Advanced Linux Rescue Techniques

Introduction

When standard troubleshooting fails, these advanced rescue techniques can help you recover seemingly lost Linux systems. Always remember: with great power comes great responsibility. Proceed with caution and always back up your data before attempting these methods.

1. Emergency Kernel and initramfs

When your system won't boot due to kernel or initramfs issues:

1. Boot into GRUB menu
2. Select the problematic entry and press 'e' to edit
3. Find the line starting with 'linux' and add: init=/bin/bash
4. Press Ctrl+X or F10 to boot
5. Once in bash shell, remount root filesystem as read-write: mount -o remount,rw /
6. Perform necessary repairs
7. Reboot with exec /sbin/init

2. Chroot from Live Environment

For deeper system repairs:

1. Boot from a live USB
2. Mount your root partition: mount /dev/sdXY /mnt
3. Mount virtual filesystems:

   	  
   mount --bind /dev /mnt/dev
   
         
   mount --bind /proc /mnt/proc
   
         
   mount --bind /sys /mnt/sys
   
   	  

4. Chroot into your system: chroot /mnt
5. Perform necessary repairs
6. Exit chroot and reboot

3. Rescuing with SystemRescue

SystemRescue is a specialized Linux distribution for recovery operations.

• Boot from SystemRescue live USB
• Use tools like TestDisk for partition recovery
• Use PhotoRec for file recovery
• Access encrypted volumes with cryptsetup

4. Recovering LUKS Encrypted Volumes

If you can't access your encrypted volume:

1. Boot from live USB
2. Install cryptsetup if not present: sudo apt-get install cryptsetup
3. Open the encrypted volume: cryptsetup luksOpen /dev/sdXY decrypted
4. Mount the decrypted volume: mount /dev/mapper/decrypted /mnt
5. Access your data and perform repairs

5. Rescuing RAID Arrays

For software RAID issues:

1. Boot from live USB
2. Install mdadm: sudo apt-get install mdadm
3. Scan for RAID arrays: mdadm --assemble --scan
4. If array is degraded, you may need to force assembly: mdadm --assemble --force /dev/md0 /dev/sdX1 /dev/sdY1
5. Mount the array and perform repairs

6. Kernel Panic Analysis

To analyze kernel panics:

1. Set up kdump to capture crash dumps
2. Analyze dump with crash utility: crash /usr/lib/debug/vmlinux /var/crash/vmcore
3. Use commands like 'bt' for backtrace, 'ps' for process info

7. Recovering Overwritten Files

If you've accidentally overwritten an important file:

1. Immediately unmount the filesystem or remount as read-only
2. Use debugfs to attempt recovery: debugfs -w /dev/sdXY
3. In debugfs, use 'logdump -i <inode>' to find previous versions