LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 03-25-2019, 01:59 PM   #1
tdbtdb
LQ Newbie
 
Registered: Mar 2019
Posts: 6

Rep: Reputation: Disabled
bit-by-bit exact copy of RAID partition?


I have a RAID array configured with 3 partitions on it. I deleted some files on one of the partitions that I wish I had not deleted. I've found some tools that might be able to recover the files. But I want to make an exact copy of the disk and work on that, so I don't goof things up if they don't work out.

I figure I'll use dd to make the copy. But in order for the resulting exact copy to be mountable, the disk geometry and format info needs to be identical. (I think - I am out of my depth here.)

I assume I need to use parted or similar tool to format the target/copy drive before the dd copy process. But I don't know what information about the original I need to know, how to figure it out, and how to tell parted to make things exactly the same.

Can anyone point me to the appropriate friendly manual or web page?

Or if I am over-complicating it, please tell me a better way to do what I want to do (make an exact bit-by-bit copy of a RAID partition onto separate single hard drive, use analysis software on the copy to try to recover some deleted files).

Thanks for your attention.
 
Old 03-25-2019, 02:04 PM   #2
rtmistler
Moderator
 
Registered: Mar 2011
Location: MA, USA
Distribution: MINT Debian, Angstrom, SUSE, Ubuntu, Debian
Posts: 7,579
Blog Entries: 13

Rep: Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105
I think you're over complicating it. Using dd to get a copy of the entire disk is an exact copy such that the system will not notice that the disk is a different one.
 
1 members found this post helpful.
Old 03-25-2019, 02:14 PM   #3
tdbtdb
LQ Newbie
 
Registered: Mar 2019
Posts: 6

Original Poster
Rep: Reputation: Disabled
I tried just using dd, but the result would not mount.

Original is /dev/sdb3, copy is /dev/sdc. I tried two approaches:

#dd if=/dev/sdb3 of=/dev/sdc
and
#use parted to create /dev/sdc1 larger than /dev/sdb3
#dd if=/dev/sdb3 of=/dev/sdc1

Could not mount the copy after either operation.
 
Old 03-25-2019, 02:21 PM   #4
rtmistler
Moderator
 
Registered: Mar 2011
Location: MA, USA
Distribution: MINT Debian, Angstrom, SUSE, Ubuntu, Debian
Posts: 7,579
Blog Entries: 13

Rep: Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105Reputation: 3105
Quote:
Originally Posted by tdbtdb View Post
I tried just using dd, but the result would not mount.

Original is /dev/sdb3, copy is /dev/sdc. I tried two approaches:

#dd if=/dev/sdb3 of=/dev/sdc
and
#use parted to create /dev/sdc1 larger than /dev/sdb3
#dd if=/dev/sdb3 of=/dev/sdc1

Could not mount the copy after either operation.
I was thinking "if=" would be all of /dev/sdb.

But perhaps that is too large for you.

In order to attain all of the partition information you'd need to use either fdisk or gparted to gather all of the partition information for /dev/sdb3 in order to make a full copy which should mount.

I.e. You could make all of /dev/sdc be that type of file system and then copy /dev/sdb3 to all of /dev/sdc. For me I've always had better success grabbing the entire source disk and then ignoring partitions which I didn't need.
 
Old 03-25-2019, 04:07 PM   #5
tdbtdb
LQ Newbie
 
Registered: Mar 2019
Posts: 6

Original Poster
Rep: Reputation: Disabled
Quote:
use either fdisk or gparted to gather all of the partition information for /dev/sdb3
I don't know how to do that yet. So that sounds like "read the man page for fdisk and gparted." Is that the best way?

I think if I did a good web search, I would find a hit that describes someone going through this exact process. But I am not familiar with the terminology, so I don't know how to make a good web search. Maybe:

dd (parted|gparted) fdisk "create an exact copy"

Anything else I could add to get rid of chaff?

This link to a manual on computer forensics looks like it might help me.
 
Old 03-25-2019, 09:14 PM   #6
jefro
Moderator
 
Registered: Mar 2008
Posts: 18,928

Rep: Reputation: 2836Reputation: 2836Reputation: 2836Reputation: 2836Reputation: 2836Reputation: 2836Reputation: 2836Reputation: 2836Reputation: 2836Reputation: 2836Reputation: 2836
Maybe we need to know a bit more. A raid of some kind is composed of real drives (in some cases) that are put together. Generally the OS views this array as a single disk. What kind of array do you have?

You can't do a if=/dev/sdb3 of=/dev/sdc that isn't apples to apples.
 
Old 03-25-2019, 11:49 PM   #7
tdbtdb
LQ Newbie
 
Registered: Mar 2019
Posts: 6

Original Poster
Rep: Reputation: Disabled
I’m at home now, so going by memory. RAID6, 11 disks, ext3, 3 partitions or filesystems? It’s a Dell system.
Is that what you’re asking?
 
Old 03-26-2019, 12:09 AM   #8
Turbocapitalist
Senior Member
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 3,855
Blog Entries: 3

Rep: Reputation: 1817Reputation: 1817Reputation: 1817Reputation: 1817Reputation: 1817Reputation: 1817Reputation: 1817Reputation: 1817Reputation: 1817Reputation: 1817Reputation: 1817
If you ever rebuild or reformat your array, you might look at OpenZFS instead of RAID. It has been ported to GNU/Linux lately. RAID-Z2 is similar to RAID-6. However, the two features which sound like would be of interest would be snapshots and zfs send/receive. The snapshots allow you to roll back and retrieve files that were inadvertantly deleted. The snapshots can also be sent to other hosts for backup or other duplcation-related tasks. That won't help you at the moment with your RAID-6 task, but is something to consider when planning future maintenance.
 
Old 03-26-2019, 07:24 AM   #9
tyler2016
Member
 
Registered: Sep 2018
Distribution: Debian, CentOS, FreeBSD
Posts: 148

Rep: Reputation: Disabled
Quote:
Originally Posted by tdbtdb View Post
I tried just using dd, but the result would not mount.

Original is /dev/sdb3, copy is /dev/sdc. I tried two approaches:

Code:
#dd if=/dev/sdb3 of=/dev/sdc
and
#use parted to create /dev/sdc1 larger than /dev/sdb3
#dd if=/dev/sdb3 of=/dev/sdc1
Could not mount the copy after either operation.
Try this:

Code:
# dd if=/dev/sdb3 of=/dev/sdk1
# mount -o ro /dev/sdk1 /mnt
 
Old 03-26-2019, 07:26 AM   #10
tyler2016
Member
 
Registered: Sep 2018
Distribution: Debian, CentOS, FreeBSD
Posts: 148

Rep: Reputation: Disabled
Quote:
Originally Posted by Turbocapitalist View Post
If you ever rebuild or reformat your array, you might look at OpenZFS instead of RAID. It has been ported to GNU/Linux lately. RAID-Z2 is similar to RAID-6. However, the two features which sound like would be of interest would be snapshots and zfs send/receive. The snapshots allow you to roll back and retrieve files that were inadvertantly deleted. The snapshots can also be sent to other hosts for backup or other duplcation-related tasks. That won't help you at the moment with your RAID-6 task, but is something to consider when planning future maintenance.
LVM also supports snapshots. I like how ZFS handles them much better though.
 
Old 04-01-2019, 03:21 PM   #11
tdbtdb
LQ Newbie
 
Registered: Mar 2019
Posts: 6

Original Poster
Rep: Reputation: Disabled
Quote:
Try this:

Code:
# dd if=/dev/sdb3 of=/dev/sdk1
# mount -o ro /dev/sdk1 /mnt

That is the correct dd command. But sdk1 won't be right unless sdk is right?

Let me check my understanding. If I had enough space, I could # dd if=/dev/sdb of=/dev/sdk. That would make a bit by bit perfect copy.

But I don't have enough space on sdk. Total space on sdb is about 25TB, I have no place I can copy that much data. I have a 10TB disk available, and the virtual disk that has the data I want is between 7 & 8TB. It would fit, but I can't seem to get the copy to work. I want to # dd if=/dev/sdb3 of=/dev/sdk1, but that generates an error, "dd: writing to '/dev/sdk1': No space left on device". I think I need to format or partition the target disk (sdk) with parted or gparted or fdisk or whatever would work.

Maybe someone can just hand me the answer, or maybe I need to educate myself about what is really going on, in which case a pointer to a manual or web site where I could bone up on the basics might help.

A complication I hadn't mentioned is that I have to do this over the network, there is no practical way to mount the target disk on the same system as the source disk. So the command I have been trying is along the lines of:
# ssh root@10.1.255.224 "dd if=/dev/sdb2 " | dd of=/dev/sdb1

Last edited by tdbtdb; 04-01-2019 at 03:25 PM. Reason: oops
 
Old 04-01-2019, 07:21 PM   #12
tyler2016
Member
 
Registered: Sep 2018
Distribution: Debian, CentOS, FreeBSD
Posts: 148

Rep: Reputation: Disabled
You don't need an actual raw disk partition. You can dd a partition to a regular file and mount the filesystem of the regular file. I've never tried it, but it would probably even work on an NFS share. Here is me doing it on my CentOS7 test VM on my XFS /boot partition. I omitted some of the output for brevity:

Code:
#  df -h | grep boot
/dev/sda1                497M  287M  210M  58% /boot
# dd if=/dev/sda1 of=/blah
1024000+0 records in
1024000+0 records out
524288000 bytes (524 MB) copied, 2.95223 s, 178 MB/s
# xfs_repair -L /blah
# uuidgen
67ff24fa-0e61-4186-83d0-37a81e15f28a
# xfs_repair -L /blah
# xfs_admin -U 67ff24fa-0e61-4186-83d0-37a81e15f28a /blah
# mount -o ro /blah /mnt
# ls /boot | tail -3
vmlinuz-3.10.0-862.6.3.el7.x86_64
vmlinuz-3.10.0-862.9.1.el7.x86_64
vmlinuz-3.10.0-957.5.1.el7.x86_64
# ls /mnt | tail -3
vmlinuz-3.10.0-862.6.3.el7.x86_64
vmlinuz-3.10.0-862.9.1.el7.x86_64
vmlinuz-3.10.0-957.5.1.el7.x86_64
With ext4, I don't think you will even need to change the UUID or fsck it.

Last edited by tyler2016; 04-01-2019 at 07:37 PM.
 
Old 04-01-2019, 09:24 PM   #13
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 17,691

Rep: Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796
Presuming mdadm, I would strongly doubt you could simply use just one disk of a RAID6 like that.
But the bigger question is why do you need to mount it at all ?. Forensics should usually be done on an unmounted image - what are you planning to use ?.
 
Old 04-01-2019, 09:43 PM   #14
tdbtdb
LQ Newbie
 
Registered: Mar 2019
Posts: 6

Original Poster
Rep: Reputation: Disabled
Quote:
Presuming mdadm, I would strongly doubt you could simply use just one disk of a RAID6 like that.
I don't know what that means. I am a newb.

Quote:
But the bigger question is why do you need to mount it at all ?. Forensics should usually be done on an unmounted image - what are you planning to use ?.
That is a good question. At the very beginning of this process I sort of looked around and convinced myself that there were programs to use and stopped with that. I was not real confident I could even get to this point, as I had to copy off all the undeleted useful files to another writeable disk so people could continue using them. I assumed that if I couldn't mount it the copy might be bogus. Depending on what the forensics programs need, you are probably right. Or at least I should give it a try, and if it fails then I can go through this further step.
Thanks to all for their suggestions.

Last edited by tdbtdb; 04-01-2019 at 09:44 PM.
 
Old 04-01-2019, 10:58 PM   #15
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 17,691

Rep: Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796Reputation: 2796
A simple dd of the partition as in post #3 should be fine. For simple file deletion I find photorec works ok. See the testdisk homepage for some examples - photorec is a component of testdisk. You can refine the search to specific types - photos only or maybe doc files. Saves work later.
Note the filenames are gone - photorec assigns sequential names as it finds them.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
RAID 1: partition then RAID or RAID then partition. arfon Linux - Software 3 10-17-2015 04:16 AM
How to make an exact copy of a Hard Disk danishmr Linux - General 15 11-10-2003 01:48 AM
Exact hard drive copy messenjah Linux - Hardware 5 09-19-2003 04:40 PM
Exact Hard Drive Copy phar1944 Linux - General 4 07-02-2002 07:53 AM
exact hard drive copy cbe Linux - General 5 11-21-2001 10:54 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 07:17 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration