[ltp] Copying Files

[Peter Stuge]

On Mon, Dec 06, 2004 at 05:01:39PM -0500, SOTL wrote:
> I have two directories one was fat32 hda5 and one is est2 hda6.
> hda5 partition table was corrupted by myself in attempts to
> restore system.

Ouch.

Please clarify this a little though. hda5 doesn't have a partition
table. hda has the partition table. hda5 is one partition on the
disk, and is represented by one entry in the partition table.

What exactly did you corrupt? If the "only" thing that happened after
you corrupted disk data is that Linux will not mount hda5, but hda5
still shows up in the boot messages as it did before then you
probably did not corrupt the partition table, but rather the actual
FAT32 file system on the partition.

Linux can not mount a corrupted file system. But even if the file
system inside the partition is corrupted, the partition itself will
still appear just fine, since that information is stored elsewhere
on the disk.


> hda5 will NOT mount.
> hda6 will mount.

This will be the case if the file system is corrupt, rather than the
partition table.


> Yesterday I copied an executable file for Mandrake from a CD to
> floppy by a variation of the above command.

That is possible, but only if you typed out the actual file name of
the destination. When run on two plain files, dd will act much like
cp. dd creates the output file if it doesn't exist and dd makes the
output file be an exact copy of the input file.

dd does not short-circuit the kernel file system code in any way,
which means that both your CD and floppy had to be mounted already.
The problem now is that you can not mount hda5 so dd can not help.


> The question that I am asking is can the data from hda5 be copied
> to hda6 by another variation of the above command WITH OUT mounting
> hda5?

Certainly not.


> If not is there another command that will copy the data?

Short answer: No.


On Mon, Dec 06, 2004 at 11:48:06PM +0000, James Hawtin wrote:
> I agree with this completely, Never work with the orginal disk.

This is really good advice.


> If you want to try to recover it yourself
> 
> 1) Buy a disk as big as your current hard drive.
> 2) use dd to copy the complete hard disk to the new drive.
> 
> EXAMPLE ONLY
> # dd if=/dev/hda of=/dev/hdb bs=1m
> 
> 3) Remove Orginal drive.
> 4) work with copy.

I'll be more specific, according to your setup, Frank.

Get a converter that allows your laptop disk to be connected to a
regular desktop computer, something like this:

http://www.kjell.com/content/media/images/items/38269.jpg

Set up some Linux system on the desktop computer. Use /dev/hda for
this.

Connect a second harddisk, at least the size of your laptop disk,
to the desktop computer. Make it /dev/hdb.

Connect your laptop disk with the converter as /dev/hdc.

Issue:

dd if=/dev/hdc of=/dev/hdb bs=1m

..to copy the entire laptop harddisk onto the large unused disk.

Do NOT swap if and of by mistake or you will ruin _everything_ on
the laptop disk. Double check before pressing enter. if=laptop disk
and of=large unused disk. Now triple check against dmesg output that
you're using the right devices.

Power down and disconnect the laptop disk, and proceed to work on
/dev/hdb on the desktop computer, that disk is now an exact replica
of your laptop disk.


> Next your problem. You told us you had corrupted the partition
> table. This means, where the "start" and the "end" of partitions
> are could be corrupt so the physical disk sectors the partition
> table points to could be wrong. What can you do about that? Well..

Assuming that the data corruption is inside the file system none of
the above is relevant, unfortunately. If the problem actually is that
the start position of the partition has been corrupted, the above is
a great explanation! :)


> Sounds like your second partion is ok. So copy that data off...

All partitions but hda5 are ok, I believe the mission is to restore
as much as possible from broken FAT32 on hda5 onto ext2 fs on hda6
(eventually).

(That's hdb5 and hdb6 in the desktop system.)


> You could use disk recoverly tools to search for the start of a
> partition or if you can guess the values if you can rember the
> sizes (This is easier than you might think). The end of the
> partition/length is not so important, set it to the complete rest
> of the disk! The filesystem knows how much space it is using... so
> its fine if your just reading. Also Only mount the disk partitions
> read only.

If the problem is to find the start of the partition, there are
several solutions; either calculate from the other entries in the
partition table or simply do a brute force search with a bash script
running sfdisk followed by a read-only mount attempt in a loop,
increasing the start block each iteration.

If the problem is that the file system is corrupted, things are much
worse.

I've only ever used Norton Diskedit (Norton Utilities 8.0) to salvage
data from a broken FAT32 partition, and that was sometime in the mid
1990s. There may be better tools available now, but diskedit did a
really good job at the time, reconstructing the FAT from actual disk
contents with just a little help. It ran under DOS, though.

What disk recovery tools are available for working with corrupted FAT
file systems now? I've used debugfs for ext2, but that's obviously
pointless with FAT. Are there any at all for Linux?

Also, again Frank, how exactly did you corrupt the partition? What
command did you run? How long did it run before you realized the
mistake and stopped it?

Hope this helps, I know what losing data feels like.

(Backups suck! :p)


//Peter