J-Soft Blog

Thursday, February 07, 2008

This space has been much neglected for a while now. I've pretty much resigned myself to the fact that I just can't keep a personal blog going for any length of time, so I have decided to change the mandate of this blog. As part of my job as an IT type I frequently run accross problems that have me scouring the net for others who have encountered the same one and have either solved it or can provide some insight to point me in the right direction. In this regard I am very much a taker and not a giver and feel indebted to the people who sit around and post solutions on message boards rather than visiting a given board once, finding a solution and never returning (as I do). To rectify this situation I've decided that whenever I come accross a problem that others may also encounter I should detail the problem and the solution here, be it the product of a google search or my own ingenuity. So, without further ado, the first installment...

Creating an image of a damaged hard drive

I recently had to replace a hard drive that was nearing death. S.M.A.R.T. caught the trouble early, so the drive was still functional but with large swaths of unreadable sectors (large as in about 1GB). I surmise that this was largely occupied by free space because nothing critical seems to be missing from the copy I made of the drive. In any case...on with the show.

When I need to image a drive my first step is usually G4u(www.feyrer.de/g4u/), which is itself an indispensable tool. In the case where G4u doesn't boot on the given hardware I reach for my trusty knoppix live cd(http://www.konpper.net) and use dd to copy an image of the drive either to a second drive of to some nfs share. (Depending on the filesystem of the machine you are writing the image to you will have problems with the maximum file size).

In this particular case G4u chugged along for a while until it reached an unreadable block at which point it gave up. At this point I started looking for alternatives. I had heard of dd_rescue, which is a modified dd that doesn't quit when it hits bad blocks, it just skips ahead and allows you to tell it where to try next. I had tried it in the past and knew that it takes an ungodly amount of time to get through rough patches, so I started searching around the net for other options. Well, I hit gold: a little script called dd_rhelp. dd_rhelp is just a shell script that directs dd_rescue in a very clever manor, skipping from the start of a patch of bad blocks to some point past it, working backwards until it reaches the end of that patch and then continuing. Once it reaches the end of the disk or partition it will return to sections it has skipped looking for readable sections. I used it on the failing drive (copying to a new drive, not a network share because of file size limits) and it worked like a charm.

You can find dd_rescue and dd_rhelp in this archive. Before you can use dd_rhelp you need to compile dd_rescue and copy the binary to /usr/local/bin (or somewhere in your PATH). Go the the dd_rescue-1.59 directory and do a 'make' and then copy dd_rescue to an appropriate place. Read the documentation in the dd_rhelp directory and be VERY CAREFUL to get the parameters in the right order to avoid writing to the partition you want to read from.

Usage:

If you're running dd_rhelp from a ramdisk, as is the case if you are using a linux live cd then dd_rhelp will complain that it can't find a suitable location for its log file, which it uses to keep track of what parts of the disk it has skipped over. If you have another hard drive available (ie. not the drive you are copying, or the drive you are copying to) you can mount that as /tmp. So, if your extra drive is /dev/hdc1 you would do:

mount /dev/hdc1 /tmp

If you don't have a spare drive then you'll need to use a network drive. If you're on a windows network here's how you do it. If you're not on a windows network the odds are good that you know what you're doing.

mount -t smbfs //*computer-name*/*share-name* /tmp -o "username=*windows-domain-name*/*user*"

(items with '*' around them should be replaced with acutal values)

Now dd_rhelp should run without issue. I'd recommend reading the dd_rhelp documentation to get to know it before doing anything. To get dd_rhelp started you need two parameters: the source device/file and the output device/file. You have to be ABSOLUTELY CERTAIN which is which. To copy /dev/hda to /dev/hda execute this from the dd_rescue-1.59 directory:

./dd_rhelp /dev/hda /dev/hdb

Everything on /dev/hdb will be CLOBBERED(To be exact, the partition table will be overwritten) the instant you run this command so be ABSOLUTELY SURE that you have the parameters right. I usually check by mounting a partition on what I think is the source drive and making sure the contents and size are correct. You can check the size of mounted partitions using the df command. If you mount /dev/hda1(the first partition on /dev/hda) to some location , look for that location in the list df returns.

Labels: backup, hard drive, hardware, image, recovery, storage

posted by Jesse at 12:46 AM #