- You can recover any type of data: Thanks to the photorec and the testdisk packages that come installed on MorpheusArch Linux by default it can recover over 400+ file formats click here to see the formats supported.
- MorpheusArch Linux doesn’t stop there it can also be called a DFTT (Digital Forensics Tool Testing Image) due to its ISO9660 compliance. Click here for further information
- Don’t need to download anything: MorpheusArch Linux can achieve all of this without a network connection. The packages are already installed and contain a stable snapshot of all the software packages. Right down to the linux kernel itself.
- Cost effective solution for SME and above: It is released for free here.
- Anti-Virus Solution: There is a script that installs ClamAV on MorpheusArch Linux which can be found here. Although it also works on Fedora and Debian based systems also.
Guide to MorpheusArch Linux
Contary to the name; photorec one of the packages pre-installed on MorpheusArch linux is not solely for recovering lost images files. It can recover video files, documents and archives (such as zipped or compressed folders) and photos even from digital cameras. Photorec ignores the systems file system and goes straight for the metadata of lost files.
What is metadata?
Quite literally metadata is data about data. Imagine a 100 piece jigsaw puzzle, the image on the cover of the box of all the pieces is the picture of what it should look like. Think of the image on the cover as metadata for the jigsaw puzzle builder to create the final image. Photorec works much the same way since information of the data is written to the hard drive in “data blocks” each one of these data blocks contains information that identifies itself.
Each puzzle piece has shape and colour to the person to help locate its corresponding place. Much in the same way your reading this words are chained together to form this document. Photorec accomplishes much the same thing but to digital files.
dd is a simple yet versatile tool. You may have already used the dd command for creating bootable live media (It is the recommended way for MorpheusArch linux to be created on a bootable flash drive) It is used to copy from one place to another with all data intact block-by-block regardless of filesystems or operating systems making it also useful for use on a Microsoft Windows© system
Word of Warning
As with any command of this nature it can destroy data rather than recovering it. I remember this command by alphabetical order. I is before O. Below is an example of a standard dd command:
dd if=/dev/sda1 of=/dev/sdb1 bs=64K conv=noerror,sync
The wrong way:
dd of=/dev/sda1 if=/dev/sdb1 bs=64K conv=noerror,sync - Do NOT enter this command.
Say you wish to create a back up of the MBR (Master Boot Record) should the MBR be overwritten it can cause a lot of headaches, its natural for everyone to feel frustrated when data is lost whether it be done through a genuine mistake or a failed hard drive imagine if this happened first thing Monday morning your organisation needs those TPS reports sent to a client and the MBR is overwritten on a multi-user server a backup of the MBR is a good thing to have in these scenarios.
“What is the MBR?”
The master boot record (MBR) is the very first 512 bytes of a storage device. Inside this 512 bytes of data is the operating systems bootloader (GRUB on must Linux systems or LILO) The MBR consists of 3 parts:
The first 446 bytes contain the bootloader
The next 64 bytes contain the operating system’s partition table
The last 2 bytes contain an identifier so the system can recognise this as the MBR
The following command will save your current MBR as ‘mbr.img’
dd if=/dev/sdX of=/path/to/mbr_file.img bs=512 count=1
Remember to change sdX to your harddrive and include the actual path of your system on systems with only one hard drive it is usually /dev/sda but you can run the command lsblk to check.
To restore (be careful: this could destroy your existing partition table and with it access to all data on the disk):
dd if=/path/to/mbr_file.img of=/dev/sdX
If you only want to restore the boot loader, but not the primary partition table entries, just restore the first 446 bytes of the MBR:
dd if=/path/to/mbr_file.img of=/dev/sdX bs=446 count=1
To restore only the partition table, one must use:
dd if=/path/to/mbr_file.img of=/dev/sdX bs=1 skip=446 count=64
You can also get the MBR from a full dd disk image:
dd if=/path/to/disk.img of=/path/to/mbr_file.img bs=512 count=1
Finding the path
The ‘path’ is where files are stored but how do you find the path to some files?
If you have a file called test.txt in your home directory the path to that file would be
MorpheusArch linux comes with the mlocate package. Mlocate is a package that contains a database which is updated at startup through systemd (arch linux’s init or initialise system) however you can update the database manually as root by typing the command:
Note that the /media and /mnt directories are ignored even after updating the database so if you’re still experiencing problems locating a file it could be in the /mnt or /media directories.
It is recommended that when you boot into the MorpheusArch linux enviornment that you run the command updatedb.
ddrescue is not derived from dd. ddrescue uses an algorithm that copies data from failing hard drives if using ‘mapfiles’ or ‘logfiles’ only the needed blocks are read. Here is an example command.
ddrescue -d -r5 /dev/sdX test.img test.logfile
The -d is telling ddrescue to use the disk via direct access and to ignore the kernels cache.
-r5 tells it to try 5 times before giving up if your sure your drive is failing you may have to skip this option attempting ddrescue on a failing drive too many times may cause more trouble than it aims to solve.
/dev/sdX again replace the x for the drive your using ddrescue on with the help of lsblk if you wanted to use it on a specific partition you would make it /dev/sdX1 or /dev/sdX2 respectively.
Test.img – is the name of the file
test.logfile – in short always use a logfile it means you can start from where you left off if you need to or to retry some stubborn bad sectors on a HDD without this logfile you would have to start all over again.