Storage failures and data recovery
Following the "copy first" rule, you recover a corrupted file system, a lost partition table, a deleted logical volume and a dying disk without losing data.
Level 501 · 16 lessons · 15 practice labs
Lessons
Principles
- The first rule of recovery: copy first, then act
- Imaging a failing disk with ddrescue
- Working on a copy: loop devices and read-only mounts
- Short task: rescue as much data as possible from a disk with bad sectors
Partitions and volumes
- A lost partition table: testdisk and sfdisk backups
- Recovering from the GPT backup header
- Restoring a deleted logical volume from the metadata archive
- Carefully reassembling an array that won't assemble
- Short task: bring back a data volume that vanished overnight
File system repair
- Corrupt ext4: e2fsck, backup superblocks and lost+found
- XFS repair: the price of zeroing the log
- Bringing back deleted files: extundelete and photorec
- A damaged LUKS header: with and without a backup
- Short task: repair a data partition that won't mount and report what was lost
Wrap-up
- After recovery: root cause and prevention report
- Capstone: bring a storage server with several faults back without losing data
Practice labs
- Image a failing disk first: Image a disk with read errors using ddrescue with a map file and submit the number of unreadable bytes.
- Examine a damaged volume without writing to it: Open a damaged volume through a read-only loop device, prevent journal replay and document the type of damage in a short note.
- Write the recovery plan and evidence trail: For a damaged archive disk at Lavinya Klinikleri record image hashes, plan the order of attempts and write down how each step can be undone.
- Find a deleted partition table again: Use testdisk to find the partitions on a disk image whose table was wiped, rewrite the table and show the file system mounts.
- Repair a damaged GPT from its backup header: On a disk with a corrupted primary GPT header, repair the table from the backup header and confirm the partition IDs are unchanged.
- Bring up a volume group with a missing disk: In a volume group that lost a physical volume, recreate it from the metadata backup and copy the data off the logical volumes that are reachable.
- Repair ext4 from a backup superblock: On a volume that will not mount because of a bad superblock, locate a backup superblock and run the repair with it.
- Repair an XFS volume with a damaged log: On an XFS volume with an unreadable log, try a log replay first, then run the repair and report what landed in lost+found.
- Extract data from a Btrfs volume that will not mount: On a Btrfs volume with a damaged tree root, try the older root copies and, if it still will not mount, pull files to another disk with restore.
- Bring deleted files back from an image: Recover contract files deleted by mistake from a disk image with photorec and submit the number of PDFs recovered.
- Rescue a deleted file that is still open: Copy a log file that a running service deleted but still holds open through /proc and compare its hash with the original record.
- Recover a deleted file from the ext4 journal: Find the inode record of a deleted config file in an older journal copy and extract its contents block by block.
- Assemble an array that does not assemble itself: Examine the member states of a mirror that did not assemble at boot, assemble it by hand and write down the event counters.
- Recover a RAID 5 with shuffled members on images: Find the right order of a three-disk array with wiped metadata by trying on copies of the disk images, then mount the file system read-only.
- Open an encrypted volume with an overwritten header: Restore the header backup on a LUKS volume whose header start was overwritten, check the key slots and move the data to a new volume.
About this course
Following the "copy first" rule, you recover a corrupted file system, a lost partition table, a deleted logical volume and a dying disk without losing data.
What you will learn
- Principles
- Partitions and volumes
- File system repair
- Wrap-up
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.