We have all run into cases where Windows refuses to load for one reason or another. The problem may be a hardware or a software failure, and the problem may seem to be irrecoverable. Yet often Linux can be used to help recover data that otherwise might be lost.

Creating the Image:

we use dd command to image the disk or partition. dd is a common UNIX program whose primary purpose is the low-levellow-level copying and conversion of raw data.

bash# dd if=[device] of=[imagename]conv=noerror

if= input file, Linux drives are located in /dev directory.IDE drives names begin with hda for fist ide disk and hdb for second ide disk and for scsi drives names begin with sda. As for partition,hda1 means first partition in ide disk1 and hdb2 means second partition in ide disk2.

of= output file.

conv=noerror, instructs the program to continue reading in case of an error, which may be necessary if the drive has been damaged.

Writing the image to remote machine using netcat:

netcat utility (nc command) considered as TCP/IP swiss army knife. It reads and writes data across network connections, using TCP or UDP protocol. It is designed to be a reliable “back-end” tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities.

Command to type on hostB (receiving data machine):

bash# netcat -p 1111 -l |bzip2 -d | dd of=/data/recovered_hda1.img

Where,

• -p 2222 : Specifies the source port nc should use, subject to privilege restrictions and availability. Make sure port 2222 is not used by another process.
• -l : Used to specify that nc should listen for an incoming connection rather than initiate a connection to a remote host.
• bzip2 -d : Compresses image using the Burrows-Wheeler block sorting text compression algorithm, and Huffman coding. This will speed up network transfer ( -d : force decompression mode)
• dd of=/data/recovered_hda1.img : specify where you want to copy the recovered partition.

Command to type on hostA (sending data machine):

bash# bzip2 -c /dev/hda1 | netcat 192.168.1.100 1111

Done. This process takes some time so be patient.

You can track the the image file size on the remote machine using watch command:

bash# watch du -h recovered_hda1.img