Linux Today: Linux News On Internet Time.

More on LinuxToday

Recovering Lost Data On Linux Or Unix Using The Coroner's Toolkit (TCT)

May 19, 2009, 12:32 (0 Talkback[s])
(Other stories by Mike Tremell)

[ Thanks to Mike Golvach for this link. ]

"1. unrm: This command basically creates one gigantic file composed of all the free blocks on the partition you want to do your data recovery from (not to be confused with the partition on which you lost your data).

"2. lazarus: This command takes the output of unrm and breaks it up into files (by block), which can make it simpler for you to find your lost data and restore it.

"It's recommended, when using unrm, that you mount the partition from which you want to recover data, in read-only mode. If this is impossible, that's not a big deal. It's imperative that you create your unrm recovery file on a "different" partition than the one from which you will be recovering. You will also need to make sure that this separate partition has about 220% of the free space available on the partition from which you want to recover, available for use.

"The breakdown on the 220% worth of disk space is pretty simple. On your recovery partition, you'll need 100% of the available free space on the partition from which you want to recover your lost data, just to copy all those free blocks over. Makes sense. Now, the other 120% is, actually, optional and dependant on whether you make use of lazarus or not."

Complete Story

Related Stories: