Dd And Its Variants
One common command-line data recovery tool from the Linux (or, rather, *NIX) world is dd, which can be used to generate an image file from any mounted file system or device. This is useful if you are dealing with a file system or device that's damaged in some way and you want to perform your recovery operations on a backup copy of the data rather than the device itself.
The best way to describe how dd works is to give an example of it in action. The Paulski Pages Web site shows it being used to perform data recovery from a physically failing drive. Debian Admin offers another walkthrough, written for Debian-based Linux distributions, but the basic concepts can be used more or less universally. The user copies the file system to an image file, mounts the image as a file system, and then performs recovery operations from the image.
The "stock" version of dd comes with just about any Linux distro, but you may want instead to use a variant named dd_rescue, which sports some slightly different behaviors. You can also use dd_rhelp on top of it, which is a utility that makes using dd_rescue all the easier. (Yet another program called ddrescue [note the lack of the underscore] also exists, with again a slightly different set of options.)
Note that when you attempt to make an image using one of these programs, always ensure the target for the image has at least as much free space as the original device. Also, dd can be used to destroy data on any mounted file system or device, so get familiar with the proper use of the program before you try to use it for anything!
Beyond Dd
 | |
 You can use TestDisk to spelunk a damaged disk and find now-missing partitions. | |
| (click for image gallery) |
If using dd seems entirely too difficult, you may want to go instead with something a little more interactive. Consider TestDisk, which can perform dd-like actions and is also designed for many other whole-disk recovery operations -- for instance, repairing a partition lost due to a damaged partition table or manual deletion.
TestDisk is menu-driven and comes with detailed step-by-step instructions for running it on a variety of platforms and file systems, although you'll need to have some understanding of disk structures (partitions, allocation tables, etc.) before you dive in and begin swimming. You might want to have a guru riding shotgun with you.
Dd images can be mounted directly as file systems within Linux by using the mount command. However, if the image contains a file system that you want to boot directly, there are ways to boot that image within a virtual machine. This is useful if you're worried about, for instance, a virus on the imaged drive, or want to perform some other kind of work that requires a live environment but don't have a machine to spare.
The Java-based Live View tool lets you turn any dd image into a VMware virtual machine, and also caches any changes made to the image so that the original image is not touched. Note that you need to have one of the VMware products (like VMware Player) installed for Live View to work.
