I still have every single hard drive I’ve ever used in every computer and laptop I have ever owned. I’ve always been a bit paranoid of doing anything with them, so for the past decade or so I’ve had a shoe box overflowing with all manner of disks rotting in my closet. However, a friend is spilling up a file server, and I’d want to donate some disks to them to get them started. Before simply handing the box over to them though, I’d want to make sure that I have all files on the drives backed up that I can possibly find, and make sure that my friend cannot pull them off the drive after I hand them over to them. Here’s my general workflow and advice if you’re ever finding yourself in a similar scenario.
Connect and mount the disk
Try having the drive hooked up in a similar manner than it was previously installed, i.e. don’t use an external hard drive adapter kit or a molex to SATA or USB adapter or anything like that if you at all have the ability to not do that. Mounting the disk usually shouldn’t be too difficult with any Linux distro, but if you’re having problems with it or working in a niche/unique scenario you might have to poke around a bit to figure out how to get the disk mounted. For example, Apple File System (APFS) has been painful to work with for me, but apfs-fuse by sgan81 will get you up and running.
Identify the drive
After your disk is all connected, run fdisk to find its logical location on the host.
$ sudo fdisk -l
You should see a report with many entries similar to the one below, which is the report on the 500GB Western Digital disk I’m looking to back up right now on /dev/sdb. It should generally be pretty easy to identify the drive from this by its manufacturer, disk size, disk model, partitions, etc.
Disk /dev/sdb: 465.76 GiB, 500107862016 bytes, 976773168 sectors
Disk model: WDC WD5000BPVT-2
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0xe790d1d1
Device Boot Start End Sectors Size Id Type
/dev/sdb1 * 2048 974772223 974770176 464.8G 83 Linux
/dev/sdb2 974774270 976771071 1996802 975M 5 Extended
/dev/sdb5 974774272 976771071 1996800 975M 82 Linux swap / Solaris
Partition 2 does not start on physical sector boundary.
If you are working with several drives that have the same make and model and size, it can be hard to identify which particular disk is the one you’re currently trying to target. Within /dev/disk/, there are also links to all of the disks connected to the host sorted by various aspects.
by-id/
by-partlabel/
by-path/
by-label/
by-partuuid/
by-uuid/
If you know the serial number of the disk, /dev/disk/by-id/ can help you figure out which specific disk you’re trying to work with. If all else fails, simply disconnect the disk, run fdisk, reconnect it, run fdisk again and see which drive is different between the two outputs.
Back the drive up to a disk image
Disk image backups of a drive create a perfect 1:1, bit-for-bit recreation of a physical drive in a digital package. This is great for performing data recovery against, as working with an image instead of a physical disk prevents further modification or interaction to the disk potentially overwriting deleted files.
MAKE SURE YOU HAVE ENOUGH STORAGE BEFORE PERFORMING A BACKUP! These tools will NOT warn you if you do, and it can (temporarily but seriously) fuck your computer up when you accidentally run out of space. If you do, just rm whatever backup has already been completed. This one-liner will report if you have enough empty space to back up each of the drives connected to the host.
$ for disk in $(lsblk -dno NAME | grep -v sda); do size=$(lsblk -dnbo SIZE /dev/$disk); avail=$(df --output=avail / | tail -1); if (( size <= avail * 1024 )); then echo "/dev/$disk: enough space"; else echo "/dev/$disk: not enough space"; fi; done
Making disk images with dd
If you have never had any issues with the drive, dd is simple, fast, comes preinstalled, and will work great, but if your drive is a bit faulty or you’d merely like a placebo, skip ahead a bit.
Using the Western Digital disk as an example again, I’d run this command.
sudo dd if=/dev/sdb of=/home/braxt0n/backups/wdc-500gb-2024-07-01-dd.img bs=4M status=progress
Be sure to change the input file (if) and output file (of) to your specific scenario. You should start seeing a live update of the backup progress.
if you have an exceptionally large disk with a higher read/write speed (such as a NAS drive), a block size of 8M or 16M might work better and speed this process up, while it’s generally good practice to use a block size of 512K or 1M for smaller file systems. On testing all of these block sizes on the 500GB Western Digital drive with time, 4M was the most efficient block size, but your mileage may vary. Also keep in mind these numbers were from me backing them up to my NAS which would be significantly slower than backing them up to a disk on the host (in my setup, about 7-10 times as slow).
You can also use conv=sparse with dd to not back up empty blocks. This is useful if you are working with a very large drive that you didn’t have much data on, as it’ll create a much smaller image file. I’m a bit superstitious about using it in any scenario, but do whatever you want.
Making disk images with ddrescue
ddrescue doesn’t come preinstalled in most distros, but it is a much finer tuned tool for crafting disk images from bad drives. Where dd might have problems reading certain sectors (especially ones that are confirmed to be problematic with smartctl or badblocks), ddrescue will make multiple passes, backwards passes, random passes, etc. to try to fully read a damaged disk. It also has better support for resuming a backup than dd. The major drawback from this is that it’s SIGNIFICANTLY slower, so if you already know that your drive is perfectly healthy, stick with just using dd.
# Debian-based distros
$ sudo apt install gddrescue
# Red Hat-based distros
$ sudo dnf install ddrescue
From here, everything is kinda similar to dd.
ddrescue -vfd -r3 /dev/sdb /home/braxt0n/backups/wdc-500gb-2024-07-01-ddrescue.img
This command will force file output, run on direct disk access, and pass over each sector 3 times before moving on. you can also adjust --sector-size= based on the fdisk output, but most times the default (512k) will work just fine.
Verify the backup
You can verify the backup by comparing the original disk with the backup image using md5sum or another hashing tool.
| |
File Recovery
For file recovery on Linux, testdisk and photorec are the two main options. They serve different purposes, and can be used in conjunction without issue. It’s also best practice to back up a recovery disk image before you make changes to it (a simple cp will do fine), but to be honest I don’t do this myself that much.
File recovery with testdisk
testdisk is designed to recover lost partitions and make non-booting disks bootable again.
# Debian-based distros
$ sudo apt install testdisk
# Red Hat-based distros
$ sudo dnf install testdisk
Run it against the disk image you’ve made.
| |
This should pop up with the disk image in the GUI. Proceeded and select the partition table (in most cases, this will be Intel). Then select Analyze and proceed through the menus.
Depending on what you try to do, this may discover the lost partitions and you can stop here. However, if there’s some documents you’re trying to claw back, keep reading.
File recovery with photorec
photorec is designed to recover lost files including videos, documents, applications, etc. and is specially designed to recover lost pictures from camera memory. It comes installed with teskdisk, so you should have it now.
| |
Just like testdisk, the disk image should pop up in the GUI. Select it and continue. It should be showing any partitions that it can find. Select them one by one and search the Whole Partition for files, and then select the output directory. It will give you an estimated time until completion and inform you of any files it recovers and their filetypes.
Secure Disk Wiping
This is fairly common knowledge nowadays, but when you delete a file on your computer, even when you empty your trash can, those files are not actually “deleted” from the hard drive. The space on the disk is simply marked as being eligible for rewriting, so unless it actually does get written over, its actually extremely easy to recover those files in the methods listed above. So what do you do if you don’t want anyone to read something you have deleted? Searching around for this topic, you’re going to find all sorts of advice that wildly contradict each other. Some people say that a single wipe works the best, others say that three or seven or 27 or even 35 wipes are how you truly remove all traces of data from a disk. The truth is, the moment that data gets written over in a hard drive, that data instantly becomes extremely difficult for a single person to recover. As such, the most secure method of disk wiping involve “zeroing out” a drive (in which every bit on the drive is switched to a zero) or adding random data to it. However, especially with solid state drives this method is not bulletproof, so it is a good practice to do multiple passes. However, a major consideration should be drive health. If you at all planning on using the drive again, any full pass will significantly decrease the life of the drive. Hard disks and solid state alike are consumables, they only have a limited lifespan where they can hold data without it getting corrupted, and the lifespan is mostly determined by how much data has been written and rewritten on the drive. So, while Western Digital or Seagate might tell you that a 7-pass wipe is the most effective way to wipe data, keep in mind that these are all people in the business of trying to sell you a hard drive. The most widely-recognized standard for secure data disposal (aside from shooting a nail gun at a drive) is the US Department of Defense 5220.22-M Data Santization Guidelines, which recommends that agents destroying Top Secret information in magnetic memory should “overwrite all addressable locations with a character, its complement, then a random character” in three passes. There’s plenty of apps that do a good job of this, but I like doing stuff with tools I already have instead of installing something like BleachBit (even though I do think that it’s a good piece of software).
Secure disk wiping with dd
Overwrite all addressable locations with a character AKA zero it out for the first pass.
sudo dd if=/dev/zero of=/dev/sdb bs=4M status=progress
Overwrite all addressable locations with its complement AKA one it out I guess for the second pass.
sudo dd if=/dev/zero bs=4M | tr '\0' '\377' | sudo dd of=/dev/sdb bs=4M status=progress
Overwrite all addressable locations with a random character for the third pass.
sudo dd if=/dev/urandom of=/dev/sdb bs=4M status=progress
DOUBLE FUCKING CHECK THAT YOU ARE RUNNING THIS ON THE RIGHT OUTPUT FILE!!
Conclusion
From here, you could mount the drive and format it using gparted, one of the few tools where I much prefer the GUI to the CLI. Hope this helped.