extracting raw data copied with dd

microcriminal · 10-22-2008, 06:16 PM

to resize a logical partition, i recently took a backup of it using dd using the command:

Code:

dd if=/dev/hda5 of=/backup/hda5-22oct2008.bak.dd

then i resized the partition using parted and now i can't restore the backup into my newly resized partition /dev/hda5 with this simple command

Code:

dd if=/backup/hda5-22oct2008.bak.dd of=/dev/hda5

because it messes up the filesystem!!

how can i extract the raw data from /backup/hda5-22oct2008.bak.dd
there must be a way to do it, right?

ps. yeah, i should have just done a simple cp, i know. it was stupid of me to not do it. agreed. but whatever done is done, right? will really appreciate your help though!

jailbait · 10-22-2008, 06:18 PM

See if you can copy from the backup using cp.

-------------------
Steve Stites

P.S. The file system may have been messed up on the backup step in which case you are out of luck. You can check by running fsck against the backup.

pixellany · 10-22-2008, 06:27 PM

The dd image contains all the filesystem overhead + all the files. As you already have observed, you can't cram all that back into a smaller space.

When you say "extract", I think you mean extract the FILES--so that you can put them into the newly re-sized partition. I believe you can mount the image as if it were a partition. I've never done this, so look at the man page for mount---or maybe Google on "mount loopback".

Next time around, consider re-sizing the partition (data and all) using something like GParted. (After, of course, backing up the data)

syg00 · 10-22-2008, 06:45 PM

Depends what you mean by messing with the filesystem. If you made the partition bigger, then dd'd back, it'll recreate the smaller filesystem in the enlarged partition.
Just like you told it to by using dd.

Shouldn't be a problem - most filesystems allow resize in this situation these days

drchuck · 10-22-2008, 06:57 PM

pixellany got it right. Your backup file is a filesystem image, which can be mounted. As root, create a directory to act as the mount point, for example /LOOP, and mount it as follows:

Code:

mount -t iso9660 /backup/hda5-22oct2008.bak.dd /LOOP -o loop

microcriminal · 10-25-2008, 05:28 AM

hey guys! thanks a lot for your response! really appreciate it...
i tried mounting the backup like drchuck mentioned but got this error:

Code:

mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

the dmesg | tail tells me this:

Code:

Unable to identify CD-ROM format.

any idea about what is going on?

H_TeXMeX_H · 10-25-2008, 06:11 AM

The filesystem type should be ext3 not iso9660

microcriminal · 10-25-2008, 06:25 AM

yeah, tried with ext3 as well. this is the message i get:

Code:

VFS: Can't find ext3 filesystem on dev loop0.

colucix · 10-25-2008, 06:50 AM

What is the output of the folowing command?

Code:

file /backup/hda5-22oct2008.bak.dd

If you have used dd to backup a logical partition, it should not be easy to determine the filesystem type. The file command may give you some direction.

microcriminal · 10-25-2008, 07:48 AM

Code:

root@noc-101 ~]#file /backup/hda5-22oct2008.bak.dd
/backup/hda5-22oct2008.bak.dd: data

shows it to be a data i.e. anything else other than text or exectuable (data is usually 'binary' or non-printable).
not much help with that either i guess?

colucix · 10-25-2008, 08:24 AM

Nope... I would have expected something like these for a ext3 partition and a logical partition respectively:

Code:

# file ext3.dd
ext3.dd: Linux rev 1.0 ext3 filesystem data (needs journal recovery)
# file extended.dd
extended.dd: x86 boot sector; partition 2: ID=0x5, starthead 254, startsector 121788765, 4209030 sectors, extended partition table

Indeed "data" is the answer when the file command does not recognize any file type. As a last resource you can try to associate a loop device with the file, then try the fdisk -l command to gather some information, for example

Code:

# losetup /dev/loop2 /backup/hda5-22oct2008.bak.dd
# fdisk -l /dev/loop2

When you've done, don't forget to release the loop device using

Code:

# losetup -d /dev/loop2

allend · 10-25-2008, 08:25 AM

I suggest you try with a loop mount with an offset.

Quote:

mount -o loop,offset=32256 /backup/hda5-22oct2008.bak.dd /foo

where /foo is a mount point.
I have specified an offset of 32256 (=63*512) bytes for a disk with 63 sectors per track and 512 bytes per sector
You should not need the -t option, but it would not hurt to specify if you know the file system type.
When dd is used to image an extended partition, it includes the extended partition table which is in the first sector of a track. When you do a loop mount, you want to skip over this.

microcriminal · 10-25-2008, 08:39 AM

coculix, trying your way:

Code:

[root@noc-101 ~]# losetup /dev/loop0 /backup/hda5-22oct2008.bak.dd 
[root@noc-101 ~]# fdisk -l /dev/loop0

Disk /dev/loop0: 106 MB, 106896384 bytes
255 heads, 63 sectors/track, 12 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/loop0 doesn't contain a valid partition table

allend, thanks for the insight but still the problem remains

Code:

[root@noc-101 ~]# mount -t ext3 -o loop,offset=32256 /backup/hda5-22oct2008.bak.dd /LOOP
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

[root@noc-101 ~]# dmesg | tail -2
hfs: unable to find HFS+ superblock
VFS: Can't find ext3 filesystem on dev loop1.

allend · 10-25-2008, 08:54 AM

What does fdisk -l show for your disk?

microcriminal · 10-25-2008, 09:00 AM

Quote:

Originally Posted by allend

What does fdisk -l show for your disk?

about that! i already formatted and resized my /dev/hda5 and all i am left with is the /backup/hda5-22oct2008.bak.dd image of the old /dev/hda5

but with colucix's idea, i could get some info out of the image (as i mentioned in post #13)

this is stupid AND embarrassing to say the least!