SystemRescueCD is an amazing tool that packs a myriad of admin stuff. The usage I give it the most are:
- Data Transfer
- Data Rescue
- Disk Cloning
This is the one that brought me to this post. It’s very easy to spin up SystemRescueCD on any machine, and you’ll get a full
sshd server to connect to. From there you can download/upload to the HDDs on that machine bypassing the Operative System.
On recent editions of SystemRescueCD iptables is started by default, so you have to stop it (or configure it to accept connections on port 22), before connecting to the
# Allow incoming and outgoing ssh iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT # Change root user password passwd # Restart sshd systemctl sshd restart
Being the "guy that knows computers" I get around 20 HDDs per year that need saving. They range from the PCB that fried – very common on external drives with soldered USB, to SATA disks that were broken due to a fist tantrum – 2021 pandemic was prolific on those!
When the hard-drive is failing you definitely don't want it searching and seeking all over the platters.
ddrescue is your own special ops team. In and out, as fast as possible. You can get it directly from gnu.org. You may also use it if you are a Windows user, just download Cygwin and take into consideration that
/dev/sda and Cygwin expects you to use
On the following examples
devX is the drive that needs saving, and you've mounted
/mnt/goodDrive/ on another physical device.
# This would try to capture as much data as fast as possible ddrescue /dev/devX /mnt/goodDrive/failing.img /mnt/goodDrive/failing.log
There are some other options I generally use that may eventually help someone.
On complex cases the following arguments have proven to be effective and a life-saver:
TestDisk from CGSecurity is one of the "must haves" of data recovery. It's a brilliant tool to try and restore partitions, if not using it on SystemRescueCD you may use it in both Linux and Windows. The steps I would generally take:
a) make an image of the bad disk using
b) if that image is mountable and everything looks fine, problem solved
c) if the image has no partition, make a copy of the image
testdisk to try and recover the lost partitions
PhotoRec, a companion to TestDisk, is downloaded in the same file. PhotoRec is a carver, which means it will go over the whole disk trying to find headers of known files. If it finds a known header it will download the file. Data Carvers, besides not knowing where the file originally was, have an extra problem, fragmentation! If the file is not sequential, there is absolutely no way for TestDisk to know where the missing piece is.
FF D8 FF E0which means it's a JPEG of the type JFIF.
Unfortunatly, as you can see, the image was not sequential, thus what I got, besides a little of actual image on the top, was garbish. You can inspect any image you have and check for the initial bytes to see its header, just get a hex reader. I'm a fan of HxD.
There has been a lot of switching from HDDs to SSDs. Cloning the old HDD to the new SSD using
ddrescue is trivial. Sometimes the new disk is larger than the old one. When that happens you get space that does not show on the primary partition. There is nothing preventing you from formatting the extra space as a new partition, but I generally prefer to expand the existing one partition and use the full space.
The application has a GUI and is pretty self-explanatory, so there really isn't much where you can go wrong there.
Hope it helped!