2011-08-24

Recovery of disk with badblocks


There are some specifics recovering the disk with badblocks.
Let's say there is badblock on sector 2550302 of /dev/sda.

This should fail because this is the bad sector:
# dd if=/dev/sda of=/dev/null bs=512 count=1 skip=2550302

This should be OK because this is the sector before:
# dd if=/dev/sda of=/dev/null bs=512 count=1 skip=2550301

But actually even this fails:
# dd if=/dev/sda of=/dev/null bs=512 count=1 skip=2550298

Reason is that the block of the block device /dev/sda is not 512 but actually (most probably) 4k:
# blockdev --getbsz /dev/sda
4096


This can cause you to loose some more data from the forensic image, than really necessary. Setting the block size on active device will most probably fail. Solution is to use O_DIRECT flag when opening the device - or rather to use tools which are capable of using direct mode.

This should really work:

# dd if=/dev/sda of=/dev/null bs=512 count=1 skip=2550301 iflag=direct
# dd if=/dev/sda of=/dev/null bs=512 count=1 skip=2550303 iflag=direct
# dc3dd if=/dev/sda of=/dev/null bs=512 count=1 skip=2550301 iflag=direct
# dc3dd if=/dev/sda of=/dev/null bs=512 count=1 skip=2550303 iflag=direct
# ddrescue -d ....

No comments:

Post a Comment