the data within the disk/partition could not be accessed unless the file system is repaired. The tools we could use here are:
fdisk (fdisk -l) – list all visible devices(disks)
lvm – help mount the invisible devices to /dev, which is necessary for fsck
fsck (fsck -y) – repair the bad file system
parted – a GUI based partition edit/recovery tool like PartitionMagic under Windows
gparted – Try its best to guess the partition
testdisk – like gparted but much more powerful and famous!

2. Data recovery
Sometimes, we just get no luck on the file system recovery. Then it is time to try data recovery directly. To avoid the duplicate failure during data recovery on the raw disk, it is a good idea to create an image for the whole disk or partition and do the data recovery on the image. The tools we could use here are:
dd – create the image of the whole disk/partition
ddrescue – do the data recovery based on the image generated by dd
magicrescue – similar with ddrescue
testdisk/photorec – photorec is a subtool from testdisk which is used to recovery certain files
R-StudioEmergencyCD – create the image of the whole disk/partition (Commercial but could run trial)
R-Studio – do the data recovery (based on the image generated by EmergencyCD, commercial but could run trail)

3. General procedure
a. Try the OS installation CD/DVD – get into rescue mode to search for the partition or repair the file system with fsck
b. Try different Linux bootable live CD – get into the live system as well as the tools mentioned above (Recommend: GParted and Ubuntu Rescue Remix)
c. Try to create the image of the whole disk/partition before data recovery using external hard drive
d. Run the data recovery tools based on the image
e. There are 3rd party commercial service focusing data recovery if data privacy is not cared so much

4. R-Studio
Well, I have tried most of the tools to recover the file system but failed. I have tried most of the tools above to recover the data but seems most of them are focusing on specific files like JPEG or ELF. Then R-Studio saved me, though it is not free ($79.99). You may find some issues using the R-Studio Linux version. But after I switched to the Windows version based on the image, R-studio worked like a charm!

5. Reference
Different Linux live CDs
GParted live CD
Ubuntu Rescue Remix
TestDisk step by step
General Data Recovery intro from Ubuntu
A good tutorial for partition/data recovery

About daveti

Interested in kernel hacking, compilers, machine learning and guitars.
This entry was posted in OS and tagged , , , , , , , , , . Bookmark the permalink.

2 Responses to Linux File System / Data Recovery

  1. Arnaud says:

    Btw, I followed your tutorial link to TestDisk that you posted above but I was wondering if you also had tutorials both for making an image of a drive and data recovery on R-Studio or DDRescue?

  2. daveti says:

    For dd:
    dd -if /dev/sda conv=sync,noerror bs=64K of=/mnt/externalDrive/dd.img
    Note: you may want to generate the img NOT on your original disk…
    For R-studio:
    You need to down load R-Studio Emergency Bootable CD and start your system from this CD. The GUI system would guide you on how to generate the img…

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s