Inquisitor - Instant Search

Here’s a handy little multisearch tool called Inquisitor.

What’s great about this tool is that it combines the power of all of the sites below

  • A9
  • Amazon
  • Digg
  • Flickr
  • Google
  • Technorati
  • Yahoo

Have a go yourself. Just remember not to press enter after typing your keyword. Just wait a few microseconds and it will all be clear.

Data recovery for Linux ext2

I just had a pair of Linux ext2 drive sent in for data recovery. Both the HDD are on RAID 1 so the data inside should be identical. They were indentical allright … right down to every CRC error.

Data recovery is a delicate, stressful, variable and time consuming task. Every recovery process is different and the steps below will not necessary work for your case. I will not answer any questions or be responsible if you damage even more of your data.

I must always stress that it’s absolutely important that you do not do any recovery on the damaged HDD. That would just put your data in an even more dangerous situation. Being overwritten!

Before attempting the feat, I mounted a new HDD on /mnt/recovery for recovery then began to copy an image of the damaged disk.

dd if=/dev/hdXX of=/mnt/recovery/damaged.img conv=noerror,sync

The param conv=noerror,sync will ensure that when the system encounters an error on the damaged disk, it will just write a nulls on the image and continue the task.

Once the image is ready, I removed the damaged disk and label it “DAMAGED - DO NOT USE“. The hard disk should be only used for display or as paper weight. Trying to reuse the damaged disk would be sheer stupidity. Be sure to wipe it clean first so you won’t be leaking any sensitive data to the whole world.

Now what I have it an image of the damaged drive minus the damaged parts. This is where Foremost comes in.

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.

Foremost is a tool released by the United States Air Force Office of Special Investigations and The Center for Information Systems Security Studies and Research.

I am not going to document how to use Foremost to repair your damaged files. Read the man page instead.