Re: [gentoo-user] data recovery advice needed

[Rich Freeman <rich0@gentoo.org>]

On Sat, Dec 15, 2018 at 6:33 PM Jack <ostroffjh@users.sourceforge.net> wrote:
>
> So, I removed that HDD for safekeeping (completely reinstalled the
> laptop on a new drive) and now I'm trying to recover data from an
> intact partition on the old drive, the problem being that the drive is
> giving some read errors, so I want to minimize access, lest it die
> completely.

Ok, step 1 - make a copy of the drive before you go messing with it.
I suggest using ddrescue for this.  Basically it works like dd
(creates an image of the drive), but it is persistent in the face of
read errors.

Once you have a copy of the drive you can now start experimenting.
Obviously keep that copy safe and if you want to write to it create
another copy.

As far as fixing dates goes - the touch suggestion might work but
honestly unless you're in a super hurry I'd just do another copy.

If you've lost any kind of drive metadata such that files are missing
completely there are utilities that can scan disk blocks looking for
things like text files, or jpegs.  That is going to be a massive
headache but if you've lost something indispensible it is an option.

Ultimately your goal is going to be to get the files you care about
off the drive.  Then you can just copy/rsync them to a completely
fresh filesystem - I wouldn't go trying to copy the old filesystem
using dd if it has been subject to read errors or especially partial
overwrites of metadata.  You want the metadata to be clean.

And then once you have your data back on a disk give some thought to
your backup strategy.  If you care about data enough to be going
through trouble to rescue it, you should probably have a backup of it.
When I was messing around with btrfs and the filesystem ate my data I
wasn't messing around with hex editors - I just wiped the filesystem
and rsynced from a backup.  Sure, it takes time, but you know the
filesystem is completely clean when you're done.

-- 
Rich