[TriLUG] A question about using dd to restore a corrupt disk image

[Andrew Blum]

On Thu, Apr 12, 2012 at 7:09 PM, Maarten Lippmann <m.w.lippmann at gmail.com>wrote:

>
>
> He was wondering if there was any way of copying the contents of the
> corrupt copy - everything _except_ the corrupt header into the working
> copy or the
> other way round.
>
> Simple visualization:
> Corrupt file:
> data1_data2_data3_Corruptheader
>
> Good older file:
> data4_data5_data6_Goodheader
>
>
>
I'm not a storage recovery specialist, but he may want to try the seek
option built into the dd command:

       seek=BLOCKS
              skip BLOCKS obs-sized blocks at start of output

Does he know the exact position that separates the data from the header in
the two files (like sector n and x below) ?

Corrupt file:
sectodata1_data2_data3_<sector n>Corruptheader

Good older file:
data4_data5_data6_<sector x>Goodheader

If so, then try something like this (given with 512 Byte block size):

# dd if=<corrupt_file> of=/tmp/file_data bs=512 count=<sector n>
# dd if=<good_older_file> of=/tmp/file_header bs=512 seek=<sector x>

# cat /tmp/file_header >> /tmp/file_data

--
Andrew