These instructions apply if errors are detected in the file system of your Persistent Storage when unlocking.

XXX: Update screenshot to new wording

TelestaiCB can try to fix these errors, but this might erase some of your data and take a long time.

That is why, if you cannot restore from a recent backup, we recommend that you create a partition image of your Persistent Storage before attempting to repair the file system of your Persistent Storage from the Welcome Screen.

Most of the time, repairing the file system will work fine and will be enough to fix your Persistent Storage.

In the rare cases when repairing the file system will not work, you might be able to recover some or most of your data from this partition image using advanced forensics tools. This recovery process is very technical and you might need help from someone experienced with data recovery.

Creating a partition image of your Persistent Storage

A partition image is a copy of your entire Persistent Storage in a single file that you can save to an external hard disk from TelestaiCB.

To save the partition image outside of TelestaiCB, you need an external hard disk with as much free space as the size of your Persistent Storage, usually 8 GB less than your TelestaiCB USB stick. You can also use another USB stick of the same size as your TelestaiCB USB stick, but writing to a USB stick is usually much slower than writing to a hard disk.

We are presenting here 2 different techniques to create a partition image of your Persistent Storage. We recommend that you try both techniques one after the other.

1. Create a partition image using the Disks utility

   If the hardware of your USB stick is not failing, using the Disks utility is easier.

2. Create a partition image using ddrescue on the command line

   If the hardware of your USB stick is failing, using ddrescue is more technical but copies all the data that can still be recovered from your USB stick.

Creating a partition image using the Disks utility

When the hardware of your USB stick is not failing, using the Disks utility is the simplest way of creating a partition image of your Persistent Storage.

Preparing the external hard disk

1. Start Telestai-CB.

   When starting TelestaiCB, choose to start without unlocking your Persistent Storage in the Welcome Screen.

2. Choose Applications ▸ Files to open the Files utility.

3. Plug in the hard disk on which you want to save the partition image of your Persistent Storage. You need as much free space as the size of your Persistent Storage, usually 8 GB less than your TelestaiCB USB stick.

   A new disk appears in the sidebar of the Files utility.

4. Right-click (on Mac, click with two fingers) on the new partition that appeared in the sidebar of the Files utility and choose Properties in the shortcut menu.

   Take note of the free space in the disk.

Identifying your Persistent Storage in the Disks utility

1. Choose Applications ▸ Utilities ▸ Disks to open the Disks utility.

2. In the left pane of the Disks utility, identify your TelestaiCB USB stick in the list of storage devices.

   Verify its brand and size.

3. In the left pane, click on the storage device that corresponds to your TelestaiCB USB stick.

4. In the right pane, this storage device should have 2 volumes, corresponding to 2 partitions.

   • Partition 1 with a TELESTAICB label and FAT content.

     This partition corresponds to the system partition of your TelestaiCB USB stick.

   • Partition 2 with a TelestaiCBData label and LUKS content.

     This partition corresponds to the Persistent Storage of your TelestaiCB USB stick.

   

5. In the right pane, click on the partition that corresponds to your Persistent Storage.

   Verify that the content of the partition is of type LUKS Encryption.

   This partition corresponds to the encrypted version of your Persistent Storage.

Unlocking your Persistent Storage in the Disks utility

Before creating the partition image, unlock the encryption to access the encrypted version of your Persistent Storage. To do so:

1. Click unlock.png.

2. In the dialog Enter passphrase to unlock, enter the passphrase of your Persistent Storage.

3. Click Unlock.

4. In the dialog Authentication Required, enter your administration password.

   If unlocking your Persistent Storage fails at this step, it is unfortunately impossible to recover as it would mean breaking the encryption of your Persistent Storage.

5. In the right page, click on the new partition that appears below the LUKS partition.

   Verify that the content of the new partition is of type Ext4.

   This partition corresponds to the unencrypted version of your Persistent Storage.

   XXX: Add notes about using unencrypted data?

6. Verify that the size of your unencrypted Persistent Storage is smaller than the available free space in the external hard disk.

7. Take note of the device name of your Persistent Storage.

   The device name is composed of /dev/mapper/luks, followed by letters and numbers.

Creating the partition image

1. Choose  ▸ Create Partition Image.

2. In the Create Disk Image dialog:

   • In the field, Name specify persistent-storage.img.

   • In the menu Save in Folder, choose the external disk to which you want to save the partition image.

   Click the Start Creating button.

   If the Disks utility returns errors while saving the partition image, try the second technique described below to create a partition image using ddrescue on the command line instead.

3. After the partition image is created successfully, close the Disks utility.

Creating a partition image using ddrescue on the command line

If creating a partition image using the Disks utility fails, you can try this second technique using ddrescue, which can be more resilient to hardware failures.

The ddrescue utility tries to copy first the parts of the Persistent Storage that are not failing and skips over the parts that are failing. After that, you can run ddrescue again to try to copy the parts that failed the first time.

1. Choose Applications ▸ Files to open the Files utility.

2. In the Files utility, navigate to the folder of the external hard where you want to save the partition image of your Persistent Storage.

3. Right-click in the empty space of the right pane and choose Open in Terminal in the shortcut menu.

   Doing so opens a terminal that is configured to operate in this folder.

4. In the terminal, execute the following command. Replace /dev/mapper/luks-xyz with the device name found when identifying your Persistent Storage in the Disks utility.

   ddrescue /dev/mapper/luks-xyz persistent-storage.img ddrescue.log

   The output of ddrescue looks like this:

   GNU ddrescue 1.27
   Press Ctrl-C to interrupt
        ipos:  749404 kB, non-trimmed:        0 B,  current rate:  34996 kB/s
        ipos:    1446 MB, non-trimmed:        0 B,  current rate:  24772 kB/s
        opos:    1446 MB, non-scraped:        0 B,  average rate:  33629 kB/s
   non-tried:    9290 MB,  bad-sector:        0 B,    error rate:       0 B/s
     rescued:    1446 MB,   bad areas:        0,        run time:         43s
   pct rescued:   13.46%, read errors:        0,  remaining time:      1m 31s
                                 time since last successful read:          0s
   Copying non-tried blocks... Pass 1 (forwards)
   

   The section about bad areas refer to errors reading the data of your Persistent Storage, most likely because of hardware failures.

5. After ddrescue finishes:

   • If bad areas were reported, you can try leaving your USB stick to rest for some minutes and executing the same ddrescue command again to copy more data.

     XXX: Hardware failure. Change USB stick.

   • If no bad areas were reported of if the same bad areas were reported after several executions of the ddrescue command, it means that all the data that could be rescued was copied to the partition image.

6. Shut down TelestaiCB.

Recovering data from the Persistent Storage

After creating a partition image, you can safely try to recover data from your Persistent Storage without risking to erase more data in the process.

We are presenting here 3 recovery techniques that work in different cases. We recommend that you try the 3 techniques one after the other.

1. Repairing the file system from the Welcome Screen

   If the hardware of your USB stick is not failing, repairing the file system from the Welcome Screen is likely the easiest technique.

2. Copying the partition image to a new USB stick

   If the hardware of your USB stick is failing, you might still be able to repair the file system of your Persistent Storage after copying the partition image to a new USB stick.

3. Analyzing the partition image using Autopsy

Repairing the file system from the Welcome Screen

XXX: Redact Welcome Screen

Copying the partition image to a new USB stick

XXX: Redact GNOME Disks

Only relevant if hardware is failing.

XXX: I also thought about documenting how to attach the partition image for repair, but disk images are only mounted as read-only through a loop device, so that won't work for e2fsck.

1. Start on new TelestaiCB USB stick.

2. Create Persistent Storage.

In Disks:

1. Unmount /media/amnesia/TelestaiCBData.

2. Gears → Restore Partition Image in Disks.

3. Restart on new TelestaiCB USB stick.

4. Repair from Welcome Screen.

Analyzing the partition image using Autopsy

XXX: Redact Autopsy

Big download but easy to install on Windows!

Hard to install on Linux.

XXX: Test installing on TelestaiCB.

Pretty easy to use! I won't give step-by-step instructions but rather general indications and some screenshots.

XXX: Make screenshots of a Persistent Storage analyzed with Autopsy.