LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 01-18-2015, 12:12 AM   #1
hack3rcon
Senior Member
 
Registered: Jan 2015
Posts: 1,432

Rep: Reputation: 11
Post Can I recover a Partition remotely?


Hi.
If I mount a remote partition, Can I recover files on it use some tools like testdisk?

Tnx.
 
Old 01-18-2015, 01:54 AM   #2
veerain
Senior Member
 
Registered: Mar 2005
Location: Earth bound to Helios
Distribution: Custom
Posts: 2,524

Rep: Reputation: 319Reputation: 319Reputation: 319Reputation: 319
So you have corrupted file system. If so use foremost to recover files.

And foremost works on raw partition and not on a mounted filesystem.
 
Old 01-18-2015, 06:32 AM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by veerain View Post
So you have corrupted file system. If so use foremost to recover files. And foremost works on raw partition and not on a mounted filesystem.
While Scalpel and Foremost are good file carvers most people should rather use Photorec instead. (Some people claim to have good results with magicrescue but I haven't tested it.)
Apart from the "raw partition" remark, which is a good one as file checking damaged partitions or mounting it (and have their journal, if any, replayed) should be avoided, I should also remark that:
0) one should also first try to determine the cause of the corruption because if this due to (imminent) hardware failure then creating a backup (also see dd_rescue, ddrescue, dcfldd) should be the first thing to do (after checking one has current, usable backups),
1) one should not act but, regardless of the tool selected, first read the documentation first. For Photorec start at http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step.
 
Old 01-19-2015, 11:19 PM   #4
hack3rcon
Senior Member
 
Registered: Jan 2015
Posts: 1,432

Original Poster
Rep: Reputation: 11
Thank you.
As I said, I want to recover files on a remote partition. For example, in a local network, Mount a Remote partition and recover files on it. I can Visit computer for Local recovery but I'm Curious to know it.
 
Old 01-20-2015, 01:31 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Can you log into the remote machine?
Is that partition still mounted and in use?
Can you install and run software?
 
Old 01-20-2015, 02:06 AM   #6
Teufel
Member
 
Registered: Apr 2012
Distribution: Gentoo
Posts: 616

Rep: Reputation: 142Reputation: 142
I would connect to remote machine and create an exact copy of damaged partition with dd. This copy may be saved locally and mounted as loop device. It is much safer to deal with image than with real hardware. You can create few copies of the image, if something went wrong, you have another copy to start recovery from the beginning. Once your files recovered, you can move them back to remote machine

Last edited by Teufel; 01-20-2015 at 02:12 AM.
 
Old 01-20-2015, 10:40 AM   #7
hack3rcon
Senior Member
 
Registered: Jan 2015
Posts: 1,432

Original Poster
Rep: Reputation: 11
Quote:
Originally Posted by Teufel View Post
I would connect to remote machine and create an exact copy of damaged partition with dd. This copy may be saved locally and mounted as loop device. It is much safer to deal with image than with real hardware. You can create few copies of the image, if something went wrong, you have another copy to start recovery from the beginning. Once your files recovered, you can move them back to remote machine
Can I use "dd" for remote partition? My target use Windows and I can use "smb" to mount it into "/mnt", is it possible to make an image remotely?

---------- Post added 01-20-15 at 11:41 AM ----------

Quote:
Originally Posted by unSpawn View Post
Can you log into the remote machine?
Is that partition still mounted and in use?
Can you install and run software?
I can use "smb" command to mount the partition and my target use Windows OS. I can install software on it but I don't prefer it.
 
Old 01-20-2015, 11:40 AM   #8
Teufel
Member
 
Registered: Apr 2012
Distribution: Gentoo
Posts: 616

Rep: Reputation: 142Reputation: 142
I doubt you can create image from mounted partition over smb, because smb is a filesystem-level protocol.
You need raw disk access to create exact copy.

It would be simple enough to copy partition over ssh from the server which running Linux:
Code:
ssh username@server "dd if=/dev/sda | gzip -1 -" | dd of=copy.gz
or by running at server side:
Code:
dd if=/dev/sda | gzip -1 - | ssh user@non-server dd of=copy.gz
But since you're running Windows at server side, it might require installing Cygwin there to be able to run dd over ssh.
http://www.howtogeek.com/howto/41560...-using-cygwin/

Added:
Though you did mentioned you can access damaged machine directly, this case you could just boot into Linux LiveCD server machine and pass copy to local machine using ssh or copy it to external usb drive directly (without packing into archive).

Last edited by Teufel; 01-20-2015 at 12:07 PM.
 
Old 01-21-2015, 12:06 AM   #9
hack3rcon
Senior Member
 
Registered: Jan 2015
Posts: 1,432

Original Poster
Rep: Reputation: 11
The problem is that the system is Windows and can't run SSH daemon . I want to do it without any special tool.
 
Old 01-21-2015, 01:48 AM   #10
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Windows can run a SSH daemon perfectly but (forensics-wise) you don't want to disturb a "victim" system by installing software. If this is not about forensics then there may be portable, free-to-use versions of SSHd and dd around you could use. Else indeed booting a Live CD (or having somebody overthere boot a Live CD, you're absolutely not clear on the situation) is your best bet IMHO.
 
Old 01-23-2015, 01:13 AM   #11
hack3rcon
Senior Member
 
Registered: Jan 2015
Posts: 1,432

Original Poster
Rep: Reputation: 11
Quote:
Originally Posted by unSpawn View Post
Windows can run a SSH daemon perfectly but (forensics-wise) you don't want to disturb a "victim" system by installing software. If this is not about forensics then there may be portable, free-to-use versions of SSHd and dd around you could use. Else indeed booting a Live CD (or having somebody overthere boot a Live CD, you're absolutely not clear on the situation) is your best bet IMHO.
Excuse me, I should install dd in Windows too?
 
Old 01-23-2015, 10:46 AM   #12
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
If this is about recovery (not forensics), and if you can not or do not want to use a Live CD then yes, you could install 'dd' for Windows. See sourceforge.net/projects/windd/ or www.chrysocome.net/dd or http://www.forensicswiki.org/wiki/Dd or FTK Imager (free to use IIRC).
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Recover partition Flora Linux - Hardware 6 11-06-2011 11:39 AM
Accidently deleted the linux partition(root partition) how to recover it? sanues Linux - Newbie 7 11-30-2009 01:55 PM
Recover var partition Sarah_Student SUSE / openSUSE 3 10-13-2009 05:14 PM
Recover partition table? Xmas777 Linux - Newbie 5 12-10-2008 10:10 AM
Recover Partition??? HELP!!!! villusion Linux - Hardware 7 10-11-2005 04:34 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 06:40 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration