This post describes how to create a bit for bit copy of a Ubuntu 14.04 LTS server using tools like gddrescue and qemu from a Ubuntu Live-CD. This procedure can actually be used to create a copy of any operating system, not just Ubuntu.
This could probably have been done more easily and faster using VMware vCenter Converter Standalone Client but I have experienced that not all linux flavours can be converted easily.
To perform such an operation you need several things.
Creating the disk image
# ddrescue --nosplit /dev/sda imagefile.img imagefile.log
The –nosplit option copies the disk without retrying or splitting the file and is also “fast”.
Remember to place the imagefile.img on another harddisk than you are imageing to avoid filling your disk.
Convert the img file to a VWware VMDK disk file
# qemu-img -p convert -f raw sda.img -O vmdk sda.vmdk
Options used
-p gives you a nice progress indication of the conversion
-f raw tells us that we a trying to convert a raw disk image
-O vmdk describes the output format of the new disk image, in this example a VMware VMDK-file
qemu-img (1.5.0) supports a wide range of formats like vvfat vpc vmdk vhdx vdi sheepdog sheepdog sheepdog rbd raw host_cdrom host_floppy host_device file qed qcow2 qcow parallels nbd nbd nbd dmg tftp ftps ftp https http cow cloop bochs blkverify blkdebug.
Tags: 14.04, ddrescue, gddrescue, p2v, QEMU, qemu-img, Ubuntu
Posted by Hans-Henry Jakobsen
GNU ddrescue (gddrescue) is a linux data recovery tool. It copies data from one file or block device (harddisc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
It can also be used as a forensic cloning tool.
Installing gddrescue in Ubuntu linux
# aptitude install gddrescue
The command to use for gddrescue is ddrescue, don’t ask me why it is not called gddrescue.
First you copy as much data as possible, without retrying or splitting sectors.
This example rescues data from one disk to another
# ddrescue --force /dev/sda /dev/sdb logfile.ddrescue
Warning! This overwrites content on /dev/sdb
When you use a log file you can stop ddrescue any time by pressing Ctrl+ C to interrupt the process.
You restart it again with the same parameters and ddrescue will resume from where it was before it was interrupted. This is good to know since this can be a time consuming process.
Now let it retry previous errors reported in the logfile 3 times, using uncached reads
# ddrescue --force --direct --max-retries=3 /dev/sda /dev/sdb logfile.ddrescue Press Ctrl-C to interrupt Initial status (read from logfile) rescued: 2 TB, errsize: 69632 B, errors: 136 Current status rescued: 2 TB, errsize: 49152 B, current rate: 256 B/s ipos: 916972 MB, errors: 96, average rate: 359 B/s opos: 916972 MB, time from last successful read: 0 s Retrying bad sectors... Retry 1
If that fails you can try again but retrimmed, so it tries to reread full sectors
# ddrescue --force --direct --retrim --max-retries=3 /dev/sda /dev/sdb logfile.ddrescue
You should now have rescued some data that you can continue your rescue work with.
There may be another post about that later.
Rescue a bad CDROM using ddrescue
# ddrescue -n -b2048 /dev/cdrom cdimage.img logfile.ddrescue # ddrescue -d -b2048 /dev/cdrom cdimage.img logfile.ddrescue
The cdimage.img file can then be mounted as a loop file or written to a CDROM.
Tags: ddrescue, gddrescue, recovery, Ubuntu
Posted by Hans-Henry Jakobsen
This post describes my workflow in recovering data from defective harddrives. These harddrives are usually not readable in Windows and in most cases not even readable or mountable in linux as well. One of the great things with linux is all the tools that are available, just do a Google search and you find forum threads with suggestions on tools and ways to fix things.
Software used
– create a disk image of the corrupted disk or partition:
# ddrescue -r3 /dev/sda rescue.img rescue.log -force
This command copies from data from harddisk /dev/sda to imagefile rescue.img and writes a log to the rescue.log file. You could have switched rescue.img with another harddisk like /dev/sdb if you would like to duplicate it. ddrescue will try to read data up to three times before it gives up and continues with other data. -force is a selfexplained switch that tells ddrescue to perform this operation despite any warnings.
– from The Sleuth Kit can show you the partitions found within an image
A good page about datarecovery https://help.ubuntu.com/community/DataRecovery
Tags: ddrescue, forensic, gddrescue, rescue, sleuthkit
Posted by Hans-Henry Jakobsen