wally’s blog

I’m currently getting stuck into “The pleasures of God” by John P. I have to say, having read several of his books, this one has moved me most thus far. I’m sure that when I come to reread previous books again, I’ll be equally shifted spiritually and theologically; but as to where I am right now, God is speaking loud and clear through this one.

Something I’ve come to admire so much of Piper is his almost blinkered, whole centered, obsession with God’s glory, and desire for having a Biblical practicing of it.

I’m becoming more convicted each day of the truth that if we as Christians could find more enjoyment in God, if we could find out satisfaction purely in Him, that is absolutely to say in scrapping TVs, game consoles, unnecessary holidays, loans, gadgets and the rest, we would become more human. We would become more satisfied, more excited, more joyful, more complete, more as we were designed to be.

A superb sermon yesterday evening looking at an introduction to prayer, considering that God promises that if we delight ourselves in Him, He will give us the desires of our heart. That’s powerful, deep stuff. God will always without hesitation satisfy fully, most completely, without restraint, our desire for Him. So if we solely seek satisfaction in God, our good and holy, perfect God, we will be made totally satisfied.

As my fallen nature encourages me to struggle through this life by my own futile strength, seeking satisfaction in money, relationships, jobs, and often even knowledge or experience, I become more and more dissatisfied, and I’m starting, just starting, to understand why that is. I know it at an intellectual level, but not at a real, applied one.

So my prayer today and forever until He returns or calls me home is that me and all my brothers and sisters would find more delight in the Lord each day. And for those who are no yet saved, that God would graciously and mercifully reveal His glory to them, so they may too find real satisfaction for an eternity.

~

Something else, slightly off topic which had never occurred to me, is that humanity is immortal.

Now that needs to be expanded because upon first reading it may sound like we are God. We are not God. All I said was, we are immortal.

We are immortal, because God designed us so. We are both physical and spiritual beings, one and at the same time. As Christians we know that when we die, we will go to be with our Lord forever. But those who are not elect don’t just cease to exist. On the contrary: they exist for eternity too. In turmoil.

So again, I’m reminded to be careful in what I say. Our fallen human bodies are not immortal, but our persons are. That is a powerful statement for evangelism.

Recover data even when an NTFS (or other) won’t mount due to partial hard drive failure.

This was born when someone brought me a near dead hard drive (a serious number of read errors, so bad that nothing could mount or fix the filesystem), asking if I could recover any data.

Now obviously (as almost any geek would know), the answer of course is a very likely yes. There are many ways of recovering data. One such way (which I performed) is using Foremost to find files based on their headers and structures. While this technique works really quite well, it does miss a lot of files, fragment others up, leave bits out and generally not retrieve any metadata (such as filenames etc).

This makes Matt mad. No filenames == days of renaming files.

So I booted up Helix, created a quick image of the drive to a 500GB external drive, and tried running Autopsy (the GUI of Sleuthkit). This is where things got interesting.

I say interesting, because Sleuthkit couldn’t read the filesystem. But it could retrieve the inodes, and the metadata along with them. And it could accordingly retrieve the data content of (some) files.

Observing this, I realized there was a high probability that I could somehow use Sleuthkit’s command line tools to retrieve the files which were not on bad clusters and recover the filenames from the inode. As it turns out, this wasn’t such a bad idea!

There are 3 tools which proved useful:

• ils
• ffind
• icat

ils “lists inode information” from the image, ffind “finds the name of the file or directory using the given inode” and icat “outputs the content of the file based on it’s inode number”. Using these three tools and a bit of bash, we can grab a list of inodes, get the filename from the metadata, create the directory structure beneath it, extract the file content, move on to the next.

So for this task I knocked up the following (really ugly, potentially unsafe) script:

#!/bin/sh
for inode in $(cat /tmp/inodes) ; do
 
/KNOPPIX/usr/local/sleuthkit-2.09/bin/ffind /dev/hda1 $inode
 
if [ $? -eq 0 ]
then
	echo "INODE: $inode"
	INODEDIR=`/KNOPPIX/usr/local/sleuthkit-2.09/bin/ffind /dev/hda1 $inode`
 
	REALDIR=/mnt/out`dirname "$INODEDIR"`
	FILENAME="/mnt/out$INODEDIR"
	mkdir -p "$REALDIR"
 
	echo "FILENAME: $FILENAME"
	/KNOPPIX/usr/local/sleuthkit-2.09/bin/icat /dev/hda1 $inode > "$FILENAME"
 
	if [ `du "$FILENAME" | awk '{print $1}'` == 1 ]
	then
		rm "$FILENAME"
		mkdir -p "$FILENAME"
	fi
	echo ""
fi
done

Really, I do warn you, take serious care running this!

It needs a lot of work, but enough is there for it to function. It reads a file of inode numbers (one per line) and uses ffind to get the filename. We extract the path, attempt to create it, output the file content and (this is important), take a wild guess at if the inode was a directory. Please note this is wildly inaccurate and needs serious rethinking! Currently we look at the file size, and assume directories alone use 1 byte.

We can populate a file with inode numbers like so:

ils -a /dev/hda1 | awk -F '|' '{print $1}' > /tmp/inodes

(Users of Helix will need to use the full pathname to ils as in the above script).

At some point (no garuntees when) I’ll tidy up the script and make it more bullet proof. In the meantime, I hope this saves some data!

Remember: No matter how much data you have, it’s always better to have 2 hard drives of half the size, mirrored than it is to have one large expensive drive. They will die unexpectedly! When you next buy a bigger hard drive, consider this: 1x500GB drive will loose you 500GB of data. 2x250GB will 99.9% probability loose you nothing. So if you’re on a tight budget, buy twice smaller. If you’ve a lot of money, buy twice big.

Oh, and always make regular backups. Cheap USB drives are good for this!

To celebrate my 2:1 degree (praise the Lord), my MacBook decided to aquire a none to small crack on the wrist rest. Naturally Apple have spent the weekend getting new parts and fixing it for free, but one does have to wonder if they’re falling victim to cheap materials?

If you’re responsible for one or more Linux servers, (they provide packages for Linux distributions only, but it may be easily ported to other Unixes) you may be interested in the lesser known tool MondoRescue.

It’s essentially nothing more (but it is a lot!) than a front end to several other GPL’ed tools, including BZip, growisofs and busybox.  To cut a long story short, it builds a set of CDs, DVDs, USB sticks with a tiny bootable Linux distribution based on your server’s kernel, which can restore parts or all of your filesystem from tarballs on the media.  It can also backup to tape drives, NFS mounts or a local filesystem.

It has (imo) a nice, clean ncurses interface; and it’s quick to use.  On an AMD K6 clocked at 350MHz, with 60MB free memory, it took just under 6 hours to compress 8.5GB of data down to a single DVD (4.7GB).  Doing the backup with an “average” compression took far less time (around an hour), but would have eaten up several DVDs.

You’re presented with a wide variety of options when you boot up the produced rescue media.  You can “nuke” the system and start from scratch, or just restore the parts you want.  It can handle new disk geometry, and because the entire rescue system is burnt onto the media, (assuming you used CDs, DVDs or USB storage), it’ll work even if the target machine is clean.

Inspired by a template in Pages (a part of the iWorks ’08 suite), I’ve started the tiring process of creating my own, plain and simple WordPress theme.

If it’s working correctly, (which while under development, may well not be), this blog should have murky green headings and an awful lot of nothing.  That’s intentional.  I believe in the “not what you include, it’s what you exclude that matters.”

Once it’s been running for a few weeks and I’m happy I’ve gotten rid of every glitch and cross-browser bug etc, I’ll release it on here under a creative commons.  Just for you.

Today I discovered an amazingly useful feature in Mail (for Mac). You can create so called “smart” mailboxes, based on any or all of several criteria including the from address, subject and message body.

The immediate use which occurred to me for this is to keep a handle on how many of those infuriating FaceBook notifications I receive. By creating a smart mailbox for all such messages, I can easily clean out my inbox of all outdated junk.

Today we discovered that Epson’s wonderfully affordable colour LaserJet printer (the AL-C1100, networked) isn’t actually as efficient as they claim.

Epson are quick to promote the number of pages per cartridge this bessy can do (which I agree, is very good for a colour laser) but they somehow forgot to mention the Photoconductor unit, which costs £150 to replace, only lasts 15,000 pages. That’s another 1p per page, or 2p per double sided.

Ouchies.

So before you go buying one of these printers, when you’re calculating the cost per page, don’t forget to add 1p to your total, for that stupid photoconductor unit.

So we’ve all done it at some point. Bye bye beautiful partition table. Bye bye 20 user’s worth of mail. Bye bye rest of my weekend doing anything enjoyable.

I just had to blog this, I was that impressed! gpart scans your hard drive for likely partitions, and offers to write the guessed MBR back to the HD. For me it worked first time without any hackery. To say I’m relieved would be a massive understatement!

So if you’ve just lost a partition, give gpart a go. Remember, always make a backup of the HD before doing it (dd if=/dev/xx of=/somewheresafe), and always have a backup system in place for lost data. The most I would have lost would have been emails received since 3.00am this morning.

I’ve just been having a long old tinker with plfc.org.uk, and I read on (slashdot iirc) about the upcoming HTML and XHTML releases, and the different directions they’re aiming.

For once I feel that the Internet might be becoming slightly structured!  I’m in preference of XHTML, it’s well structured, it’s unambiguous (assuming people actually validate it, but then there’s absolutely no point in using a language if you’ve not used the correct syntax, nobody releases source code with 20 compile errors in it on the basis that “well, some compiler out there will be able to guess what I meant”), and it’s extensible.

That was it really.  I just thought I’d proclaim my adoration of XML

Blogged with Flock

posix_setgid only sets the primary group for the process.  So make sure the group permissions you’re relying is a single group, who’s GID is set in /etc/passwd.

Took me over an hour to trace that bug down today.