rescuing files with a liveCD

from HTYP, the free directory anyone can edit if they can prove to me that they're not a spambot
Jump to navigation Jump to search

Computing: Linux: rescuing files with a liveCD

  • Scenario: Unusable machine (won't boot, bad keyboard/display, whatever) with important files trapped on the hard drive. Let's say it's a laptop, so pulling out the drive and connecting it to another machine is at least difficult and risky.
  • Solution: Boot up using a liveCD, connect to it through your LAN, and copy the files.

Using Knoppix

I'm using Knoppix as the example here, because I wasn't able to get the display to work right on this particular laptop (there's probably a way to do it without using a keyboard, but I don't know enough about Knoppix, e.g. what is the default password for any default user?) with any other liveCD.

You will need:

  • a Knoppix liveCD (or other liveCD where you know the equivalents of the details given here)
  • a connection to a LAN with a suitable host computer on it (details follow)
  • that computer must have:
    • ssh (Linux always does, but it's available for Windows too). This is only needed for testing the ssh connection
    • scp (again, Linux does)
    • enough space to store the files you intend to rescue


  • Boot the unusable machine with the liveCD. (This may be slow. If you know how – which I don't – you can select a command-line-only mode for faster booting; graphics are not needed.) A terminal window should come up.
  • Find out what the machine's IP address is using ifconfig (no parameters). You should see at least two network interfaces listed: (1) a real network interface, probably "eth0", and (2) the loopback interface, "lo". Look for the line "inet addr" in eth0 (or any of the real interfaces, if there are more than one); the first address listed (I got " is the machine's local IP address.
  • Change the password for user "root" (necessary because by default root has no password, which means you can't log in from outside; any password will do, as long as you can remember it):
(enter new password at the prompts; it will ask twice)
  • Start the ssh daemon:
/etc/init.d/ssh start
  • This should churn for a bit and print out a lot of gobbledygook about generating secure keys and fingerprints. If that doesn't seem to work:
ls /etc/init.d|less
  • will give you a list of daemons; look for anything beginning with ssh (possibly sshd).
  • Now you need to determine the filespec of the drive you want to rescue. Also, Knoppix will not mount it automatically (other liveCDs might), so you will need to mount it. Fortunately, Knoppix does put recognized drives into the /etc/fstab file, so you don't have to puzzle out how to mount them manually. On the example system, I was able to mount the main hard drive with this command:
mount /dev/hda2
  • If that's not the drive you're looking for, do "cat /etc/fstab" to see what other drives might be available.
  • Go over to the host computer.
  • Optional steps to test the ssh connection:

(On the "host" computer) start a shell session and (if using Linux) type:

ssh root@bad.machine's.ip.addr


ssh root@

You should be able to log in using the password you just set. Type "exit" to close the ssh connection.

  • Navigate (i.e. cd) to the directory where you would like to save the directory-structure from the unusable machine.
  • Type this (first line is general, and the second line is the actual command I used):
scp -prv root@bad.machine's.ip.addr:/path/to/files/to/rescue/* path/to/local/destination
scp -prv root@* .

Note the final "." in the example – this refers to the current folder, i.e. (in the example) where I wanted the files to go.

  • Answer prompts as needed (you will probably need to answer "yes" to one prompt, and then to enter in root's password on the unusable system).
  • Sit back and watch as files are copied.

other methods

Another method which preserves timestamps and attributes involves tarring the files on the remote machine and piping the output of the tar over the network connection. This method might also not give the reassuring feedback of showing filenames as they are processed. These examples have not been used successfully; I am recording them for later testing. --Woozle 07:04, 1 February 2006 (EST)

tar czpf - dir |ssh user@host 'cd /dir/path; tar xzpf'

ssh user@machine 'cd /path; tar czvpf -' |tar xzf -

The "v" in "czvpf" is for "verbose", i.e. show the files as they are being tarred. Both of these commands tar, stream, and untar the files. The dashes on the tar parameter lists indicate stdout/stdin; in other words, the command says "tar to stdout | ssh to machine | tar from stdin".

ssh root@ 'tar czvpC /mnt/hda2 -vf - *' |tar xzf -
ssh root@ 'cd /mnt; tar czvpf - hda2' |tar xzf -

other distros

With the ubuntu or kubuntu liveCDs, you will need to install the ssh package (which includes the ssh server and client). Run Adept or Synaptic, whichever is available, for user-friendly GUI-based installation of packages.