Mounting with Knoppix

Hi mark,
You don't mount a drive to dd it.(knoppix/fdisk whatever may not see it if its corrupted anyways.)

you could try ' cat /proc/scsi/scsi ' and see what shows up.

Or, maybe try running testdisk/photorec, from Knoppix, just to see what it finds. But don't run anything of the program. Quit using Q to get out of the menu's and exit the prog.

If the system can see it, it will report so, then at least you have found a ../../../dev/sdX drive identity to dd (or similar) out.

kern

Thanks for help. When I ran the testdisk I got "Attached Devices", but nothing else. Please correct me where I am wrong. When loading Knoppix, you should see the harddrive (either SDA or HDA) under /mnt or /media. Is that correct? If not where? At that point you can dd the drive to another location. Is there another way to image the drive if can't see it under Knoppix? I have a drive caddy, but only for HDA, not SDA. And as mentioned the actual drive is not seen upon bootup.

Thanks,

mark

Does BIOS see the drive/SCSI controller

what did you get back from

# cat /proc/scsi/scsi

and if you run testdisk/photorec run it from a root terminal / shell.

Try photorec, its output is easier to read. when it opens, it will show u the drives directly, mounted or not, the Q Quit.

kern

Thanks for your help. I was finally able to get to view the file system (sda) in /dev/. There is an sda, sda1, sda3, and sda3. I have tried to mount sda, but with no luck. I keeps telling my to specify the fs, but I did with a -t ext2/3. When I run file agaist them I get responses like, sda block special (8/0). I was assuming that its telling me that its a the actual fs. Is that correct. At this time, can I just run dd against the sda located in /dev/ to another remote system with NC (again still using KNOPPIX) and analyze the data on the remote system.

Again, thanks for your help.

Mark

Hi again

/dev/sda is the path to the block device node of the drive. you don't mount this. you would however use it when using dd to copy the drive entirely. like -

dd if=/dev/sda of=path-to-your-sparedrive/myscsi.img

or to clone the drive (needs same size drive or bigger)

dd if=/dev/sda of=/dev/sd(myspare-drive) (or hd for IDE/PATA)

Be absolutely sure of your source (if=) and your destination (of=) .
dd takes no prisoners, and you could lose all data if you get this wrong.

You can use a util called air from a terminal if its installed on that particular version of knoppix u have. its a GUI front end for dd utils.

Once that's done you can either work on this copy and try to mount/restore/repair the partitions, or you can try to carve files out independently.

if the drive was partitioned for a linux type setup
/dev/sda1 is likely to be the boot partition
/dev/sda2 is likely to be the swap partition.
/dev/sda3 is likely to be the root partition.

You might want to try and mount the sda3 partition, as this usually is where your main bulk of data are stored. ie.

mount -t <whateverFS > /dev/sda3 /mnt/sda3

Hardware detection in knoppix is excellent and finds most anything thats still alive, so i'm thinking that the drive maybe corrupted somehow.

If you're still goofed, take a look here

www (dot) ibm.com/developerworks/linux/library/l-knopx.html

hth
Kern

Kern,

Thanks so much for your help.

Mark