Data recovery help needed

Goodmorning Linux experts
Scenario:
Yesterday my Open Suse 10.x system “has crashed to the commandline”. No graphic shell after bootup. I now have only the linux commandline prompt with which i am able to login as Root or other user.

**History… What happend?

  1. Account USERNAME2: **
    When i wanted to save a file, this was not possible cause there was “no diskspace left???..”
    The command “DF -H” (executed in the root directory) showed me that i had:
  • 350 MB free left om /root directory
  • 9.5 GB! free left on /HOME (where i wanted to save the file)

2. Actions taken:
Via ROOT Account and YAST
I remove a lot of “automatic pre-installed Suse software” that i did not use (yet) like doc files, k-office apps, games, to free diskspace on root partition. Result after “DF -h” command: NO MORE FREE SPACE!!!on / root partition ? huh ??

3. Account ROOT:
Checke my mail on the commandline:
Apperantly i have (had) a rootkit (visiting) in my system. Rootkit warning mails where sent to the root account since 2-12-2008 by rkhunter, but i did not notice then until yesterday :frowning:

4. Performed a filesystem check
→ first time oke, no errors
→ Later on in the process… a lot of cross-linked clusters



To make a long and very learning rich experience short:
A - I have moved all files and folders that i do want to save, rescue to one directory on / partition.
B - I am able to boot with a live cdrom of Open Suse 11.1

Now my questions:
0. How can i check the "“physical health” of my harddrive?
Is there a way, programm, command under linux that tells me i my harddrive is rotten (bad clusters etc.) and/or can perform physical tests on a harddrive?

1. How can I ACCESS the files on my local harddrive , after booting from a OpenSuse 11.1 “Live cdrom”?

I do not have (found) the knowledge (yet) to “mount the local harddisk” so that i am able to acces my local harddisk. I do not (yet) know i can add an entry to etc/fstab… so that i am able “to mount and acces” the files on my local harddrive.

2. How can i acces “my usb sticky” (to store my rescue files on")
So far i have seen that - during bootup - the hardware detection process recognizes an /dev/SDA and a SDA1 device :slight_smile:

But i do not know how i am able to mount and acces my usb sticky, so that i can use it as rescue / backup device.

3. Other alternative for usb sticky backup device:

  • Boot from Live CdRom
  • Acces files on local harddrive
  • FTP them over to my webserver
  1. Do you know a book/website where i can learn FTP commandline command by example?
    Very useful for scripting and backup purposes later on in time :slight_smile:

Thanks for you wise answers to my questions :slight_smile:

Ronald
“Linux crash recovery… My BEST experience yet to master Linux on the commandline”

Hello All,
I have found a workaround for this problem.

The recepy:

  1. I’ve Inserted a Knoppix 5.0 Live CDrom
  2. Attached a USB sticky to my machine

Knoppix did recognize my local harddrive and usb stick :slight_smile:

  1. Changed the [read mode] -> [read/write] mode on both drives and usb stick
  2. Copied the files that i wanted to rescue… and saved the day

Have fun with this solution (if you ever might need it)

Ronald

The badblocks(8) command is the one to RTFM on - badblocks(8): search device for bad blocks - Linux man page

Something like “badblocks -s -p 1 /dev/sda” usually suffices.

1. How can I ACCESS the files on my local harddrive , after booting from a OpenSuse 11.1 “Live cdrom”?

Yes, openSUSE CD/DVD, parted magic, Knoppix, System Rescue will all let you get at the data to copy what you need. You found the right solution.