| 3562 |
|
|
| 3563 |
|
|
| 3564 |
|
|
|
Data Recovery |
|
|
============================================================================== |
|
|
|
|
|
Intro |
|
|
**************************************** |
|
|
Deleted or "lost" files can be recovered from failed or formatted drives |
|
|
and partitions, cdroms and memory cards using the software available in |
|
|
SystemRescueCD. |
|
|
|
|
|
Unless you can rule out hardware failure, you must not write to the failed |
|
|
device. The following software will passively try to recover your data |
|
|
from failed or failing hardware. If your data is not replaceable, do not |
|
|
attempt to write to the failed device if the following applications do |
|
|
not work but seek professional advice instead. |
|
|
|
|
|
If your device is damaged, it is advisable to image the device and work on |
|
|
the image file for data recovery. If hardware failure is not the problem, |
|
|
you can recover data directly from the device. |
|
|
|
|
|
To recover data from a failed device, you will need another device of equal |
|
|
or greater storage capacity onto which to save your data. If you need to make |
|
|
an image of the failed device, you will need yet another quantity of space. |
|
|
|
|
|
I should state here, that I haven't used any of these tools recently (other |
|
|
than plain and simple dd, a long time ago, which I found to be very slow), |
|
|
so I couldn't recommend any of them. Any comments on a tool's usability |
|
|
found in this page, is just what I found on the Net. |
|
|
|
|
|
Partition recovery |
|
|
**************************************** |
|
|
If you made a mistake while partitioning and the partition no longer appears |
|
|
in the partition table, so long as you have not written data in that space, |
|
|
all your data is still there and can be restored. |
|
|
|
|
|
When changing the partition table on your hard drive, you must ensure that |
|
|
no partition on the disk is mounted. This includes swap space. In order |
|
|
to restore your partition, execute: |
|
|
|
|
|
swapoff -a |
|
|
parted /dev/old_disk |
|
|
|
|
|
Then, use the rescue option: |
|
|
|
|
|
rescue START END |
|
|
|
|
|
where START is the area of the disk where you believe the partition began |
|
|
and END is it's end. If parted finds a potential partition, it will ask |
|
|
you if you want to add it to the partition table. |
|
|
|
|
|
Note: TestDisk can also be used to recover a "lost" partition. |
|
|
|
|
|
Disk / files recovery |
|
|
**************************************** |
|
|
Using dd |
|
|
--------------------- |
|
|
In order to duplicate a disk to another disk, execute |
|
|
|
|
|
dd if=/dev/old_disk of=/dev/new_disk conv=noerror,sync |
|
|
|
|
|
or to create an image file |
|
|
|
|
|
dd if=/dev/old_disk of=image_file conv=noerror |
|
|
|
|
|
Be careful, if you are copying a disk, the destination must also be a disk, |
|
|
not a partition. If you are copying a partition, the destination partition |
|
|
must be large enough. Copying the whole disk is recommended. |
|
|
|
|
|
To speed up the copy process, you can append bs=8k, it will read/write |
|
|
the disk by 16 sectors at a time. |
|
|
|
|
|
Using dd_rescue |
|
|
--------------------- |
|
|
Like dd, dd_rescue {{ http://www.garloff.de/kurt/linux/ddrescue/ }} does |
|
|
copy data from one file or block device to another. You can specify file |
|
|
positions (called seek and skip in dd). There are several differences: |
|
|
|
|
|
* dd_rescue does not provide character conversions. |
|
|
* The command syntax is different. Call dd_rescue -h. |
|
|
* dd_rescue does not abort on errors on the input file, unless you specify a |
|
|
maximum error number. Then dd_rescue will abort when this number is reached. |
|
|
* dd_rescue does not truncate the output file, unless asked to. |
|
|
* You can tell dd_rescue to start from the end of a file and move backwards. |
|
|
* It uses two block sizes, a large (soft) block size and a small (hard) |
|
|
block size. In case of errors, the size falls back to the small one and |
|
|
is promoted again after a while without errors. |
|
|
* It does not (yet) support non-seekable in- or output. |
|
|
|
|
|
In order to duplicate a disk to another disk, execute |
|
|
|
|
|
dd_rescue -A -v /dev/old_disk /dev/new_disk |
|
|
|
|
|
or to create an image file |
|
|
|
|
|
dd_rescue -A -v /dev/old_disk image_file |
|
|
|
|
|
The copying should go very quickly until it hits a bad sector and then it |
|
|
will slow down to take smaller chunks of data. People have reported very |
|
|
good results with this technique. |
|
|
|
|
|
Using GNU ddrescue |
|
|
--------------------- |
|
|
The GNU site describes GNU ddrescue as a data recovery tool, and lists |
|
|
these features: |
|
|
|
|
|
* It copies data from one file or block device (hard disc, CD-ROM, etc) |
|
|
to another, trying hard to rescue data in case of read errors. |
|
|
* It does not truncate the output file if not asked to, so every time you |
|
|
run it on the same output file, it tries to fill in the gaps. |
|
|
* It is designed to be fully automatic. |
|
|
* If you use the log file feature of GNU ddrescue, the data is rescued very |
|
|
efficiently (only the needed blocks are read). Also you can interrupt the |
|
|
rescue at any time and resume it later at the same point. |
|
|
* The log file is periodically saved to disc. So in case of a crash you |
|
|
can resume the rescue with little recopying. |
|
|
* If you have two or more damaged copies of a file, CD-ROM, etc, and run |
|
|
GNU ddrescue on all of them, one at a time, with the same output file, |
|
|
you will probably obtain a complete and error-free file. The probability |
|
|
of having damaged areas at the same places on different input files is |
|
|
very low. Using the log file, only the needed blocks are read from the |
|
|
second and successive copies. |
|
|
* The same log file can be used for multiple commands that copy different |
|
|
areas of the file, and for multiple recovery attempts over different subsets. |
|
|
|
|
|
The algorithm of GNU ddrescue is as follows: |
|
|
|
|
|
* Optionally read a log file describing the status of a multi-part or |
|
|
previously interrupted rescue. |
|
|
* Read the non-damaged parts of the input file, skipping the damaged areas, |
|
|
until the requested size is reached, or until interrupted by the user. |
|
|
* Try to read the damaged areas, splitting them into smaller pieces and |
|
|
reading the non-damaged pieces, until the hardware block size is reached, |
|
|
or until interrupted by the user. |
|
|
* Try to read the damaged hardware blocks until the specified number of |
|
|
retries is reached, or until interrupted by the user. |
|
|
* Optionally write a log file for later use. |
|
|
|
|
|
Note: GNU ddrescue is considered to be the best recovery tool available. |
|
|
|
|
|
In order to duplicate a disk to another disk, execute |
|
|
|
|
|
ddrescue -vr3 /dev/old_disk /dev/new_disk logfile |
|
|
|
|
|
or to create an image file |
|
|
|
|
|
ddrescue -vr3 /dev/old_disk image_file logfile |
|
|
|
|
|
If the disk is failing fast and you want to get the most data out of it |
|
|
on the first try, you should probably use "-n" on the first run. This |
|
|
will avoid splitting error areas. Subsequent runs can use "-r1" or "-r3", |
|
|
without "-n", to retry those error areas. |
|
|
|
|
|
To summarise, we execute: |
|
|
|
|
|
ddrescue -vn /dev/old_disk image_file logfile |
|
|
ddrescue -v -r3 -C /dev/old_disk image_file logfile |
|
|
|
|
|
Note: When working with CD-ROMs you should probably specific "-b 2048" |
|
|
|
|
|
Using Foremost |
|
|
--------------------- |
|
|
Foremost {{ http://foremost.sourceforge.net/ }} is a console program |
|
|
to recover files based on their headers, footers, and internal data |
|
|
structures. This process is commonly referred to as data carving. Foremost |
|
|
can work on image files, such as those generated by dd, Safeback, Encase, |
|
|
etc, or directly on a drive. The headers and footers can be specified |
|
|
by a configuration file or you can use command line switches to specify |
|
|
built-in file types. These built-in types look at the data structures of |
|
|
a given file format allowing for a more reliable and faster recovery. |
|
|
|
|
|
It can be run on an image file created with any of the above tools, to |
|
|
extract files: |
|
|
|
|
|
foremost -i image -o /recovery/foremost |
|
|
|
|
|
Foremost can be instructed to recover only specific file types, using the |
|
|
-t command line parameter. In the following example Foremost will extract |
|
|
only jpg files: |
|
|
|
|
|
foremost -t jpg -i image -o /recovery/foremost |
|
|
|
|
|
Available types are: jpg, gif, png, bmp, avi, exe (Windows binaries and |
|
|
DLLs), wav, riff, wmv (will extract wma also), mov, pdf, ole (will extract |
|
|
any file using the OLE file structure; this includes PowerPoint, Word, |
|
|
Excel, Access, and StarWriter), doc, zip (will extract .jar files and Open |
|
|
Office docs as well; this includes SXW, SXC, SXI, and SX? for undetermined |
|
|
OpenOffice files), rar, html and cpp. |
|
|
|
|
|
Using TestDisk |
|
|
--------------------- |
|
|
TestDisk {{ http://www.cgsecurity.org/wiki/TestDisk }} was primarily |
|
|
designed to help recover "lost" partitions and/or make non-booting disks |
|
|
bootable again when these symptoms are caused by faulty software, certain |
|
|
types of viruses or human error (such as accidentally deleting a Partition |
|
|
Table). Partition table recovery using TestDisk is really easy. |
|
|
|
|
|
TestDisk can |
|
|
|
|
|
* Fix partition table, recover deleted partition |
|
|
* Recover FAT32 boot sector from its backup |
|
|
* Rebuild FAT12/FAT16/FAT32 boot sector |
|
|
* Fix FAT tables |
|
|
* Rebuild NTFS boot sector |
|
|
* Recover NTFS boot sector from its backup |
|
|
* Fix MFT using MFT mirror |
|
|
* Locate ext2/ext3 Backup SuperBlock |
|
|
|
|
|
Some great tutorials are available at TestDisk's site: "TestDisk Step |
|
|
By Step {{ http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step }}", |
|
|
"Running TestDisk", "Data Recovery Examples" etc. |
|
|
|
|
|
Using PhotoRec |
|
|
--------------------- |
|
|
PhotoRec {{ http://www.cgsecurity.org/wiki/PhotoRec }} is file data recovery |
|
|
software designed to recover "lost" files including video, documents |
|
|
and archives from Hard Disks and CDRom and "lost" pictures (thus, its |
|
|
'Photo Recovery' name) from digital camera memory. PhotoRec ignores the |
|
|
filesystem and goes after the underlying data, so it will still work even |
|
|
if your media's filesystem has been severely damaged or re-formatted. |
|
|
|
|
|
For more safety, PhotoRec uses read-only access to handle the drive or |
|
|
memory support you are about to recover "lost" data from. |
|
|
|
|
|
Important: As soon as a pic or file is accidentally deleted, or you discover |
|
|
any missing, do NOT save any more pics or files to that memory device or |
|
|
hard disk drive; otherwise you may overwrite your "lost" data. This means |
|
|
that even using PhotoRec, you must not choose to write the recovered files |
|
|
to the same partition they were stored on. |
|
|
|
|
|
A great tutorial titled "PhotoRec Step By Step {{ |
|
|
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step }}" can be found at |
|
|
PhotoRec's site. |
|
|
|
|
|
Links & resources |
|
|
**************************************** |
|
|
This page is a compilation of the following pages: |
|
|
|
|
|
DataRecovery |
|
|
https://help.ubuntu.com/community/DataRecovery |
|
|
|
|
|
Hard Drive Recovery, Ubuntu-Style |
|
|
http://blogs.sun.com/superpat/tags/ddrescue |
|
|
|
|
|
Recover Data and (deleted) Partition with Linux from Hard Drives, CD-ROMs |
|
|
or DVDs |
|
|
http://sysblogd.wordpress.com/2008/01/05/data-recovery-with-linux-from-hard-drives-cd-roms-or-dvds/ |
|
|
|
|
|
dd_rescue |
|
|
http://www.garloff.de/kurt/linux/ddrescue/ |
|
|
|
|
|
gddrescue: a tool for recovering data from damaged media |
|
|
http://debaday.debian.net/2007/12/12/gddrescue-a-tool-for-recovering-data-from-damaged-media/ |
|
|
|
|
|
Foremost |
|
|
http://foremost.sourceforge.net/ |
|
|
|
|
|
TestDisk |
|
|
http://www.cgsecurity.org/wiki/TestDisk |
|
|
|
|
|
PhotoRec |
|
|
http://www.cgsecurity.org/wiki/PhotoRec |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Clonezilla-SysRescCD own scripts |
|
|
============================================================================== |
|
|
|
|
|
Intro |
|
|
**************************************** |
|
|
In this page I will present the scripts I have ever written for |
|
|
Clonezilla-SysRescCD |
|
|
|
|
|
what-cd |
|
|
**************************************** |
|
|
Included in: SystemRescueCD |
|
|
|
|
|
This script determines the device names for your CDs/DVDs, and whether |
|
|
they can read/write CD/DVD-ROMs |
|
|
|
|
|
Its help screen is the following: |
|
|
|
|
|
# what-cd -h |
|
|
what-cd - v 1.0.0 - S. Georgaras <sng@hellug.gr> |
|
|
|
|
|
what-cd will try to identify your CD/DVDs |
|
|
You can use it to identify the device name of your CD-Reader (default), |
|
|
CD-Writer, DVD-Reader, and DVD-Writer. |
|
|
|
|
|
Usage: what-cd [options] |
|
|
Availabe options are: |
|
|
d Print info about DVDs |
|
|
w Print info about writers |
|
|
b Batch mode. Only print one device name. |
|
|
If more than one device is found, print |
|
|
nothing. For use with scripts |
|
|
e deviceID Eject device deviceID |
|
|
Accecpable values: -1...num of devices |
|
|
Use -1 when in batch mode |
|
|
v Print version info and exit |
|
|
h Print this screen and exit |
|
|
|
|
|
Its typical usage would be to identify the DVD writer: |
|
|
|
|
|
# what-cd -dw |
|
|
Device /dev/hdd (id=0) can not write DVDs |
|
|
Device /dev/hdc (id=1) can write DVDs |
|
|
|
|
|
When used in batch mode, it will only print a device name. This is |
|
|
especially useful in scripts, but also in the command line, as shown in |
|
|
section "Burning the DVD". |
|
|
|
|
|
# what-cd -dwb |
|
|
/dev/hdc |
|
|
|
|
|
continue-multi-cd |
|
|
**************************************** |
|
|
Included in: SystemRescueCD |
|
|
|
|
|
continue-multi-cd helps you append data to a multi session CD; that is |
|
|
it helps you prepare and burn any consecutive sessions to it. It may lack |
|
|
some of the functionality you would have had if you used the command line |
|
|
tools themselves (mksiofs and cdrecord), but because of it, it keeps you |
|
|
away from writing a lot of parameters. |
|
|
|
|
|
You could use it for example, to burn some extra documentation to |
|
|
Clonezilla-SysRescCD CD, but you cannot use it to change the configuration |
|
|
files of isolinux, as it just reads the first session when booting. |
|
|
|
|
|
Its help screen is the following: |
|
|
|
|
|
# continue-multi-cd -h |
|
|
continue-multi-cd - v 2.0.0 - S. Georgaras <sng@hellug.gr> |
|
|
|
|
|
Usage: continue-multi-cd [options] <path to be added to CD> |
|
|
|
|
|
Available options are: |
|
|
d Specify write device (in case auto detection does |
|
|
not work) |
|
|
c Close the CD. No more burning will be possible |
|
|
Default is to leave it open |
|
|
l Don't burn the CD after image creation |
|
|
o <image name> Save the image file as <image name> |
|
|
r Remove the image file after burning |
|
|
f On the fly burning of the CD. No image file will |
|
|
be created |
|
|
v Print version info and exit |
|
|
h Print this screen and exit |
|
|
|
|
|
You have to note one thing though: the folder <path to be added to CD> |
|
|
will not be present on the CD; only its contents will. |
|
|
|
|
|
Let's suppose that you want to add to the CD the folder extra-doc, |
|
|
which contains q-a.html and faq.html, and that its full path is |
|
|
/home/user/extra-doc. If you issue the command |
|
|
|
|
|
continue-multi-cd -mwr /home/user/extra-doc |
|
|
|
|
|
you will not have a extra-doc folder on the root of your CD, but the files |
|
|
q-a.html and faq.html will be present there. |
|
|
|
|
|
In order to have extra-doc on the CD, you have to copy it to a temporary |
|
|
location and pass that path to continue-multi-cd. Let's see how it's done: |
|
|
|
|
|
mkdir -p /tmp/for-the-cd |
|
|
cp -r /home/user/extra-doc /tmp/for-the-cd |
|
|
continue-multi-cd -r /tmp/for-the-cd |
|
|
rm -rf /tmp/for-the-cd |
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3565 |
Managing partitions |
Managing partitions |
| 3566 |
============================================================================== |
============================================================================== |
| 3567 |
|
|
| 4118 |
in /dev/sda1 still works. Anyway, the disk should now be ready for the |
in /dev/sda1 still works. Anyway, the disk should now be ready for the |
| 4119 |
new distro. |
new distro. |
| 4120 |
|
|
| 4121 |
|
Partition list |
| 4122 |
|
--------------------- |
| 4123 |
|
The following table presents known partition types along with their IDs: |
| 4124 |
|
|
| 4125 |
|
0 Empty 80 Old Minix |
| 4126 |
|
1 FAT12 81 Minix / old Linux |
| 4127 |
|
2 XENIX root 82 Linux swap / Solaris |
| 4128 |
|
3 XENIX usr 83 Linux |
| 4129 |
|
4 FAT16 <32M 84 OS/2 hidden C: drive |
| 4130 |
|
5 Extended 85 Linux extended |
| 4131 |
|
6 FAT16 86 NTFS volume set |
| 4132 |
|
7 HPFS/NTFS 87 NTFS volume set |
| 4133 |
|
8 AIX 88 Linux plaintext |
| 4134 |
|
9 AIX bootable 8e Linux LVM |
| 4135 |
|
a OS/2 Boot Manager 93 Amoeba |
| 4136 |
|
b W95 FAT32 94 Amoeba BBT |
| 4137 |
|
c W95 FAT32 (LBA) 9f BSD/OS |
| 4138 |
|
e W95 FAT16 (LBA) a0 IBM Thinkpad hibernation |
| 4139 |
|
f W95 Ext'd (LBA) a5 FreeBSD |
| 4140 |
|
10 OPUS a6 OpenBSD |
| 4141 |
|
11 Hidden FAT12 a7 NeXTSTEP |
| 4142 |
|
12 Compaq diagnostics a8 Darwin UFS |
| 4143 |
|
14 Hidden FAT16 <32M a9 NetBSD |
| 4144 |
|
16 Hidden FAT16 ab Darwin boot |
| 4145 |
|
17 Hidden HPFS/NTFS b7 BSDI fs |
| 4146 |
|
18 AST SmartSleep b8 BSDI swap |
| 4147 |
|
1b Hidden W95 FAT32 bb Boot Wizard hidden |
| 4148 |
|
1c Hidden W95 FAT32 (LBA) be Solaris boot |
| 4149 |
|
1e Hidden W95 FAT16 (LBA) bf Solaris |
| 4150 |
|
24 NEC DOS c1 DRDOS/sec (FAT-12) |
| 4151 |
|
39 Plan 9 c4 DRDOS/sec (FAT-16 |
| 4152 |
|
3c PartitionMagic recovery c6 DRDOS/sec (FAT-16) |
| 4153 |
|
40 Venix 80286 c7 Syrinx |
| 4154 |
|
41 PPC PReP Boot da Non-FS data |
| 4155 |
|
42 SFS db CP/M / CTOS / ... |
| 4156 |
|
4d QNX4.x de Dell Utility |
| 4157 |
|
4e QNX4.x 2nd part df BootIt |
| 4158 |
|
4f QNX4.x 3rd part e1 DOS access |
| 4159 |
|
50 OnTrack DM e3 DOS R/O |
| 4160 |
|
51 OnTrack DM6 Aux1 e4 SpeedStor |
| 4161 |
|
52 CP/M eb BeOS fs |
| 4162 |
|
53 OnTrack DM6 Aux3 ee EFI GPT |
| 4163 |
|
54 OnTrackDM6 ef EFI (FAT-12/16/32) |
| 4164 |
|
55 EZ-Drive f0 Linux/PA-RISC boot |
| 4165 |
|
56 Golden Bow f1 SpeedStor |
| 4166 |
|
5c Priam Edisk f4 SpeedStor |
| 4167 |
|
61 SpeedStor f2 DOS secondary |
| 4168 |
|
63 GNU HURD or SysV fd Linux raid autodetect |
| 4169 |
|
64 Novell Netware 286 fe LANstep |
| 4170 |
|
65 Novell Netware 386 ff BBT |
| 4171 |
|
70 DiskSecure Multi-Boot |
| 4172 |
|
75 PC/IX |
| 4173 |
|
|
| 4174 |
|
The partitions you are most likely to see in use, are: |
| 4175 |
|
|
| 4176 |
|
* FAT16 (ID = 6) |
| 4177 |
|
This is the old DOS partition type |
| 4178 |
|
You may still find it in pure DOS installations, like vendor diagnostics |
| 4179 |
|
tool partitions, and small USB sticks (128 - 250 MB) |
| 4180 |
|
|
| 4181 |
|
* HPFS/NTFS (ID = 7) |
| 4182 |
|
This is the Windows XP partition, also known as NTFS |
| 4183 |
|
|
| 4184 |
|
* W95 FAT32 (LBA) (ID = c) |
| 4185 |
|
This is the Windows 95 - 98 partition |
| 4186 |
|
It is used in any kind of disk and large USB devices (1 GB and more) |
| 4187 |
|
|
| 4188 |
|
* W95 Ext'd (LBA) (ID = f) |
| 4189 |
|
Extended partition. It acts as a container for other partitions |
| 4190 |
|
There is one more extended partition type (ID = 5), but it does not seem |
| 4191 |
|
to be in use as much |
| 4192 |
|
|
| 4193 |
|
* Linux swap / Solaris (ID = 82) |
| 4194 |
|
Swap partition, acting as Virtual Memory |
| 4195 |
|
Modern computers with 1 - 2 GB of memory may not use it at all |
| 4196 |
|
|
| 4197 |
|
* Linux (ID = 83) |
| 4198 |
|
Linux partitions, such as ext2, ext3 and reiserfs |
| 4199 |
|
|
| 4200 |
|
|
| 4201 |
|
|
| 4202 |
|
|
| 4203 |
|
Data Recovery |
| 4204 |
|
============================================================================== |
| 4205 |
|
|
| 4206 |
|
Intro |
| 4207 |
|
**************************************** |
| 4208 |
|
Deleted or "lost" files can be recovered from failed or formatted drives |
| 4209 |
|
and partitions, cdroms and memory cards using the software available in |
| 4210 |
|
SystemRescueCD. |
| 4211 |
|
|
| 4212 |
|
Unless you can rule out hardware failure, you must not write to the failed |
| 4213 |
|
device. The following software will passively try to recover your data |
| 4214 |
|
from failed or failing hardware. If your data is not replaceable, do not |
| 4215 |
|
attempt to write to the failed device if the following applications do |
| 4216 |
|
not work but seek professional advice instead. |
| 4217 |
|
|
| 4218 |
|
If your device is damaged, it is advisable to image the device and work on |
| 4219 |
|
the image file for data recovery. If hardware failure is not the problem, |
| 4220 |
|
you can recover data directly from the device. |
| 4221 |
|
|
| 4222 |
|
To recover data from a failed device, you will need another device of equal |
| 4223 |
|
or greater storage capacity onto which to save your data. If you need to make |
| 4224 |
|
an image of the failed device, you will need yet another quantity of space. |
| 4225 |
|
|
| 4226 |
|
I should state here, that I haven't used any of these tools recently (other |
| 4227 |
|
than plain and simple dd, a long time ago, which I found to be very slow), |
| 4228 |
|
so I couldn't recommend any of them. Any comments on a tool's usability |
| 4229 |
|
found in this page, is just what I found on the Net. |
| 4230 |
|
|
| 4231 |
|
Partition recovery |
| 4232 |
|
**************************************** |
| 4233 |
|
If you made a mistake while partitioning and the partition no longer appears |
| 4234 |
|
in the partition table, so long as you have not written data in that space, |
| 4235 |
|
all your data is still there and can be restored. |
| 4236 |
|
|
| 4237 |
|
When changing the partition table on your hard drive, you must ensure that |
| 4238 |
|
no partition on the disk is mounted. This includes swap space. In order |
| 4239 |
|
to restore your partition, execute: |
| 4240 |
|
|
| 4241 |
|
swapoff -a |
| 4242 |
|
parted /dev/old_disk |
| 4243 |
|
|
| 4244 |
|
Then, use the rescue option: |
| 4245 |
|
|
| 4246 |
|
rescue START END |
| 4247 |
|
|
| 4248 |
|
where START is the area of the disk where you believe the partition began |
| 4249 |
|
and END is it's end. If parted finds a potential partition, it will ask |
| 4250 |
|
you if you want to add it to the partition table. |
| 4251 |
|
|
| 4252 |
|
Note: TestDisk can also be used to recover a "lost" partition. |
| 4253 |
|
|
| 4254 |
|
Disk / files recovery |
| 4255 |
|
**************************************** |
| 4256 |
|
Using dd |
| 4257 |
|
--------------------- |
| 4258 |
|
In order to duplicate a disk to another disk, execute |
| 4259 |
|
|
| 4260 |
|
dd if=/dev/old_disk of=/dev/new_disk conv=noerror,sync |
| 4261 |
|
|
| 4262 |
|
or to create an image file |
| 4263 |
|
|
| 4264 |
|
dd if=/dev/old_disk of=image_file conv=noerror |
| 4265 |
|
|
| 4266 |
|
Be careful, if you are copying a disk, the destination must also be a disk, |
| 4267 |
|
not a partition. If you are copying a partition, the destination partition |
| 4268 |
|
must be large enough. Copying the whole disk is recommended. |
| 4269 |
|
|
| 4270 |
|
To speed up the copy process, you can append bs=8k, it will read/write |
| 4271 |
|
the disk by 16 sectors at a time. |
| 4272 |
|
|
| 4273 |
|
Using dd_rescue |
| 4274 |
|
--------------------- |
| 4275 |
|
Like dd, dd_rescue {{ http://www.garloff.de/kurt/linux/ddrescue/ }} does |
| 4276 |
|
copy data from one file or block device to another. You can specify file |
| 4277 |
|
positions (called seek and skip in dd). There are several differences: |
| 4278 |
|
|
| 4279 |
|
* dd_rescue does not provide character conversions. |
| 4280 |
|
* The command syntax is different. Call dd_rescue -h. |
| 4281 |
|
* dd_rescue does not abort on errors on the input file, unless you specify a |
| 4282 |
|
maximum error number. Then dd_rescue will abort when this number is reached. |
| 4283 |
|
* dd_rescue does not truncate the output file, unless asked to. |
| 4284 |
|
* You can tell dd_rescue to start from the end of a file and move backwards. |
| 4285 |
|
* It uses two block sizes, a large (soft) block size and a small (hard) |
| 4286 |
|
block size. In case of errors, the size falls back to the small one and |
| 4287 |
|
is promoted again after a while without errors. |
| 4288 |
|
* It does not (yet) support non-seekable in- or output. |
| 4289 |
|
|
| 4290 |
|
In order to duplicate a disk to another disk, execute |
| 4291 |
|
|
| 4292 |
|
dd_rescue -A -v /dev/old_disk /dev/new_disk |
| 4293 |
|
|
| 4294 |
|
or to create an image file |
| 4295 |
|
|
| 4296 |
|
dd_rescue -A -v /dev/old_disk image_file |
| 4297 |
|
|
| 4298 |
|
The copying should go very quickly until it hits a bad sector and then it |
| 4299 |
|
will slow down to take smaller chunks of data. People have reported very |
| 4300 |
|
good results with this technique. |
| 4301 |
|
|
| 4302 |
|
Using GNU ddrescue |
| 4303 |
|
--------------------- |
| 4304 |
|
The GNU site describes GNU ddrescue as a data recovery tool, and lists |
| 4305 |
|
these features: |
| 4306 |
|
|
| 4307 |
|
* It copies data from one file or block device (hard disc, CD-ROM, etc) |
| 4308 |
|
to another, trying hard to rescue data in case of read errors. |
| 4309 |
|
* It does not truncate the output file if not asked to, so every time you |
| 4310 |
|
run it on the same output file, it tries to fill in the gaps. |
| 4311 |
|
* It is designed to be fully automatic. |
| 4312 |
|
* If you use the log file feature of GNU ddrescue, the data is rescued very |
| 4313 |
|
efficiently (only the needed blocks are read). Also you can interrupt the |
| 4314 |
|
rescue at any time and resume it later at the same point. |
| 4315 |
|
* The log file is periodically saved to disc. So in case of a crash you |
| 4316 |
|
can resume the rescue with little recopying. |
| 4317 |
|
* If you have two or more damaged copies of a file, CD-ROM, etc, and run |
| 4318 |
|
GNU ddrescue on all of them, one at a time, with the same output file, |
| 4319 |
|
you will probably obtain a complete and error-free file. The probability |
| 4320 |
|
of having damaged areas at the same places on different input files is |
| 4321 |
|
very low. Using the log file, only the needed blocks are read from the |
| 4322 |
|
second and successive copies. |
| 4323 |
|
* The same log file can be used for multiple commands that copy different |
| 4324 |
|
areas of the file, and for multiple recovery attempts over different subsets. |
| 4325 |
|
|
| 4326 |
|
The algorithm of GNU ddrescue is as follows: |
| 4327 |
|
|
| 4328 |
|
* Optionally read a log file describing the status of a multi-part or |
| 4329 |
|
previously interrupted rescue. |
| 4330 |
|
* Read the non-damaged parts of the input file, skipping the damaged areas, |
| 4331 |
|
until the requested size is reached, or until interrupted by the user. |
| 4332 |
|
* Try to read the damaged areas, splitting them into smaller pieces and |
| 4333 |
|
reading the non-damaged pieces, until the hardware block size is reached, |
| 4334 |
|
or until interrupted by the user. |
| 4335 |
|
* Try to read the damaged hardware blocks until the specified number of |
| 4336 |
|
retries is reached, or until interrupted by the user. |
| 4337 |
|
* Optionally write a log file for later use. |
| 4338 |
|
|
| 4339 |
|
Note: GNU ddrescue is considered to be the best recovery tool available. |
| 4340 |
|
|
| 4341 |
|
In order to duplicate a disk to another disk, execute |
| 4342 |
|
|
| 4343 |
|
ddrescue -vr3 /dev/old_disk /dev/new_disk logfile |
| 4344 |
|
|
| 4345 |
|
or to create an image file |
| 4346 |
|
|
| 4347 |
|
ddrescue -vr3 /dev/old_disk image_file logfile |
| 4348 |
|
|
| 4349 |
|
If the disk is failing fast and you want to get the most data out of it |
| 4350 |
|
on the first try, you should probably use "-n" on the first run. This |
| 4351 |
|
will avoid splitting error areas. Subsequent runs can use "-r1" or "-r3", |
| 4352 |
|
without "-n", to retry those error areas. |
| 4353 |
|
|
| 4354 |
|
To summarise, we execute: |
| 4355 |
|
|
| 4356 |
|
ddrescue -vn /dev/old_disk image_file logfile |
| 4357 |
|
ddrescue -v -r3 -C /dev/old_disk image_file logfile |
| 4358 |
|
|
| 4359 |
|
Note: When working with CD-ROMs you should probably specific "-b 2048" |
| 4360 |
|
|
| 4361 |
|
Using Foremost |
| 4362 |
|
--------------------- |
| 4363 |
|
Foremost {{ http://foremost.sourceforge.net/ }} is a console program |
| 4364 |
|
to recover files based on their headers, footers, and internal data |
| 4365 |
|
structures. This process is commonly referred to as data carving. Foremost |
| 4366 |
|
can work on image files, such as those generated by dd, Safeback, Encase, |
| 4367 |
|
etc, or directly on a drive. The headers and footers can be specified |
| 4368 |
|
by a configuration file or you can use command line switches to specify |
| 4369 |
|
built-in file types. These built-in types look at the data structures of |
| 4370 |
|
a given file format allowing for a more reliable and faster recovery. |
| 4371 |
|
|
| 4372 |
|
It can be run on an image file created with any of the above tools, to |
| 4373 |
|
extract files: |
| 4374 |
|
|
| 4375 |
|
foremost -i image -o /recovery/foremost |
| 4376 |
|
|
| 4377 |
|
Foremost can be instructed to recover only specific file types, using the |
| 4378 |
|
-t command line parameter. In the following example Foremost will extract |
| 4379 |
|
only jpg files: |
| 4380 |
|
|
| 4381 |
|
foremost -t jpg -i image -o /recovery/foremost |
| 4382 |
|
|
| 4383 |
|
Available types are: jpg, gif, png, bmp, avi, exe (Windows binaries and |
| 4384 |
|
DLLs), wav, riff, wmv (will extract wma also), mov, pdf, ole (will extract |
| 4385 |
|
any file using the OLE file structure; this includes PowerPoint, Word, |
| 4386 |
|
Excel, Access, and StarWriter), doc, zip (will extract .jar files and Open |
| 4387 |
|
Office docs as well; this includes SXW, SXC, SXI, and SX? for undetermined |
| 4388 |
|
OpenOffice files), rar, html and cpp. |
| 4389 |
|
|
| 4390 |
|
Using TestDisk |
| 4391 |
|
--------------------- |
| 4392 |
|
TestDisk {{ http://www.cgsecurity.org/wiki/TestDisk }} was primarily |
| 4393 |
|
designed to help recover "lost" partitions and/or make non-booting disks |
| 4394 |
|
bootable again when these symptoms are caused by faulty software, certain |
| 4395 |
|
types of viruses or human error (such as accidentally deleting a Partition |
| 4396 |
|
Table). Partition table recovery using TestDisk is really easy. |
| 4397 |
|
|
| 4398 |
|
TestDisk can |
| 4399 |
|
|
| 4400 |
|
* Fix partition table, recover deleted partition |
| 4401 |
|
* Recover FAT32 boot sector from its backup |
| 4402 |
|
* Rebuild FAT12/FAT16/FAT32 boot sector |
| 4403 |
|
* Fix FAT tables |
| 4404 |
|
* Rebuild NTFS boot sector |
| 4405 |
|
* Recover NTFS boot sector from its backup |
| 4406 |
|
* Fix MFT using MFT mirror |
| 4407 |
|
* Locate ext2/ext3 Backup SuperBlock |
| 4408 |
|
|
| 4409 |
|
Some great tutorials are available at TestDisk's site: "TestDisk Step |
| 4410 |
|
By Step {{ http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step }}", |
| 4411 |
|
"Running TestDisk", "Data Recovery Examples" etc. |
| 4412 |
|
|
| 4413 |
|
Using PhotoRec |
| 4414 |
|
--------------------- |
| 4415 |
|
PhotoRec {{ http://www.cgsecurity.org/wiki/PhotoRec }} is file data recovery |
| 4416 |
|
software designed to recover "lost" files including video, documents |
| 4417 |
|
and archives from Hard Disks and CDRom and "lost" pictures (thus, its |
| 4418 |
|
'Photo Recovery' name) from digital camera memory. PhotoRec ignores the |
| 4419 |
|
filesystem and goes after the underlying data, so it will still work even |
| 4420 |
|
if your media's filesystem has been severely damaged or re-formatted. |
| 4421 |
|
|
| 4422 |
|
For more safety, PhotoRec uses read-only access to handle the drive or |
| 4423 |
|
memory support you are about to recover "lost" data from. |
| 4424 |
|
|
| 4425 |
|
Important: As soon as a pic or file is accidentally deleted, or you discover |
| 4426 |
|
any missing, do NOT save any more pics or files to that memory device or |
| 4427 |
|
hard disk drive; otherwise you may overwrite your "lost" data. This means |
| 4428 |
|
that even using PhotoRec, you must not choose to write the recovered files |
| 4429 |
|
to the same partition they were stored on. |
| 4430 |
|
|
| 4431 |
|
A great tutorial titled "PhotoRec Step By Step {{ |
| 4432 |
|
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step }}" can be found at |
| 4433 |
|
PhotoRec's site. |
| 4434 |
|
|
| 4435 |
|
Links & resources |
| 4436 |
|
**************************************** |
| 4437 |
|
This page is a compilation of the following pages: |
| 4438 |
|
|
| 4439 |
|
DataRecovery |
| 4440 |
|
https://help.ubuntu.com/community/DataRecovery |
| 4441 |
|
|
| 4442 |
|
Hard Drive Recovery, Ubuntu-Style |
| 4443 |
|
http://blogs.sun.com/superpat/tags/ddrescue |
| 4444 |
|
|
| 4445 |
|
Recover Data and (deleted) Partition with Linux from Hard Drives, CD-ROMs |
| 4446 |
|
or DVDs |
| 4447 |
|
http://sysblogd.wordpress.com/2008/01/05/data-recovery-with-linux-from-hard-drives-cd-roms-or-dvds/ |
| 4448 |
|
|
| 4449 |
|
dd_rescue |
| 4450 |
|
http://www.garloff.de/kurt/linux/ddrescue/ |
| 4451 |
|
|
| 4452 |
|
gddrescue: a tool for recovering data from damaged media |
| 4453 |
|
http://debaday.debian.net/2007/12/12/gddrescue-a-tool-for-recovering-data-from-damaged-media/ |
| 4454 |
|
|
| 4455 |
|
Foremost |
| 4456 |
|
http://foremost.sourceforge.net/ |
| 4457 |
|
|
| 4458 |
|
TestDisk |
| 4459 |
|
http://www.cgsecurity.org/wiki/TestDisk |
| 4460 |
|
|
| 4461 |
|
PhotoRec |
| 4462 |
|
http://www.cgsecurity.org/wiki/PhotoRec |
| 4463 |
|
|
| 4464 |
|
|
| 4465 |
|
|
| 4466 |
|
|
| 4467 |
|
Clonezilla-SysRescCD own scripts |
| 4468 |
|
============================================================================== |
| 4469 |
|
|
| 4470 |
|
Intro |
| 4471 |
|
**************************************** |
| 4472 |
|
In this page I will present the scripts I have ever written for |
| 4473 |
|
Clonezilla-SysRescCD |
| 4474 |
|
|
| 4475 |
|
what-cd |
| 4476 |
|
**************************************** |
| 4477 |
|
Included in: SystemRescueCD |
| 4478 |
|
|
| 4479 |
|
This script determines the device names for your CDs/DVDs, and whether |
| 4480 |
|
they can read/write CD/DVD-ROMs |
| 4481 |
|
|
| 4482 |
|
Its help screen is the following: |
| 4483 |
|
|
| 4484 |
|
# what-cd -h |
| 4485 |
|
what-cd - v 1.0.0 - S. Georgaras <sng@hellug.gr> |
| 4486 |
|
|
| 4487 |
|
what-cd will try to identify your CD/DVDs |
| 4488 |
|
You can use it to identify the device name of your CD-Reader (default), |
| 4489 |
|
CD-Writer, DVD-Reader, and DVD-Writer. |
| 4490 |
|
|
| 4491 |
|
Usage: what-cd [options] |
| 4492 |
|
Availabe options are: |
| 4493 |
|
d Print info about DVDs |
| 4494 |
|
w Print info about writers |
| 4495 |
|
b Batch mode. Only print one device name. |
| 4496 |
|
If more than one device is found, print |
| 4497 |
|
nothing. For use with scripts |
| 4498 |
|
e deviceID Eject device deviceID |
| 4499 |
|
Accecpable values: -1...num of devices |
| 4500 |
|
Use -1 when in batch mode |
| 4501 |
|
v Print version info and exit |
| 4502 |
|
h Print this screen and exit |
| 4503 |
|
|
| 4504 |
|
Its typical usage would be to identify the DVD writer: |
| 4505 |
|
|
| 4506 |
|
# what-cd -dw |
| 4507 |
|
Device /dev/hdd (id=0) can not write DVDs |
| 4508 |
|
Device /dev/hdc (id=1) can write DVDs |
| 4509 |
|
|
| 4510 |
|
When used in batch mode, it will only print a device name. This is |
| 4511 |
|
especially useful in scripts, but also in the command line, as shown in |
| 4512 |
|
section "Burning the DVD". |
| 4513 |
|
|
| 4514 |
|
# what-cd -dwb |
| 4515 |
|
/dev/hdc |
| 4516 |
|
|
| 4517 |
|
continue-multi-cd |
| 4518 |
|
**************************************** |
| 4519 |
|
Included in: SystemRescueCD |
| 4520 |
|
|
| 4521 |
|
continue-multi-cd helps you append data to a multi session CD; that is |
| 4522 |
|
it helps you prepare and burn any consecutive sessions to it. It may lack |
| 4523 |
|
some of the functionality you would have had if you used the command line |
| 4524 |
|
tools themselves (mksiofs and cdrecord), but because of it, it keeps you |
| 4525 |
|
away from writing a lot of parameters. |
| 4526 |
|
|
| 4527 |
|
You could use it for example, to burn some extra documentation to |
| 4528 |
|
Clonezilla-SysRescCD CD, but you cannot use it to change the configuration |
| 4529 |
|
files of isolinux, as it just reads the first session when booting. |
| 4530 |
|
|
| 4531 |
|
Its help screen is the following: |
| 4532 |
|
|
| 4533 |
|
# continue-multi-cd -h |
| 4534 |
|
continue-multi-cd - v 2.0.0 - S. Georgaras <sng@hellug.gr> |
| 4535 |
|
|
| 4536 |
|
Usage: continue-multi-cd [options] <path to be added to CD> |
| 4537 |
|
|
| 4538 |
|
Available options are: |
| 4539 |
|
d Specify write device (in case auto detection does |
| 4540 |
|
not work) |
| 4541 |
|
c Close the CD. No more burning will be possible |
| 4542 |
|
Default is to leave it open |
| 4543 |
|
l Don't burn the CD after image creation |
| 4544 |
|
o <image name> Save the image file as <image name> |
| 4545 |
|
r Remove the image file after burning |
| 4546 |
|
f On the fly burning of the CD. No image file will |
| 4547 |
|
be created |
| 4548 |
|
v Print version info and exit |
| 4549 |
|
h Print this screen and exit |
| 4550 |
|
|
| 4551 |
|
You have to note one thing though: the folder <path to be added to CD> |
| 4552 |
|
will not be present on the CD; only its contents will. |
| 4553 |
|
|
| 4554 |
|
Let's suppose that you want to add to the CD the folder extra-doc, |
| 4555 |
|
which contains q-a.html and faq.html, and that its full path is |
| 4556 |
|
/home/user/extra-doc. If you issue the command |
| 4557 |
|
|
| 4558 |
|
continue-multi-cd -mwr /home/user/extra-doc |
| 4559 |
|
|
| 4560 |
|
you will not have a extra-doc folder on the root of your CD, but the files |
| 4561 |
|
q-a.html and faq.html will be present there. |
| 4562 |
|
|
| 4563 |
|
In order to have extra-doc on the CD, you have to copy it to a temporary |
| 4564 |
|
location and pass that path to continue-multi-cd. Let's see how it's done: |
| 4565 |
|
|
| 4566 |
|
mkdir -p /tmp/for-the-cd |
| 4567 |
|
cp -r /home/user/extra-doc /tmp/for-the-cd |
| 4568 |
|
continue-multi-cd -r /tmp/for-the-cd |
| 4569 |
|
rm -rf /tmp/for-the-cd |
| 4570 |
|
|
| 4571 |
|
|
| 4572 |
|
|
| 4573 |
|
|
| 4951 |
|
|
| 4952 |
|
|
| 4953 |
|
|
|
|
|
|
Some theory on disks |
|
|
============================================================================== |
|
|
|
|
|
Intro |
|
|
**************************************** |
|
|
When working with with disks/partitions and system backup, restoration |
|
|
and rescue, it is vital to have a very good understanding of the basic |
|
|
concepts of booting, partitioning etc. |
|
|
|
|
|
This page is by no means a guide to these concepts. It just pin-points |
|
|
some of them, so the user can look them up in more thorough sources. |
|
|
|
|
|
What is a file system? |
|
|
**************************************** |
|
|
A file system is the way in which files are named and where they are placed |
|
|
logically for storage and retrieval. The DOS, Windows, OS/2, Macintosh, |
|
|
and UNIX-based operating systems all have file systems in which files are |
|
|
placed somewhere in a hierarchical (tree) structure. A file is placed in |
|
|
a directory (folder in Windows) or subdirectory at the desired place in |
|
|
the tree structure. |
|
|
|
|
|
File systems specify conventions for naming files. These conventions include |
|
|
the maximum number of characters in a name, which characters can be used, |
|
|
and, in some systems, how long the file name suffix can be. A file system |
|
|
also includes a format for specifying the path to a file through the |
|
|
structure of directories. |
|
|
|
|
|
Each operating system provides special tools to initialize/format the file |
|
|
system types it supports. Examples of such tools are format in DOS/Windows, |
|
|
mkdosfs and mkfs in Linux, etc. |
|
|
|
|
|
What is a partition? |
|
|
**************************************** |
|
|
A partition is a logical division of a hard disk created so that you can |
|
|
have different operating systems on the same hard disk or to create the |
|
|
appearance of having separate hard drives for file management, multiple |
|
|
users, or other purposes. |
|
|
|
|
|
In Windows, a one-partition hard disk is labelled the "C:" drive ("A:" |
|
|
and "B:" are typically reserved for diskette drives). A two-partition |
|
|
hard drive would typically contain "C:" and "D:" drives. (CD-ROM drives |
|
|
typically are assigned the last letter in whatever sequence of letters |
|
|
have been used as a result of hard disk formatting, or typically with a |
|
|
two-partition, the "E:" drive.). |
|
|
|
|
|
In UNIX-based systems, a partition is used to host the / (root) file |
|
|
system, and optionally the /opt, /usr and /home file systems. There may |
|
|
also be a swap partition, which doesn't host any file system. |
|
|
|
|
|
Each operating system provides some kind of tool to create and manage |
|
|
partitions. Examples of such tools are fdisk in DOS/Windows, fdisk, sfdisk |
|
|
and parted in Linux, etc. |
|
|
|
|
|
What is the MBR? |
|
|
**************************************** |
|
|
When you boot an operating system into your computer, a critical part |
|
|
of the process is to give control to the first sector on your hard disk, |
|
|
which is called the Master Boot Record (MBR). |
|
|
|
|
|
The Master Boot Record is also sometimes called the "partition sector" |
|
|
or the "master partition table" because it includes a partition table |
|
|
that defines how many partitions the hard disk has, the size of each, |
|
|
and the address where each partition begins. |
|
|
|
|
|
What is the Boot Loader? |
|
|
**************************************** |
|
|
A boot loader, also called a boot manager, is a small program which usually |
|
|
resides in the MBR of the first disk (i.e. primary master ATA disk) of |
|
|
the system, that places the operating system (OS) of a computer into memory. |
|
|
|
|
|
Microsoft Windows or the Mac OS provide their own Boot Loaders, beeing able |
|
|
to load only the operating system in question. Linux, on the other hand, |
|
|
provides two alternatives: LILO {{ http://lilo.go.dyndns.org/ }} and GRUB, |
|
|
which have Multiboot capabilities. |
|
|
|
|
|
Managing partitions |
|
|
**************************************** |
|
|
All the programs presented previously are able to create and delete |
|
|
partitions on any disk, with qparted at the top of the list, as it is a |
|
|
graphic tool. |
|
|
|
|
|
Changing the ID (type) of a partition is easy using qparted, but it is |
|
|
as easy with sfdisk. In order to change a FAT32 partition to HPFS/NTFS |
|
|
(NTFS), the following command is enough: |
|
|
sfdisk --change-id /dev/hda1 c 7 |
|
|
where |
|
|
c: existing partition ID |
|
|
7: new partition ID |
|
|
|
|
|
Of course the partition will be usable only after it is formated with NTFS |
|
|
format, or after restoring a NTFS partition to it, using Clonezilla Live. |
|
|
|
|
|
Finally, enlarging a partition is a two step process: |
|
|
|
|
|
* Resizing the partition itself |
|
|
* Resizing the file system contained within |
|
|
|
|
|
Fortunatelly, Clonezilla Live takes care of both these steps for us, |
|
|
when instructed to do so (using the parameter -r). |
|
|
|
|
|
Partition list |
|
|
--------------------- |
|
|
The following table presents known partition types along with their IDs: |
|
|
|
|
|
0 Empty 80 Old Minix |
|
|
1 FAT12 81 Minix / old Linux |
|
|
2 XENIX root 82 Linux swap / Solaris |
|
|
3 XENIX usr 83 Linux |
|
|
4 FAT16 <32M 84 OS/2 hidden C: drive |
|
|
5 Extended 85 Linux extended |
|
|
6 FAT16 86 NTFS volume set |
|
|
7 HPFS/NTFS 87 NTFS volume set |
|
|
8 AIX 88 Linux plaintext |
|
|
9 AIX bootable 8e Linux LVM |
|
|
a OS/2 Boot Manager 93 Amoeba |
|
|
b W95 FAT32 94 Amoeba BBT |
|
|
c W95 FAT32 (LBA) 9f BSD/OS |
|
|
e W95 FAT16 (LBA) a0 IBM Thinkpad hibernation |
|
|
f W95 Ext'd (LBA) a5 FreeBSD |
|
|
10 OPUS a6 OpenBSD |
|
|
11 Hidden FAT12 a7 NeXTSTEP |
|
|
12 Compaq diagnostics a8 Darwin UFS |
|
|
14 Hidden FAT16 <32M a9 NetBSD |
|
|
16 Hidden FAT16 ab Darwin boot |
|
|
17 Hidden HPFS/NTFS b7 BSDI fs |
|
|
18 AST SmartSleep b8 BSDI swap |
|
|
1b Hidden W95 FAT32 bb Boot Wizard hidden |
|
|
1c Hidden W95 FAT32 (LBA) be Solaris boot |
|
|
1e Hidden W95 FAT16 (LBA) bf Solaris |
|
|
24 NEC DOS c1 DRDOS/sec (FAT-12) |
|
|
39 Plan 9 c4 DRDOS/sec (FAT-16 |
|
|
3c PartitionMagic recovery c6 DRDOS/sec (FAT-16) |
|
|
40 Venix 80286 c7 Syrinx |
|
|
41 PPC PReP Boot da Non-FS data |
|
|
42 SFS db CP/M / CTOS / ... |
|
|
4d QNX4.x de Dell Utility |
|
|
4e QNX4.x 2nd part df BootIt |
|
|
4f QNX4.x 3rd part e1 DOS access |
|
|
50 OnTrack DM e3 DOS R/O |
|
|
51 OnTrack DM6 Aux1 e4 SpeedStor |
|
|
52 CP/M eb BeOS fs |
|
|
53 OnTrack DM6 Aux3 ee EFI GPT |
|
|
54 OnTrackDM6 ef EFI (FAT-12/16/32) |
|
|
55 EZ-Drive f0 Linux/PA-RISC boot |
|
|
56 Golden Bow f1 SpeedStor |
|
|
5c Priam Edisk f4 SpeedStor |
|
|
61 SpeedStor f2 DOS secondary |
|
|
63 GNU HURD or SysV fd Linux raid autodetect |
|
|
64 Novell Netware 286 fe LANstep |
|
|
65 Novell Netware 386 ff BBT |
|
|
70 DiskSecure Multi-Boot |
|
|
75 PC/IX |
|
|
|
|
|
The partitions you are most likely to see in use, are: |
|
|
|
|
|
* FAT16 (ID = 6) |
|
|
This is the old DOS partition type |
|
|
You may still find it in pure DOS installations, like vendor diagnostics |
|
|
tool partitions, and small USB sticks (128 - 250 MB) |
|
|
|
|
|
* HPFS/NTFS (ID = 7) |
|
|
This is the Windows XP partition, also known as NTFS |
|
|
|
|
|
* W95 FAT32 (LBA) (ID = c) |
|
|
This is the Windows 95 - 98 partition |
|
|
It is used in any kind of disk and large USB devices (1 GB and more) |
|
|
|
|
|
* W95 Ext'd (LBA) (ID = f) |
|
|
Extended partition. It acts as a container for other partitions |
|
|
There is one more extended partition type (ID = 5), but it does not seem |
|
|
to be in use as much |
|
|
|
|
|
* Linux swap / Solaris (ID = 82) |
|
|
Swap partition, acting as Virtual Memory |
|
|
Modern computers with 1 - 2 GB of memory may not use it at all |
|
|
|
|
|
* Linux (ID = 83) |
|
|
Linux partitions, such as ext2, ext3 and reiserfs |
|
|
|
|
|
|
|
|
|
|
| 4954 |
|
|
Parent Directory
| 
Revision Log
| 
Patch