Rescatux: Debian based rescue distro

Rescatux is from the developers of Super GRUB2. It is a useful distro for disaster recovery, e.g., your system is not booting or there is a filesystem error. You can create a live USB out of the distro ISO using Universal USB Installer or Ubuntu ImageWriter. Continue reading Rescatux: Debian based rescue distro

Boot single UEFI image to shell

tux_compHarald Hoyer from Red Hat has come up with a demonstration of booting the Linux kernel to a command prompt on a UEFI device using a single image. It is the userland proof of concept for the work done by Kay Sievers and David Herrmann in gummiboot. They created a UEFI loader which starts a linux kernel with an initrd and a kernel cmdline, all stuffed-in as the COFF section of the executable.

Hover did this using a shell script which creates a rescue image on Fedora using a rescue kernel and rescue initrd. The kernel cmdline parameter rd.retry is set to 20 seconds to wait for devices. Finally it drops to a shell as the root device is specified as “root=/dev/failme” which does not exist. You can fsck your devices, mount them and repair your system from this shell.

To try it out on Fedora, run:

# yum install gummiboot binutils
# wget https://raw.githubusercontent.com/haraldh/mkrescue-uefi/master/mkrescue-uefi.sh
# chmod +x mkrescue-uefi.sh
# bash mkrescue-uefi.sh BOOTX64.EFI

Copy the generated BOOTX64.EFI to a UEFI-formatted bootable FAT32 USB volume under EFI/BOOT/ and point your BIOS to boot from the USB stick. If you are not sure how to create the FAT32 volume, refer to my earlier article on creating a UEFI bootable ArchBang USB.

[Source]

safecopy: recover data from corrupt media

cool_penguin_smallHard disk or CD with important information gone bad? You might still be able to recover readable data using the low-level rescue tool safecopy. It’s a utility similar to GNU ddrescue.

safecopy does not fail where other tools (like cat or cp) fail on encountering an I/O error. It uses low level IO to read media in raw mode as well as direct hardware access with O_DIRECT instead of making calls through the virtual filesystem. In addition it issues device resets and other helpful low level operations.

Users can force continue a previous safecopy run at arbitrary position. It can keep trying to open source files even when they went away. This allows copying from devices that vanish temporarily in case of errors, like USB drives that renumerate in case of device resets.

From the developer notes: internally safecopy does this by identifying and skipping problematic or damaged areas, and continuing reading afterwards. The corresponding area in the destination file is either skipped (on initial creation that means padded with zeros) or deliberately filled with a recognizable pattern to later find affected files on a corrupted device. safecopy uses an incremental algorithm to identify the exact beginning and end of bad areas, allowing the user to trade minimum accesses to bad areas for thorough data resurrection. Multiple passes over the same file are possible, to first retrieve as much data from a device as possible with minimum harm, and then trying to retrieve some of the remaining data with increasingly aggressive read attempts.

safecopy can generate data to simulate a corrupt media. This data can be used to benchmark safecopy against similar data recovery tools.

Installation

To install safecopy on Ubuntu:

$ sudo apt-get install safecopy

Usage

A few common use cases:

  • To view the options safecopy provides, run:
    $ safecopy --help
  • Resurrect a file from a mounted but damaged media, that cp failed on:
    $ safecopy /path/to/problemfile ~/saved-file
  • Create a filesystem image of a damaged disk/cdrom:
    $ safecopy /dev/device ~/diskimage
  • Interrupt and later resume a data rescue operation:
    $ safecopy source dest
    <CTRL+C> (safecopy aborts)
    $ safecopy source dest -I /dev/null
  • Find the corrupted files on a partially successful rescued file system:
    $ safecopy /dev/filesystem image -M CoRrUpTeD
    $ fsck image
    $ mount -o loop image /mnt/mountpoint
    $ grep -R /mnt/mountpoint "CoRrUpTeD"
  • Create an image of a device that starts at X and is Y in size:
    $ safecopy /dev/filesystem -b  -s <X/bsize> -l <Y/bsize>

Webpage: safecopy

Jaypack: recover images from corrupt filesystem

image_editor_compLosing your images can be costly. You’ll definitely miss those precious moments from your kid’s childhood lost due to a disk or filesystem failure. Here’s the good news – if the disk is still readable there’s a chance that you can recover the images, thanks to Jaypack. It is a small open source tool that scans your disk to recover the files.

Jaypack works on a simple algorithm. It bypasses the filesystem and scans the disk for the image signature. To be more accurate, it checks for the characteristical SOI signature: FF D8 FF, followed by a byte determining the type of the image (at the time of writing only for JPEG/JFIF, SPIFF and Exif images can be recovered) and then keeps track of these, as well as EOI signatures (FF D9).

The tool is still under development and has its limitations – it uses a linear algorithm, has a limit on the maximum size of a file (by default set to 10MB, but configurable) and a number of skip bytes, during which EOI byte sequences won’t be honored. It also tends to sacrifice smaller images for bigger ones.

Installation

You need to compile the tool to use it. Download the source archive, extract it, cd into the source code directory and run:

$ make

It will generate 3 binaries: jaypack, jaypack-server, jaypack-client.

Usage

1. The simplest form of usage is:

$ sudo dd if=/dev/sdXn bs=8192 | ./jaypack max_size skip
where
sdXn: device node (e.g. sda, sdb2)
max_size: maximum size (in bytes) of the file jaypack will consider
skip: number of bytes to skip at the beginning (default 0, ~16000 recommende

The output will be a sequence of lines in the following format:

<jpgtype> <offset> <size>

You can then use dd to recover the files.

2. Client server way

jaypack-client will take the output of jaypack from stdin, extract data at those offsets and then output this in an idiotical binary format to stdout. jaypack-server will be able to take that binary format from stdin and then save .jpg files in a folder of your choosing. Example:

$ sudo dd if=<device> skip=<offset> bs=<bs> | 
  ./jaypack - 16384 |
  sudo ./jaypack-client <device> <offset * bs> <extrasize> |
  ./jaypack-server <output-dir>/

3. Over the network

You can start the client on a computer where a live CD is booted, for instance, and pipe the recovered .jpgs over the network to another computer where you can safely stash them.

Run the following command on the server:

$ nc -l -p <server_port> | ./jaypack-server recovered-jpegs/

Run the following on the client (from which to recover images):

$ sudo dd if=/dev/sda1 skip=131072 bs=8192 |
  ./jaypack - 16384 |
  sudo ./jaypack-client /dev/sda1 1073741824 64 |
  nc <server_ip> <server_port>

Webpage: Jaypack

Systemback: restore points on Ubuntu

systemback_compWe explored TimeShift in one of our earlier articles. We came across another backup tool that works similarly – Systemback. It too does a restore point based backup and can handle system files as well as user configuration files. Note that it is not a tool to backup videos, pictures or documents. A restore point can be created at any time and the application will list the time of the restore point creation for an easy rollback later. Features include:

  • Create restore points
  • Copy system from one partition to another
  • Create a new user, modify root password, modify hostname
  • Create a Live CD/DVD/USB from current system with or without user data
  • System repair, Grub2 repair with or without fstab
  • Upgrade Ubuntu to next release
  • Exclude certain files

Run the following commands to install Systemback on Ubuntu (12.04.x, 14.04.x or 14.10 at the time of writing):

$ sudo add-apt-repository ppa:nemh/systemback
$ sudo apt-get update
$ sudo apt-get install systemback

Webpage: Systemback

Boot-Repair: recover access to your OS

Boot-Repair is a graphical utility that can recover the access to your operating systems and boot them. It is most useful when used in combination with the Boot-Repair-Disk, an advanced rescue disk. Features of Boot-Repair:

  • Easy-to-use (repair in 1 click ! )
  • Free (GPL open-source license)
  • Helpful (Boot-Info summary to get help by email or on your favorite forum)
  • Safe (automatic backups)
  • Popular (300.000 users per year)
  • Can recover access to Windows (XP, Vista, Windows7, Windows8).
  • Can recover access to Debian, Ubuntu, Mint, Fedora, OpenSuse, ArchLinux…
  • Can recover access to any OS (Windows, MacOS, Linux..) if your PC contains Debian, Ubuntu, Mint, Fedora, OpenSuse, ArchLinux, or derivative.
  • Can repair MBR-locked OEM computer boot if the original bootsector has been saved by Clean-Ubiquity
  • Can repair the boot when you have the “GRUB Recovery” error message
  • Options to reinstall GRUB2/GRUB1 bootloader easily (OS by default, purge, unhide, kernel options..)
  • and much more ! (UEFI, SecureBoot, RAID, LVM, Wubi, filesystem repair…)

Webpage: Boot-Repair