4

I have an old forgotten Windows laptop. It no longer boots from the internal hard drive. I successfully created a live Manjaro USB Drive which boots successfully.

There appears to be some sort of data corruption or bit-rot as some of the partitions appear to not be there.

I want to create a copy of the hard drive so I can attempt some data recovery. I have a drive in my PC that is plenty large enough to store any copies I make.

I have no way to transfer a copy physically (an external drive). So I assume the only other way would be though my local network (perhaps a local file share?).

After some searching, I ran across this question, which might be the answer I am looking for. I am unsure if this world work in my situation though.

Obviously I don't want to overwrite the laptop's drive, and the Manjaro USB (or any other USB Drive I have) doesn't have enough space to hold a copy of the laptop's drive.

With all of these limitations, is it possible to create a copy of my laptop's hard drive on my PC? If so, what are some ways I can do it?

Tom Newton
  • 79
  • 1
  • 6
Bryan B
  • 41
  • 2
  • 4
    One of the proposed command can do the job of sending an image of the disk: `dd if=/dev/sda | gzip -1 - | ssh user@pc_address dd of=image.gz` However, the image can can hard to use (you would have to transfer it on an other drive). It would be better to try mounting readonly your file system and see if is Possible. Then a `tar` export will be easier to handle, but may fail because of the data corruption. – Frédéric Loyer Mar 26 '23 at 21:03
  • 4
    Check this for dd Backup : https://unix.stackexchange.com/a/740612/515538 – Z0OM Mar 26 '23 at 22:08
  • 4
    And this for Others Tools Like clonezilla, e2image and more : https://wiki.archlinux.org/title/Disk_cloning – Z0OM Mar 26 '23 at 22:09
  • Does "PC" imply you're talking about a desktop machine? If so, why don't you just take the harddrive out of the laptop and temporarily add it to your desktop? – TooTea Mar 27 '23 at 08:33
  • @TooTea, if it's a SATA drive, you'll probably need a bay adapter to keep the drive from rattling around. If it's a PATA drive, you'll need both the bay adapter and either a 44-pin to SATA or 44-pin to 40-pin+power adapter. Easier just to read the drive while it's still in the laptop. (Besides, not all laptops are built for easy access to the drive.) – Mark Mar 27 '23 at 21:19

3 Answers3

11

Good news and bad news.
The good news is that you are correct, that would be the way to go. Always do a full sector by sector copy ("dd" would be the go to standard for this) and mess with the old potentially damaged drive as little as possible!

But if you don't have the space for a full copy you will need to get more storage space first. Sure, you could work with compression, but there is no guarantee that this would be enough and it would just make everything vastly more complicated.

Or in the words I would use at work: We need to buy another drive. This is not worth even trying without it. We are likely just going to burn a lot of time without obtaining a useful result. Also we would run the risk of just damaging the old drive/data more with each attempt to read from it.

So you "could" but I would heavily advise against it.

To further emphasize on how important I think excess storage is here:
In fact I would suggest the following setup:
At least twice as much storage as the size of the drive you want to rescue. With the simple reasoning that you want to make the full copy first and then duo all further work with the full backup and restore the data to yet another location in order not to tamper with the potentially corrupted data any further.

Also you might wanna keep that copy in pristine condition until your rescue is complete as further copies might be worse as the disk/filesystem potentially degrades. Worst case every second the drive is running. And on the fly compression makes the process slower.

Daniel
  • 153
  • 6
  • 4
    On the fly compression is a tossup; modern compression like LZ4 can be very very fast and if it's being sent over a slow network connection, compressing it can be much faster than sending it in clear. I also like using `mbuffer` or similar to maximize throughput if any single stage (read, compress, network transfer, write) temporarily slows down. – SomeoneSomewhereSupportsMonica Mar 27 '23 at 07:23
  • Really, though, the best option is likely to pull the disk out of the laptop and connect it directly to the PC. No network involved and the CPU/RAM/other resources are likely far greater. – SomeoneSomewhereSupportsMonica Mar 27 '23 at 07:24
  • 2
    Yes, I took that for granted, my understanding was that there was no sufficiently big storage medium available in general. It's also correct that properly configured compression could counteract other bottlenecks like network speeds. But that still falls under the category: increases complexity and therefore potential for error. And I don't know if we want to go this deep without being prompted for it. – Daniel Mar 27 '23 at 08:15
  • 1
    "that would be **they** to go" should be "that would be **the way** to go" and "duo" should be "do" – Greenonline Mar 27 '23 at 08:24
  • 3
    @Daniel I was referring to this line: `I have a drive in my PC that is plenty large enough to store any copies I make.` I do agree with your comment about minimising complexity. – SomeoneSomewhereSupportsMonica Mar 27 '23 at 08:43
  • Okay, I missed that one. – Daniel Mar 27 '23 at 08:55
  • If the image file is on BTRFS or XFS, the amount of space you need for a pristine original and a modified copy is only the size of the delta. `cp --reflink=always orig.img repair-attempt.img` won't take any space, and copy-on-write will only take space for blocks that you modify. If your Linux desktop doesn't use a filesystem that supports that, you could I think do something similar with a special loop device, but yes it would be easier to just copy it if you have the space. – Peter Cordes Mar 27 '23 at 15:28
  • 1
    If the disk may be corrupted, you don't want `dd`, you want `ddrescue`. – Mark Mar 27 '23 at 21:15
4

You can use sshfs or samba to mount a network share to your computer

after mount you can make a copy of the hole drive with your data with the dd command

list drives with lsblk than make a copy with

Example: Your drive is /dev/sdx

Your mounted folder is /mount/backup/

dd if=/dev/sdX of=/mount/backup/yourdrive.image bs=1M status=progress

You can also make a backup of the needed folders if you don't want to make a whole backup of the drive with rsync or cp

At the end you need space, you can compress the whole thing but i don't know if you will gain that much space and if the space on the remote machine is enough or buy a new usb stick or a harddrive and do the backup on the new drive

SyncToy
  • 1
  • 3
  • 13
  • 13
    Instead of ordinary `dd`, you'll want to use `ddrescue` if possible. It has a number of features especially for reading partially damaged or failing disks – telcoM Mar 26 '23 at 21:58
  • 4
    @telcoM please write your own answer showing how to use ddrescue effectively – user253751 Mar 27 '23 at 11:27
  • 1
    @user253751: There's a [tag:ddrescue] tag, shouldn't be hard to find an existing Q&A to link. e.g. [ddrescue imaged my partition with no errors, but I can't mount the image as a loop device](https://unix.stackexchange.com/q/709869) shows working commands in the question. Or [ddrescue with USB Enclosure](https://unix.stackexchange.com/q/600928) has a long answer, presumably many parts of that are useful or related. – Peter Cordes Mar 27 '23 at 15:22
0

The easiest way would be to stream the data over ssh. For this you need the sshd on the broken machine (which you have, assuming your live CD comes with it). Then, from another machine:

$ cd empty_dir
$ ssh broken_machine -c "tar czf - /mnt/volume_to_save" | tar xzf -

Or

$ ssh broken_machine -c "tar czf - /mnt/volume_to_save" > volume.tar.gz

This would work simple and well if there are no further bit errors on that particular partition, and you are still able to mount it. Preferably mount it read-only (use the ro option with mount). Note that you can experiment with removing the z compression flag if you feel like the old machine is CPU-bound; while the ssh transport stream would catch bit errors anyways, it would just be one more layer of protection.

The next escalation would be to use dd if you for some reason cannot or do not want to mount the target partition.

$ ssh broken_machine -c "dd if=/dev/hda1 bs=64k" > hda1.img

You can then play around with that image on the good machine to your heart's content (i.e., mount it using mount -o loop hda1.img /mnt/rescue). During the copy operation, again, it would be very advisable to have the partition unmounted or mounted read-only, which should not be an issue as you're booting from a rescue CD anyways.

Finally, if you really expect physical damage, especially if you fear that even reading would cause more damage, you can use ddrescue to grab parts of the partition in order of importance. See the ddrescue manual for details; and you can then use it in the same fashion over ssh.

Good luck!

AnoE
  • 565
  • 1
  • 3
  • 11