[LAU] [ot] Data recovery

[Gabriel M. Beddingfield]

On 09/09/2012 10:33 AM, Robin Gareus wrote:
> First of all: Immediately unmount or read-only-remount the partition
> (mount -o remount,rw /dev/...) -- worst case SysRq+u (remount all
> read-only), SysRq+b (reboot now), boot a live-CD rescue-system.

Suggestion in addition to Robin's...

If you can... create a byte-for-byte back-up of the partition (using dd).  E.g.

$ sudo dd if=/dev/sda1 of=/media/usbdrive/my-backup-of-sda1.img bs=1M

This way you can continue working on your hard drive while you do "off-line" recovery on the filesystem img.

Mount an image like this for doing your recovery work:

$ sudo mkdir /mnt/my-recovery
$ sudo mount -o loop,ro /media/usbdrive/my-backup-of-sda1.img /mnt/my-recovery

WARNING: Be VERY CAREFUL when using dd.  It will unconditionally overwrite anything you put in the 'of' parameter... including your hard drive.  This is true even if mounted read-only... it will kill.

-gabriel