[tlug] Handling Raw Hard Drive Images (was Re: Mac OS X: bad super block has become Unsupported sector size (0))

[jep200404@example.com]

On Sat, 21 May 2011 13:12:35 +0900, Jean-Christian Imbeault <jc.imbeault@example.com> wrote:

> Unfortunate I can't make an image as the disk is 1TB and I don't have
> anything that could accept an image that size (not that I even know
> how to make an image).

Once one has acquired a bigger drive on which to store the image, 
one would use a command like: 

   dd if=/dev/sdb of=/home/jci/backup/sdb

to make a backup of the whole drive /dev/sdb. That's simple 
enough and works. Make sure that no partitions of /dev/sdb are 
mounted when you're doing the backup. 














































The following might scare you. There's much below. You might want 
to skip around and chew on one little piece at a time. 

Here are some commands I find handy related to backing up or 
working with hard drives as images. Often I use Knoppix to work 
around hard drives that have problems. If you use Knoppix, be 
very sure to boot with noswap option. I.e.: 

   boot: knoppix no3d noswap

--------------------------------------------------------------------------------

# Knoppix 5.3.1 DVD accesses IDE drives as /dev/hd[abcd]

echo 'set -o vi' >>.bashrc
chmod 755 /var/run/screen
screen

--------------------------------------------------------------------------------

drive=hda
drive=sdb
date
fdisk -l /dev/$drive
echo 'scale=10;('`cat /sys/block/$drive/size`'*512)' | bc
echo 'scale=10;('`cat /sys/block/$drive/size`'*512)/(1024^3)' | bc
for f in /sys/block/${drive}/${drive}*; do echo -n "e2label for $f is "; e2label /dev/`basename $f` ;done
for f in /sys/block/${drive}/${drive}*; do echo -n "offset for $f is ";echo '512*'`cat $f/start` | bc ;done
cat /sys/block/$drive/capability
cat /sys/block/$drive/dev
cat /sys/block/$drive/range
cat /sys/block/$drive/removable
cat /sys/block/$drive/size
cat /sys/block/$drive/stat
find /sys/block/$drive -name size | xargs head
for f in /sys/block/${drive}/${drive}*; do head $f/dev $f/size $f/start $f/stat;done

# $f/start is offset for mounting loopback devices
# Learn how to master the losetup command. 
# For real fun, combine LVM with losetup. 

# for IDE drives only
ls /proc/ide/$drive
cat /proc/ide/$drive/cache
cat /proc/ide/$drive/capacity
cat /proc/ide/$drive/driver
cat /proc/ide/$drive/geometry
cat /proc/ide/$drive/identify
cat /proc/ide/$drive/media
cat /proc/ide/$drive/model
cat /proc/ide/$drive/settings
cat /proc/ide/$drive/smart_thresholds
cat /proc/ide/$drive/smart_values

# for SCSI (or USB) drives
cat /proc/scsi/scsi
cat /proc/scsi/usb-storage/0

# for all
smartctl -a /dev/$drive

# in dd, big blocks copy faster. I try to find a block size close to 1MB 
# that divides evenly into the total size of the drive. 
cat /sys/block/$drive/size
factor `cat /sys/block/$drive/size`
bc
scale=11
# the bs and count numbers below are for a particular drive I worked with
dd if=/dev/$drive bs=922624 count=14112 of=/home/jci/backup/$drive

# sometimes I will squirt the image over to another computer with netcat. 
# keep in mind that this is completely insecure (but can be very fast). 

dd if=/dev/$drive bs=922624 count=14112 | nc -l -p 8000
# on other machine, run: 
nc 192.168.1.123 8000 >/home/jci/backup/$drive

# to test hardware, repeatedly read the whole hard drive and calculate its md5sum
# I often combine that with other stuff, like smartctl, 
# and watching the temperature over time. Cool drives are happy drives. 
# You should scrutinize which value awk prints below

date
while true; do (date | tr '\n' ' ';smartctl -a /dev/$drive | tee -a smartctl.log | awk '/^194 Temperature_Celsius/ {print $4}' ) | tee -a temperatures;time dd if=/dev/$drive bs=924672 count=22080 | md5sum | tee -a MD5SUM;date;done

# on another "screen", run watch
watch -n 60 'uniq -c MD5SUM;awk '\''{ print $7 }'\'' <temperatures | uniq -c'
uniq -c MD5SUM;awk '{ print $7 }' <temperatures | uniq -c