A little while back a 3TB harddrive started to die on me. A recent enough backup was in place, so there was no reason to be overly concerned. However, rather then using a recent backup, it is even better to be able to recover the current data.
To achieve that, it is most important not to write to the drive. This can be achieved by mounting it (the partition) in read only mode. Also, this method will work for ext3, as well as for ext4 formated drives / filesystems.
Let’s say you can still mount the partitions, then this would work fastest:
- Open a console and gain root access using ”su”
- I recommend opening a screen session using “screen”, so you can safely step away from the machine or even work remotely
- Create a mountpoint for the damaged partition. This could be /tmp/broken by using the command “mkdir /tmp/broken”
- Mount the broken partition to /tmp/broken . Assuming your broken partition resides on the blockdevice /dev/sdg1 the command would be: “mount -t ext4 -o ro,noexec,noload /dev/sdg1 /tmp/broken/”
- Next, just copy the data to a safe location
If the harddrive is _really_ damaged, use ddrescue to save the partitions to an image (this will probably take a really, really long time). The procedure to read those data after that is the same till step 4. The command to mount the image created by ddrescue would be: “mount -t ext4 -o loop,ro,noexec,noload /path/to/ddrescue_image /tmp/broken/
I really like this method of data recovery, because it has proven to work and is easy to apply. I especially like the fact, that it works for all known ext filesystems.
So, hope this helps and don’t hesitate to give me some input on recommendations on how to improve the data recovery process.