Re: Tools to retrieve images from dead hard drive and/or deleted partitions
Hi,
On Fri, Dec 28, 2012 at 01:23:47PM +0100, Ralf Mardorf wrote:
...
> PS: Even if you make a backup first, by all means mount the drive or
> partition read only, before you access it.
Hmmm... Maybe I was too short on explanation.
The best practice is "NOT TO MOUNT AT ALL".
If your desktop system auto mount disk, just run like:
$ sudo mount
... check output to see if device is automounted:
$ sudo umount /dev/sdc1 (or what ever disk partition mounted)
(It is better not to face this situation but this tends to happen
unintentionally.)
Use "dd" to make disk image. For that you do not need to mount
drive. From root with /dev/sdc being bad drive and /dev/sdd being good
bigger drive, do this first.
root # dd if=/dev/sdc of=/dev/sdd
This is the best way to get a safe copy to work with the testdisk
command on the copy. This way, recovered data is safe too.
See more on this
http://www.debian.org/doc/manuals/debian-reference/ch10.en.html#_making_the_disk_image_file
Osamu
PS: I am not recommending to mount nor work on the original data disk.
Reply to: