this post was submitted on 25 Dec 2023
50 points (93.1% liked)

Linux

48224 readers
709 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
50
What would be the best way for me to recover data from my old laptop's hard drive, which seems to have a bad superblock? (lemmy.ml)
submitted 10 months ago by vortexal@lemmy.ml to c/linux@lemmy.ml
24 comments fedilink hide all child comments
 

I got an external hard drive enclosure for the purpose of recovering some of the files from my old laptops hard drive. The hard drive and all of it's partitions show up in both disks and gparted but it wont mount. When I tried to mount it manually, it gave the error message stating that it can't read the superblock. I've never had to deal with this issue before, so the only things I've tried so far were fsck and the data recovery option in GParted, and neither of them helped.

I tried searching about it online but all of the solutions I found online either didn't work or required methods that are currently not possible for me. The hard drive had Ubuntu (22.04 if I remember correctly) installed on it and I just need access to the files in the sdd3 partition, which was formatted in ext4.

all 25 comments
sorted by: hot top controversial new old
[–] aard@kyu.de 38 points 10 months ago (4 children)

First step, in case you didn't do that yet: Create a disk image of the partition - you don't want to try data recovery on the actual data. Easiest is just using dd to dump the disk to another drive.

Next try running testdisk on the image to see if it can find the backup superblocks - if it does you can feed that to fsck to restore the filesystem.

If you know the blocksize of the filesystem you can also run mke2fs with the -S parameter - this will just write the superblocks. Again, only do that on a disk image, not the actual drive.

[–] OmnipotentEntity@beehaw.org 5 points 10 months ago (2 children)

If the disc is corrupted it may be failing, recommending ddrescue over dd is probably a better call not knowing anything else about this situation. Essentially, no reason not to use it.

[–] noUsernamesLef7@infosec.pub 3 points 10 months ago

I swear by ddrescue. It's a situation I strive to never be but i've been there before. I used it once to rescue an employees masters capstone project from their dead work laptop.

[–] aard@kyu.de 1 points 10 months ago

After reading about it - true. Disadvantage of doing this stuff for a long time - you miss new developments. Only reason I'm aware of testdisk is that I lost the sources of my own superblock search tool, my old binaries broke with a newer glibc, and before reimplementing it I checked if sombody else had done that in a more usable form in the meantime.

[–] cmnybo@discuss.tchncs.de 3 points 10 months ago (1 children)

The hard drive should be connected by SATA or eSATA when making the image. Connecting over USB is just asking for more trouble when the drive is not working correctly.

[–] aard@kyu.de 2 points 10 months ago

That has changed over the last few years - I'd prefer a proper usb3 to sata bridge over a shitty sata controller - and the quality of integrated sata controllers isn't that great nowadays.

[–] vortexal@lemmy.ml 3 points 10 months ago (2 children)

That's one of the solutions I saw that I currently can't do because I have no other device that I can use for that.

[–] redcalcium@lemmy.institute 20 points 10 months ago

You can decide yourself if the data in that disk is more valuable than the price of a new disk to store the backup image. If it's not that valuable I guess you can one-shot it.

[–] aard@kyu.de 11 points 10 months ago (1 children)

You can do all of that on the device - but you only get one shot. If you mess up that's it - so no sensible person would try any form of data rescue directly on the device. Storage is cheap, if you don't have sufficient space on your computer just get another external disk.

[–] vortexal@lemmy.ml -4 points 10 months ago* (last edited 10 months ago) (2 children)

I know you wont understand where I'm coming from so I wont bother explaining it. If I need another storage device than I'll just have to wait until next year to get another storage device.

Edit: I don't understand why I'm getting downvoted but it proves to me that I made the right choice in not explaining my situation.

[–] aard@kyu.de 27 points 10 months ago

In that case I'd recommend waiting until next year before attempting recovery.

[–] olosta@lemmy.world 3 points 10 months ago (1 children)

The target storage device for the image can be over the network if that's an option for you.

I admit the downvote is weird.

[–] vortexal@lemmy.ml 2 points 10 months ago* (last edited 10 months ago) (1 children)

I don't think I can use that mostly because my internet package has a data cap and I don't want to risk exceeding that.

Also, I know it's not really the time or place for this type of discussion but I've noticed recently (within the last few months) that for some reason the Lemmy community has changed. I don't know if anyone else feels that way but it sometimes seems like some users are unnecessarily hostile/judgemental towards me. I wont say anything more because once again, this is not the time or the place but Lemmy wasn't like this when I first started using it over two years ago.

[–] moonpiedumplings@programming.dev 3 points 10 months ago

By "network" they also meant you can export the disk image to another device on your local network, rather than over the internet.

[–] franzcoz@feddit.cl 1 points 10 months ago

Another tool that has helped me when the others couldn't was RecuperaBit. It has the same restrictions though, you have to do it on an image of the drive.

[–] bizdelnick@lemmy.ml 9 points 10 months ago (2 children)

Try testdisk. It can copy files from damaged filesystem without touching it. But only if you are lucky enough and the filesystem is not so heavily damaged that testdisk will be unable to find it.

[–] EddoWagt@feddit.nl 2 points 10 months ago

I have had great results with testdisk. At one point my dad's external hard drive was so messed up that a local IT company couldn't fix it. Mind you all our family and vacation pictures where on there, so it was kind of important. I think it took me a couple of hours, but with testdisk I was able to recover everything

[–] vortexal@lemmy.ml 1 points 10 months ago (1 children)

Assuming I'm using it correctly, it doesn't seem to be working for me. It sees the partitions but then it says that they can't be recovered. But it's weird because it's for some reason saying that there is two unreadable partitions called "ms data", which unless it's referring to some partitions that were deleted when I install Ubuntu, I have no idea what they are supposed to be.

[–] bizdelnick@lemmy.ml 2 points 10 months ago

Yes, it could find partitions removed long time ago if filesystem headers were not overriden.

[–] Molten_Moron@lemmings.world 6 points 10 months ago

As others have said, first make a full copy of the disk so you're not working on a failing drive.

Then, I highly recommend DDRescue

[–] possiblylinux127@lemmy.zip 4 points 10 months ago

The first thing you should do is create a raw backup of the data. The more you use this drive the worse the failure gets.

[–] mvirts@lemmy.world 3 points 10 months ago* (last edited 10 months ago) (1 children)

The quick and dirty way I've used is...

Use the nbd system (network block devices) and qemu to create a qcow2 image with your defective device as the base device. Serve this qcow2 image with qemu-nbd and attach it as a NBD device locally. Then run fsck or testdisk on the NBD device. This will let you repair the filesystem Linux sees without writing to the disk. Testdisk can scan for any filesystems left on the device if the partitions no longer match filesystems.

Also, if all else fails use photorec to slice the file types you need.

Also, ddrescue can try to read any actually failing sectors and work out what they contain, but puts a lot of stress on the device.

Beware, any method that puts more wear on the disk should not be used unless you're willing to accept the risk that the drive could get worse.

[–] vortexal@lemmy.ml 2 points 10 months ago

I don't know how to do any of that first part. All of the data on the drive is replaceable, it's just going to be very tedious and time consuming. I'm currently trying one other method and I think after I'm done with that, that I'm just going to skip trying to recover the data. I had some other plans for what I wanted to do with this device and I think trying to recover the data isn't worth it at this point.

[–] MonkderZweite@feddit.ch 1 points 10 months ago

First create an image (cat /dev/your-disk > /path/your/image) and use recovery tools on there.