Disk Recovery Tools Clonezilla Dd / Ddrescue Testdisk Repair/Fix HFS+
Total Page:16
File Type:pdf, Size:1020Kb
Linux List Disks Disk Recovery Tools pmount dd / ddRescue CloneZilla Repair/Fix HFS+ (macOS) partition using Ubuntu TestDisk WSL Format and Wipe Free Disk Space List Disks lsblk #OR sudo fdisk -l To list Filesystem disks, you can run df -hl Disk Recovery Tools If you are looking to recover data from a drive that is at least potentially failing, you should first resort to try to make a clone/image of that drive to a backup drive. Tools like DiskDrill on MacOS, or Clonezilla and DDrescue are great at doing this. Linux can also be a great last resort OS to try to recover data from a drive if you keep running into issues on Windows or MacOS Disk Recovery Tools pmount pmount manual pmount is a device mounting solution that simplifies mounting and will automatically try to remount any devices that may eject on their own. Very useful for doing data recovery on misbehaving drives. sudo apt install pmount Disk Recovery Tools dd / ddRescue Install ddrescue through the gddrescue package dd is a recovery tool probably found on every UNIX system. It is built to be lightweight, simple, and available. However, ddrescue (GNU) is more sophisticated algorithm to read "good" or "big" blocks first and then more damaged areas later to help reduce the amount of data read in a single operation. Install gddrescue package containing ddrescue (GNU) by entering this command: sudo apt install gddrescue References https://opensource.com/article/18/7/how-use-dd-linux https://askubuntu.com/questions/803789/testdisk-is-showing-wrong-size-of-drive https://superuser.com/questions/1024643/in-which-case-should-i-prefer-dd-over-gnu- ddrescue Manual https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html Disk Recovery Tools CloneZilla CloneZilla is useful disk cloning software that can be installed using Windows, MacOS, or Linux. sudo apt install clonezilla Using the uMount command, You will need to unmount the drives that you want to restore from / clone to: umount /dev/yourdrive #i.e. umount /dev/sdb/ umount /dev/sdc/ Disk Recovery Tools Repair/Fix HFS+ (macOS) partition using Ubuntu sudo apt-get install hfsprogs # Use fdisk to find the Mac Partition. sudo fdisk -l Disk /dev/sda: 465.8 GiB, 500107862016 bytes, 976773168 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: 00006451-5A98-0000-F944-0000E3560000 Device Start End Sectors Size Type /dev/sda1 40 409639 409600 200M EFI System We want to do a FSCK check on the mac partition. sda1 is the EFI partition, so the mac partition should be sda2 (verify this in fdisk). sudo fsck.hfsplus -fryd /dev/sda2 # -f will force a filesystem check even if the specified device is "clean". # -r will try to rebuild the catalog file on the specified file system # -y Tries to repair fielsystem errors automatically during the check Disk Recovery Tools TestDisk If you are trying to recover data from a failing hard drive, try to clone the drive first. Resort to TestDisk only if that fails. Also, you should really only try to use TestDisk on a recovered image on a healthy disk rather than a damaged image on a failing drive. The reason to use it in this way is because the write operations that TestDisk performs will likely aggravate or further damage the failing drive more. TestDisk is an excellent multi-purpose repair software. It can perform repairs on most partitions and partition tables, and make non-booting disks bootable again. It can also help in a pinch with data recovery, though you should run it on secured and recovered data only (see the warning above). Check https://www.cgsecurity.org/wiki/TestDisk#Filesystems for a complete list of supported filesystems. Install TestDisk On Linux, TestDisk is really easy to install via package management. Otherwise, if you use TestDisk on Windows or MacOS you will have to compile binaries to run TestDisk on those platforms. sudo apt upgrade sudo apt update sudo apt install testdisk Basic Commands Run TestDisk sudo testdisk Run TestDisk and provide debugging and a log file. sudo testdisk /debug /log TestDisk - Data Recovery Examples https://www.cgsecurity.org/wiki/Data_Recovery_Examples WSL You can run a GNU/Linux environment in a terminal on Windows through Windows Subsystem for Linux (WSL). Note: Not all Ubuntu commands/programs will work in the WSL, including but not limited to disk restore/repair software. WSL2 is out, which improves overall performance using an entirely new software architecture. Install WSL Format and Wipe Free Disk Space You can use the DD command to completely clean a disk and make it difficult to reconstruct the drive and preexisting data on it. This is great if the drive had confidential files/information on it and you need to discard it or give it away. Identify your drives! List your available drives, their available partitions and storage information: lsblk You might see output like this, where there is a list of given disk names and their partitions. sda is most likely the internal disk of your computer, and sdb or sdc are probably your external drives (make sure you verify which disk is which): sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 260M 0 part /boot/efi ├─sda2 8:2 0 16M 0 part ├─sda3 8:3 0 814.3G 0 part ├─sda4 8:4 0 980M 0 part ├─sda5 8:5 0 18.4G 0 part ├─sda6 8:6 0 40.9G 0 part / ├─sda7 8:7 0 3.7G 0 part └─sda8 8:8 0 33.5G 0 part /home sdb 8:16 0 4.6T 0 disk ├─sdb1 8:17 0 200M 0 part └─sdb2 8:18 0 4.6T 0 part sdc 8:32 0 7.3T 0 disk ├─sdc1 8:33 0 200M 0 part └─sdc2 8:34 0 4.6T 0 part sr0 11:0 1 1024M 0 rom Lets say that sdb represents a drive that I want to completely wipe and jumble the data. The drive is a 5TB drive in this example. Write Zeros all over the drive dd if=/dev/zero of=/dev/sdb2 #Where sdb2 is the partition on your disk (sdb) you want to wipe. or Write random characters all over the drive dd if=/dev/urandom of=/dev/sdb2 #Where sdb2 is the partition on your disk (sdb) you want to wipe..