Imaging hard drive mistake

[remya]

From http://www.knoppix.net/docs/index.php/ImageYourHardDriveUsingKnoppix

Image hard drive to Windows/Samba share:


Execute the following command, making necessary changes for your system
dd if=/dev/hda | split -b 100000000 - /mnt/remote_share/mypc_hda.img.
(Note: the period at the end is significant.)

Question (says she, trying not to panic): If you (or your dear boyfriend, actually) forgot to put the period at the end, what can be done to recover the contents of the harddrive you've imaged? All of the data seems to be there (the same number of GBs that were on the source drive) but due to the absence of period, the files are all over the place.

Eek! (deep breaths, must...take...deep breaths...)

[Dave_Bechtel]

--Ah, I think I see what you're saying. W/o that period on the end, all the "split" prefixes are right after the .img part of the filename.

--Post about 3-5 sample filenames from /mnt/remote_share/ and we'll see what can be done. Is the original HD unusable for some reason?


From http://www.knoppix.net/docs/index.php/ImageYourHardDriveUsingKnoppix

Image hard drive to Windows/Samba share:


Execute the following command, making necessary changes for your system
dd if=/dev/hda | split -b 100000000 - /mnt/remote_share/mypc_hda.img.
(Note: the period at the end is significant.)

Question (says she, trying not to panic): If you (or your dear boyfriend, actually) forgot to put the period at the end, what can be done to recover the contents of the harddrive you've imaged? All of the data seems to be there (the same number of GBs that were on the source drive) but due to the absence of period, the files are all over the place.

Eek! (deep breaths, must...take...deep breaths...)

[remya]

mypc_hda.imgaa, ...._hda.imgab, .imgac, etc.. are the file names.

And yes, the hard drive has been formatted in the meantime.

Thanks!

[Stephen]

mypc_hda.imgaa, ...._hda.imgab, .imgac, etc.. are the file names.

And yes, the hard drive has been formatted in the meantime.

Thanks!

That is how they should look you just ended up with the mypc_hda.img in front of the parts instead of the default x that would have been used to put the file back together cat mypc_hda.imgaa mypc_hda.imgab mypc_hda.imgac > mypc_hda.img just put all the parts on the line in the correct order eg. the aa, ab,ac,ad,ae .... on the end before the > mypc_hda.img and you will have the one big image again.

[Dave_Bechtel]

--Actually you shouldn't even have to specify every single part; bash filename completion should auto-sort the parts for you. Test this by:

' echo mypc_hda.img* ' (without the quotes)

Example:


/mnt/squid/cache # l
total 2963
drwxr-x--x 66 nobody nogroup 1656 Dec 19 23:41 ./
drwxr-xr-x 4 nobody nogroup 688 Dec 20 00:01 ../
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 00/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 01/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 02/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 03/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 04/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 05/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 06/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 07/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 08/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 09/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 0A/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 0B/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 0C/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 0D/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 0E/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 0F/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 10/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 11/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 12/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 13/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 14/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 15/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 16/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 17/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 18/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 19/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 1A/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 1B/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 1C/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 1D/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 1E/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 1F/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 20/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 21/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 22/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 23/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 24/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 25/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 26/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 27/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 28/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 29/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 2A/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 2B/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 2C/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 2D/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 2E/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 2F/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 30/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 31/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 32/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 33/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 34/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 35/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 36/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 37/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 38/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 39/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 3A/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 3B/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 3C/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 3D/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 3E/
drwxr-xr-x 130 nobody nogroup 3120 May 5 2003 3F/
-rw-r--r-- 1 nobody nogroup 2800992 Dec 25 23:06 swap.state
-rw-r--r-- 1 nobody nogroup 0 Dec 19 23:41 swap.state.last-clean

[ p233 (scrn=) ]
829 root /mnt/squid/cache # echo *
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F swap.state swap.state.last-clean


--So all you (should) have to do is ' cat ' with a wildcard and it should all fall into place. IIRC the "split" program has deliberate naming to allow sorting by default.

--DO NOT, however, trust blindly to this. :) Run a test 1st before you try restoring this way on a "production" machine. Hopefully the lack of a period won't be so significant after all