The Gentoo-based SystemRescue CD/USB is one of the very best rescue distros, packing amazing functionality into a 350MB image. It can rescue Linux, Unix, Mac, and Windows systems, and recover data from almost any media. Today we will learn how to create a SystemRescue live USB stick, and recover data from failing drives.
Creating a SystemRescue USB Stick
Live Linux CD/DVDs are easy and good, but they have two drawbacks: they are slow, and they are not writable. (Unless you use a CD/DVD-RW, but these are not always reliable.) A bootable SystemRescue USB stick is fast, and you can copy files to it. The one roadblock with live USBs is your system BIOS must support booting from USB devices. Any PC built after 2001 should have this capability, though the older ones don’t always work.
Some BIOS have a really nice feature: a boot device picker. Just plug in your boot media, power up your machine, and then press the appropriate hotkey, which is usually an F key. Then you get a menu for picking your boot device without having to enter the BIOS configuration. For example, on my Thinkpad it’s F12. This varies on different machines as motherboard manufacturers love to monkey with this stuff, so I’m afraid you’re on your own for finding out what your systems support.
The fine SystemRescue folks have made it easy to create a bootable SystemRescue USB stick by adding a script to the CD image that does all the work for you. All you need are a USB drive that holds at least 512 MB, and the latest SystemRescue CD image. After downloading the CD image, create a temporary directory and mount the image with the loopback device:
mkdir temp/
sudo mount -o loop,exec systemrescuecd-x86-2.3.1.iso temp/
You need the exec option so you can run the USB creator script. Plug in your USB stick, and if your system auto-mounts it then you need to unmount it. Then run the usb_inst.sh script:
sudo bash ./usb_inst.sh
You can run this either in an X terminal or from the console. Just follow the prompts, and presto! Instant live SystemRescue USB.
SystemRescue boots to a console by default. You can also have a nice XFCE desktop by typing wizard at the prompt. You get root privileges by default, so this is a mighty power tool all ready to do real work.
Adding a Data Partition
You can copy files to the /home directory on the SystemRescue USB and have an all-in-one rescue stick. I like having a separate data partition, but usb_inst.sh overwrites the entire device, and there is no option to partition it. But with a little work you can partition your SystemRescue USB.
First create your SystemRescue USB. Do not boot it up yet, but make sure it is plugged in to your PC and unmounted. Then shrink the single partition and create a second partition in the free space. I use the excellent GParted for this, and formatting it as fat32 prevents file permissions headaches.
Now you can boot SystemRescue. It does not automount any filesystems outside its own root filesystem, so you will have to mount the new partition manually. The SystemRescue manual says to always create subdirectories in /mnt, and never mount anything in /mnt itself. So run fdisk -l to see your block device names, and then run these commands using your own device names:
# mkdir /mnt/sdb2
# mount /dev/sdb2 /mnt/sdb2
Be very sure that you are doing this to the second partition on your USB stick, and not to your hard drive.
Rescuing Data From a Failing Hard Drive
When a hard drive, CD/DVD, USB stick, or any digital storage media is on its way to the Great Bitbucket in the Sky, GNU ddrescue is my favorite data recovery tool. GNU ddrescue is included in the default SystemRescue image. Before we dive into the fun stuff, there is some vexing naming confusion to clear up. There are two ddrescue programs in SystemRescue. GNU ddrescue, by Antonio Diaz, is the one I prefer. The version on the current SystemRescue release is ddrescue 1.14. There is also a dd_rescue, version 1.23, by Kurt Garloff. dd_rescue is nice, but it’s slower than ddrescue and doesn’t include as many features.
Just to keep it interesting, Debian Linux adds its own bizarre naming conventions. The Debian package name for GNU ddrescue is gddrescue, and the package name for dd_rescue is ddrescue. But the binary for gddrescue is /sbin/ddrescue, and the binary for dd_rescue is /bin/dd_rescue. Fortunately, SystemRescue doesn’t mess with the original binary names, and calls them /usr/bin/ddrescue and /bin/dd_rescue.
Enough of that; let’s talk about what makes GNU ddrescue my favorite. It performs block-level copies of the failing media, and so it doesn’t matter what filesystem is on the media. You’re probably thinking it sounds like the venerable dd command, and it is similar, with some significant improvements. dd works fine on healthy disks, but when it encounters a read error it stops, and you have to manually restart it. It reads the media sequentially, which is very slow, and if there are a lot of bad blocks it may never complete a full pass.
GNU ddrescue is fully automatic and fast for a block-level copy program, and you want speed when a drive full of important data is dying. It seeks out good blocks to copy and skips over the bad blocks. It optionally records all activity in a logfile, so you can resume where you left off if the copying is interrupted for any reason. It is best to always generate a logfile, because every time you power up the failing drive the more likely it is to die completely. Using a logfile ensures that ddrescue will not repeat operations, but will move on and look for new good blocks to copy.
When you are rescuing a failing drive, the first step is to copy it with ddrescue. Then take the original offline, and perform any additional recovery operations on the copy. Don’t touch the original any more than you have to. You can copy the copy as many times as you need for insurance.
You need a healthy drive to copy your rescued data to. I prefer USB-attached media such as a USB hard drive, USB thumb drive, Compact Flash, or SD cards. Of course a second internal hard drive is a good option, or this might be your chance to finally use that eSATA port that always looked like it should be cool and useful, but you never found a reason to use it. Your second drive should be at least 50% larger than the drive you’re recovering. The troubled drive must not be mounted. The simplest invocation looks like this:
# ddrescue /dev/sda1 /dev/sdb1 logfile
Here, /dev/sda1 is a partition on the failing drive. Everything on /dev/sdb1 will be overwritten, and the logfile will be written to /dev/sdb1. You can name the logfile anything you want. You can rescue an entire drive if you prefer, like this:
# ddrescue /dev/sda /dev/sdb logfile
Note that if there is more than one partition on the failing drive and the partition table is damaged, you will have to re-create it on the rescue drive. I copy one partition at a time to avoid this sort of drama.
You can have ddrescue make multiple passes with the -r option; sometimes you can make a more complete recovery this way. You can go as high as you want; I use 3-5:
# ddrescue -r5 /dev/sda2 /dev/sdb1 logfile
Sometimes ddrescue is nearly magical for rescuing scratched CDs and DVDs. The first command copies the disk, and the second command copies it to a blank disk:
# ddrescue -n -b2048 /media/cdrom image logfile
# ddrescue -d -b2048 /media/cdrom image logfile
You can give the image file whatever name you like. While I’ve never needed to go beyond the basics in this article, ddrescue has a whole lot of other capabilities that you can learn about in the GNU ddrescue manual.
