Reanimation

PhotoRec and TestDisk help rescue deleted files. Both are called in a terminal window. If the tools have unearthed a lot of files, the program hiding behind System | Bulk Rename can help. It assigns multiple files new file names in one fell swoop.

First click the plus icon, and then select all the files to be given new names. The files now appear in the list on the right, showing the future new file names. You can then use the drop-down lists at the bottom of the window to configure the desired changes (Figure 7).

Figure 7: With these settings, Bulk Rename changes the capitalization of the file names.

The Partimage and the Partclone tools are also launched in a terminal window. The programs create complete images of partitions and restore these backups on demand. This is useful even if the hard drive is on its last legs. If you clone the disk, you can immediately continue working with the copy, thus avoiding aggravating the damage to the original.

Partimage and Partclone only save occupied sectors of known filesystems and abort on read errors. Ddrescue copies a data carrier bit by bit. It thus also captures seemingly unoccupied areas of the data carrier in which valuable data could still be stored, as well as supporting less common filesystems. However, the backup will take up the same amount of disk space as the existing partition.

The command from Listing 3, line 1, for example, writes the contents of the /dev/sda1 partition to a file named backup.img. You can save the partition table with the sfdisk command-line tool. The command from line 2 moves the table from the hard disk /dev/sda to a file named sdatabelle.bin. You can then use the command from line 3 to restore the table if necessary.

01 # ddrescue /dev/sda1 backup.img
02 # sfdisk -d /dev/sda > sdatabelle.bin
03 # cat sdatabelle.bin | sfdisk /dev/sda

At Your Command

SSH and SCP are also included in the SystemRescueCd feature set; the lftp FTP client is also available in the start menu under Internet. To start the SSH daemon on the live system, use:

systemctl start sshd

If you want to connect as root from another system with this daemon, you have to assign a password to the account using passwd root. Rsync can be used for file backups if required. Rsnapshot, which was included with older SystemRescueCd versions, is no longer part of the current version.

If you want to make sure that all confidential data on a disk has been destroyed, then run the shred tool. The call to

shred -v /dev/sda

deletes the whole hard disk /dev/sda irretrievably. The data on the disk can then no longer be restored – not even by PhotoRec and its cohorts.

Conclusions

SystemRescueCd is a lean toolbox for emergency recovery. Many of the useful programs are command-line tools. It makes good sense to first try out, and familiarize yourself with the use of, the tools on a test system. This is the only way to ensure that you stay calm and choose the right parameters if worse comes to worst. Various instructions on the SystemRescueCd website [6] will help you with this.