cms on 26 Nov 2004 04:55:04 -0000


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Linux Disk utilities


On Thursday 25 November 2004 22:08, abradley wrote:
> To further clarify
> I have been migrating towards Linux, so this is more of a test to see if
> I can do it.  I know I can recover the disk with a windows utility (If I
> pay for it)

You can recover your data from within Linux as well, should you chose to pay
for it. [http://www.asrdata.com/SMART/]  Or, you can go the free route and
save yourself a lot of money.

> I like what I see with Linux.  I like how it has been maturing and I
> would like to try going Windows free at home.  I even have my kids on
> Linux(SUSE, Knoppix, FC3).  I have always considered myself a techie.
> That is until I started lurking around you command line junkies. :-) I
> do not have the skill set to do everything in Linux that I can do in
> Windows.  I know it can be done.  I just have to get there.
>
> The disk had Win2k only.  No dual boot.  I typically swap disks when I
> want to swap OSes.  I never liked the dual boot thing since I lost the
> battle dual booting OS2 and windows 3.0.  No lilo or grub on the disk.
>
> The disk spins and the heads move.  I do not get a SMART error.  If I
> wanted to, I know I could re-format the disk.
>
> During the boot sequesnce, the drive is found.
>
> As a stand alone disk at boot the computer displays a No OS error
>
> As a secondary disk on a computer booted to win2k, the OS wants to
> format the drive.
>
> R-Studio is a windows disk recovery application.  Something like
> Spinrite (Also a commercial windows ($) disk recovery utility)
>
> The r-studio application scanned the disk and found the lost files much
> like an undelete utility would.  With out the pay version, I think I can
> restore files less than 64k.  If I pay, I am a few clicks away from a
> recovered disk.

Sounds like you're able to see a directory structure using the TRIAL version
of a Windows app but you would have to buy the app to actually recover your
data.?.? If that is the case, than you shouldn't have any problems recovering
your data using various free utilities/apps.

> Yes, I did try MS fdisk and it says the disk is FAT32.  Nope, no copy of
> MBR laying around. (I did not know you could do that).  Maxtor's utility
> (DLG?) is of no help.
>
> The disk is a Maxtor.  I have been seeing issues with "large" Maxtor
> disks.  This is the 3rd one (2 others were friends' disks) in a two
> months.  Maybe it's time to change brands.

I've had two Maxtor disks go bad on me. Both developed problems with the code
found on the controller. I could recover my data rather easily, however, I was
not able to reliably reformat or reuse either disk (wow, a lot of Rs). They
were both the same model too--though I cannot recall the model number--and
they were not that large. An interesting note though; Maxtor has had a lot of
their 250Gb DiamondMax series drives fail in recent months. Many of my
colleagues have had problems with these drives failing after just a few months
of use. Maxtor's more expense line--I think they're called Maxline--are much
more reliable.

> Considering the information above, is Sluethkit the way to go? And OK,
> I'll start with the dd command, and copy the disk byte for byte.  I
> found some resources for syntax.

You have a lot of options. Use a Linux box with the failed drive as a slave
and copy the data to another location/device; or, use a LiveCD such as SLAX,
Knoppix, F.I.R.E., SysRescue, etc., with the failed disk as a master in your
windows box--or any box for that matter. You just need to be able to use
dd--or one of its clones, such as sdd--to copy the data from the failed disk.
How you copy the disk depends on a few things, such as the filesystem on the
disk to which you are copying and the tool(s) you intend to use. For example,
you would do well to copy the data from your failed disk to a second disk
formatted with a more robust file system than FAT32, or even NTFS. The file
size limitations in FAT32 and NTFS can be a nuisance. With other file systems,
such as Ext3, ReiserFS, XFS, etc., you would have less problems to deal with
when it came time to start playing with the image(s) you created using dd.

On your Linux box start Autopsy/Sleuthkit and point Sleuthkit to the image(s)
you created using dd and start recovering your data. The Sleuthkit app has a
lot of really cool tools built into it. You should have no problems using it.
If you do though, or you have any other questions, feel free to ask. I know
there are many people on this list that can/will help you. Myself included.

Have a good night.

Chris Shanahan

> Gracias
> AB
> -----Original Message-----
> From: plug-admin@lists.phillylinux.org
> [mailto:plug-admin@lists.phillylinux.org] On Behalf Of cms
> Sent: Thursday, November 25, 2004 4:52 PM
> To: plug@lists.phillylinux.org
> Subject: Re: [PLUG] Linux Disk utilities
>
> On Thursday 25 November 2004 15:23, abradley wrote:
> > Are there any Linux disk recovery tools available for free?
>
> Yes. There are a lot of good tools out there that do a variety of
> different
> things, depending on your needs. Before you do anything, make a copy of
> the
> entire disk that way should you really mess it up while you're trying to
> restore it you'll have a copy to return to--albeit a damaged copy.
>
> > I recently lost a 40gig drive.  Actually, I think I lost the MBR.   I
> > tried Fdisk \MBR and a few other things to no avail.
>
> Lost a 40Gb drive? In what way?
>
> 'fdisk \mbr' tells me you used MS's fdisk utility to rewrite the mbr on
> the
> disk. I would suggest you ALWAYS use a Linux/Unix version of fdisk. They
> offer
> much more functionality than the MS versions. Also, if you have a copy
> of the
> disk's mbr lying around you could use sfdisk to rewrite the correct mbr
> back
> to the confused disk.
>
> > I downloaded the R-Studio demo and was able to see the drive contents
> > but to get it to work I need to lay down some cash.
>
> Not familiar with R-Studio.
>
> > The drive appears to have been FAT32 (Which is strange because it had
> > WIN2K and I usually use NTFS.)
>
> What utility/app told you it was FAT32?
>
> > At work, I am smart enough to back things up.  At home is another
>
> story.
>
> > I am typically a Windows kind of guy at work with a few boxes running
> > Windows and Linux for fun at home.
>
> Was this disk a dual-boot setup? Or, did you have Win2k alone on the
> disk? Did
> you have lilo or Grub installed in the mbr?
>
> > Any pointers will be appreciated.
>
> As long as the drive spins--in other words, as long as the drive hasn't
> suffered any serious failures--you should be able to recover data from
> it.
> Just take your time. First though, make a copy of it!!! If you need a
> second
> drive for the copy ask a friend to borrow an extra drive or buy
> one--hard
> drives are fairly inexpensive right now. If you just want to recover the
> files
> from the disk you could simply make a copy of the disk using dd, or one
> of its
> clones, and Brian Carrier's Autopsy/Sleuthkit to view the disk's
> structure and
> recover what you need. [http://www.sleuthkit.org/]
>
> If I can offer any specific help please feel free to ask. I'll be around
> all
> evening.
>
> To those that celebrate Thanksgiving, have a great day! To those that do
> not,
> have a great day!
>
> Chris Shanahan
>
> > Regards,
> > Andrew Bradley
>
> ________________________________________________________________________
> ___
> Philadelphia Linux Users Group         --
> http://www.phillylinux.org
> Announcements -
> http://lists.phillylinux.org/mailman/listinfo/plug-announce
> General Discussion  --
> http://lists.phillylinux.org/mailman/listinfo/plug
>
> ___________________________________________________________________________
> Philadelphia Linux Users Group         --        http://www.phillylinux.org
> Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
> General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug