msgbartop
A chronological documentation test project, nothing serious, really!
msgbarbottom

02 Nov 2015 How to mount LVM partitions from rescue mode

This is a short post about mounting LVM partitions when you are using a rescue CDROM or a desktop install CDROM. The whole process is only four easy steps.

  1. Boot your rescue media. This can be a CentOS, Ubuntu, Red Hat or other CDROM that gives you a console access to the server. Most newer linux distributions have LVM support available.Scan for volume groups
    # lvm vgscan -v
  2. Activate all Volume Groups
    # vgchange -a y “volume group name”
  3. List Logical Volumes
    # lvm lvs –all
  4. You have now activated the volumes and have all the information you need to mount them
    # mkdir /media/your-mount-point
    # mount /dev/volumegroup/logical-volume /media/your-mount-point

You can now look into /media/your-mount-point and see the content of your mounted LVM volume.

Tags: , , , ,

Posted by

05 Sep 2010 Datarecovery using Ubuntu Linux

This post describes my workflow in recovering data from defective harddrives. These harddrives are usually not readable in Windows and in most cases not even readable or mountable in linux as well. One of the great things with linux is all the tools that are available, just do a Google search and you find forum threads with suggestions on tools and ways to fix things.

Software used

  • gddrescue
  • – create a disk image of the corrupted disk or partition:

    # ddrescue -r3 /dev/sda rescue.img rescue.log -force

    This command copies from data from harddisk /dev/sda to imagefile rescue.img and writes a log to the rescue.log file. You could have switched rescue.img with another harddisk like /dev/sdb if you would like to duplicate it. ddrescue will try to read data up to three times before it gives up and continues with other data. -force is a selfexplained switch that tells ddrescue to perform this operation despite any warnings.

  • testdisk, http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_NTFS and https://help.ubuntu.com/community/DataRecovery
  • mmls
  • – from The Sleuth Kit can show you the partitions found within an image

A good page about datarecovery https://help.ubuntu.com/community/DataRecovery

Tags: , , , ,

Posted by

19 Jan 2009 Mount a RAID Reconstructor disk image in linux

This post came to life because I had gotten a image file of a 120GB linux ext2 RAID partition that I couldn’t access using Windows software. The partition had been rescued by RAID Reconstructor, a Windows software that can rebuild RAID arrays by combining the disks from the RAID and store it as one image file.

The solution was to use linux and try to mount it as a loop filesystem. My assumption was that the partition itself had an unknown offset, so I used this script to search and mount the partition. The script tries to mount the partition within the first 20000 blocks. I assume the block size is 512 bytes and I already know that the partition is formatted as ext2.

for ((i=0 ; $i < 20000 ; i=$i + 1)) ; do
    mount -t ext2 -o loop,offset=$(($i * 512)) diskimage.img /mnt/point && break
done

If it succeeds you can issue the mount command to get the offset value to the mounted partition

# mount | grep diskimage

/dev/loop0 on /mnt/point type ext2 (rw,offset=32256)

In my case the offset was 32256.

This script can also be used to mount a partition from a backup of your filesystem.

Example
This is my example disk I'm going to create an image of

# fdisk -l

Disk /dev/hda: 80.0 GB, 80026361856 bytes
255 heads, 63 sectors/track, 9729 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1          14      112423+  83  Linux
/dev/hda2              15          96      658665   83  Linux
/dev/hda3              97        3394    26491185   83  Linux
/dev/hda4            3395        9729    50885887+   f  W95 Ext'd (LBA)
/dev/hda5            3395        7218    30716248+  83  Linux
/dev/hda6            7219        8750    12305758+  83  Linux
/dev/hda7            8751        9533     6289416   83  Linux
/dev/hda8            9534        9729     1574338+  83  Linux

Create a backup image of your entire disk

# dd if=/dev/hda of=imagefile.img

To mount one of these partitions as a loop filesystem you can issue a mount command and tell it the right offset. Use the script above if you don't know the offset, it will take the guesswork for you and mount the partition.

Example of mounting /dev/hda3 if the offset is known

# mount -t ext3 -o loop,offset=49664 /dev/hda3 /mnt/point

Determining the offset is easy when you know the disk geometry have access to the file table.
In this case the hda3 partition has an offset of 512 bytes * 96 blocks = 49664.

EDIT
This post could have been avoided if I had known about the linux tool TestDisk. testDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). It could also be used as a forensic tool.

Tags: , , , , ,

Posted by