So, a man walks into a [Genius] Bar…

By Dave On February 22, 2010 · Add Comment · In Tech Journal

Self-recrimination is a sur­pris­ingly pow­er­ful motivator.

I won­dered into the State Street Apple Store this after­noon and had an pleas­ant encounter with one of the Geniuses (Genii?) behind the bar. Not­ing my snappy, well-put-together appear­ance and preppy Com­mand Prompt polo shirt, he opined that he was famil­iar with the brand, and had recently been perus­ing the web­site. Yes, this very site which, in a burst of syn­chronic­ity, you are now, your­self, view­ing. Sends chills up the spine no?

Any­way, it reminded me that I don't cur­rently have a sin­gle post­ing on the wretched thing, and that in my posi­tion of joint supreme ruler, I should prob­a­bly have one. (Actu­ally, I did have a few posts, but they were swal­lowed by Word­Press and are gone for­ever. Don't ask.)

So, Erik the State Street Genius, this post's for you. An oldie, but, I think, a goodie.

This is a rather handy lit­tle les­son on some of the neater things you can do with the com­mand line, a dead hard drive, and an inor­di­nate amount of time. Please note: this tip involves open­ing up the Ter­mi­nal util­ity and typ­ing a lot of com­mands very care­fully. Check your syn­tax. Com­mand Prompt LLC is in no way respon­si­ble if your com­puter explodes. Actu­ally, those who know me swear I’m not respon­si­ble, period.

The under­pin­nings of OS X are murky, ancient UNIX foun­da­tions, and dip­ping into it is often an expe­ri­ence akin to fish­ing off the edge of some crum­bling, dilap­i­dated pier. Sure, you know full well what's down there, and how to bring it all up, but then you stum­ble across a Coela­canth or two and won­der where the hell that came from, and how you're sup­posed to cook the darn thing. But­ter? Lemon juice? Hot sauce? Absinthe? Is it even legal? dd is prob­a­bly going to be a pre­his­toric catch of the day to a few of you, so it's worth spend­ing a minute or two talk­ing about what it is and what it does.

Sim­ply, it's a neat lit­tle pro­gram that copies stan­dard input to stan­dard out­put, and it's gen­er­ally used for copy­ing and syn­chro­niz­ing disks on a byte-by-byte level. Even "dead" disks — if you have the time and the incli­na­tion, it can often pull a lot of fairly use­ful stuff off a drive you may have given up for dead.

Here's how: First, you have to find the drive. I like to keep a cou­ple of assorted enclo­sures around for putting dri­ves into, usu­ally a nice firewire one for ATA and SCSI, and a bizarre, no-name brand USB2 one for SATA dri­ves. Once you have the drive snugly in its enclo­sure, hook it up to your mac, and fire up the Ter­mi­nal. Type in "disku­til list" for a list of all avail­able disks and their atten­dant par­ti­tions. What you're look­ing for is the iden­ti­fier for your dead disk — it should be pretty straight­for­ward; look for the disk that isn't one of your cur­rently mounted disks, then iden­tify the par­ti­tion on the disk that con­tains the files you want to recover. Hint: it's prob­a­bly the biggest one. It should fol­low the syn­tax "disk(disk number)s(partition number)".

For our exam­ple, we're going to use the sec­ond par­ti­tion on the sec­ond disk, or "disk1s2". Next, you need another drive to copy every­thing on to. Note, it can be your main hard drive if you have enough space — we're going to cre­ate a disk image of the dead hard drive, so we don't nec­es­sar­ily require a whole other par­ti­tion. Make sure you have enough space, though — dd will copy the whole drive, even unused space, so if you're try­ing to revive a 40GB hard drive, you'll need 40GB of free space to put it on to.

Open a new ter­mi­nal win­dow. I like to put the recov­ered stuff on my desk­top, so the actual syn­tax (note: type it all as one very, very long string) I'd use for our disk1s2 drive would be:

dd bs=512 if=/dev/rdisk1s2 of=/Users/dave/Desktop/recovereddrive.dmg conv=noerror,sync

Here's what all that means:

dd — the com­mand. Duh!

bs=512 — set the block size for the trans­fer to chunks of 512 bytes.

if=/dev/rdisk1s2 — look for the device/partition in the invis­i­ble /dev directory.

of=/Users/dave/Desktop/recoverddrive.dmg — copy every­thing to this new location.

conv=noerror — don't stop on any nasty bad sec­tors or other stum­bling blocks.

sync — fill those miss­ing spots with null data.

Hit return. And wait. A long time. dd is great for retriev­ing data, but it often takes days to trawl through a large drive, byte by byte. The longest I've ever had it run was a hair under three weeks on a dead 160GB drive, and I've heard of it tak­ing up to a month for more com­pli­cated jobs. Moral of the story? OS X has a lot of very pow­er­ful UNIX tools bolted right into the OS that you'll prob­a­bly never hear of, and almost cer­tainly never need. Oh, and please, for the sake of all that's good and true, have a backup strategy.