Become A System Rescue Guru With Linux, Part 1

One of my favorite Linux features is its endless adaptability as a cross-platform rescue tool, and my favorite rescue Linux of all is the excellent Gentoo-based SystemRescueCD. SystemRescueCD comes with every imaginable necessity:

• Support for most computer filesystems, including Mac’s HFS+ and all Windows filesystems
• Samba
• rsync
• a useful assortment of network diagnostic and fixit apps
• rdesktop, free Windows terminal server client
• tightvnc, cross-platform remote desktop
• several VPN (virtual private network) servers and clients
• LVM (Linux volume manager)
• Linux software RAID
• GParted, graphical partitioning tool
• Partimage, for cloning partitions
• Testdisk, for recovering data from lost partitions and damaged drives

And a lot more stuff you can read about at SystemRescueCD. With a SystemRescueCD or USB stick you can perform heroic rescues on any Linux, Unix, Mac OS X, Windows, and probably a number of lesser-known platforms as well. Yes, you can really fix these systems- you’re not limited to the tired old reformat-reinstall dance that those big shot innovative vendors rely on.

SystemRescueCD comes with WindowMaker for folks who prefer a graphical environment to the command line, but it’s pretty limited. It’s good for running GParted, Leafpad, Firefox and Dillo, and for running multiple X terminals. It’s nice and lightweight, so it should work even on frail old PCs and laptops.

To use SystemRescueCD, just boot it up. It will ask you for a keymap preference; if you ignore it and wait it will select a US keyboard by default and finish booting. If you are using the bootable USB image, be sure to test it a lot on different systems. Any PC made in this century claims to support booting from USB devices, but this isn’t always reliable. Still, it’s the ultimate in cool to whip out your Swiss Army Knife with the built-in USB stick and boot computers with it. SystemRescueCD uses around 380 megabytes, so these days you won’t have any trouble finding a USB device with enough capacity.

SystemRescueCD doesn’t automatically set up networking, so run the net-setup command after it boots up to configure networking. startx gives you WindowMaker. If you have any problems starting SystemRescueCD, reboot and hit the F2-F5 keys to see a lot of helpful information on boot options.

If your hard drive is in its death throes, the fastest and most reliable method of rescuing your data is to connect a second hard drive and copy everything to it. If you don’t want to open the case and hassle with connecting an internal drive, you have several good external drive options. You can get a standalone USB/Firewire drive. There are external enclosures for single SATA/PATA drives. You can get a USB-to-PATA/SATA adapter, with a power connector. These are nice for rescue operations because some models will take both 2.5″ and 3.5″ drives, and both SATA and PATA drives, so you can use whatever hard disk you grab first. The external drive must have a filesystem on it, which you can create from SystemRescueCD with GParted.

When the extra drive is ready, create a directory to mount it in, then mount it and copy your files. In this example the sick hard disk is /dev/sda, and the external drive is /dev/sdb. We’re going to save /etc/ and /home:

% mkdir /mnt/sickly

% mkdir /mnt/rescue
% mount /dev/sda1 /mnt/sickly
% mount /dev/sdb1 /mnt/rescue
% cd /mnt/sickly
% cp -r home/ etc/ /mnt/rescue

Do not mount anything in mnt or bad things will happen; always create a new mountpoint.

GNU ddrescue, by Antonio Diaz, is a superior data-rescuing utility. It operates in a similar fashion to dd-rescue and dd-rhelp, which are also good rescue commands. It works at the block level, so it doesn’t matter what filesystem you’re saving- it works on all of them. Yes, every single one. It copies good blocks first, and when it hits bad blocks it skips over them and keeps going. Time is crucial on a dying hard disk, and ddrescue is the fastest of the three. Make sure your source disk is not mounted before running ddrescue; you can check this with the mount command.

ddrescue has a lot of command options, but this simple invocation does the job just fine:

% ddrescue -r3 /dev/sda1 /dev/sdb1 rescue-logfile

That tells it to run three times, and to copy whatever it can from /dev/sda1 to /dev/sdb1. The partition you’re copying to should be half again as large as the source partition so you have a safe margin to operate in. The logfile can be named whatever you want. Using a logfile requires more disk space, but it’s your insurance against interruptions and crashes.

Then run the appropriate version of fsck for your filesystem on the copy, not on the original. For extra insurance, make a copy of your copy first. Then mount it read-only and see what you were able to save. This example is for Ext3:

% e2fsck -v -f /dev/sdb1
% mkdir /mnt/ddrescued
% mount -o ro /dev/sdb1 /mnt/ddrescued

You’ll probably want to install ddrescue on another system so you can read the dommed info pages, which are much more detailed than the man page. (Yes, we hates info pages and crippled man pages.) SystemRescueCD doesn’t include an info reader.

In part two, you’ll learn how to perform rescue operations over the network.

Resources

• DataRecovery; an excellent Ubuntu help page on using advanced tools to recover data from damaged files
• SystemRescueCD

Carla Schroder is the author of the Linux Cookbook and the newly-released Linux Networking Cookbook, and is a regular contributor to LinuxPlanet.

This article was first published on LinuxPlanet.com.