1

I need to recreate a system from a corrupt system disk image.

I can't use the system when it boots. The backup algorithm left nothing but similarly corrupt images. The user data looks to be safe but I can't log into the system when booted. It doesn't take keyboard or mouse input and does not connect to the network.

Since all I can think of is trying to look at the data files where the package information is kept, where are the?

Once I have the packages I can tweak the configuration of each package from the corrupt image if the data is still there.

2 Answers2

2

Technically speaking, yes it is possible. All installed packages have a *.list file associated with them; these files are lists of all the files that were created upon installation of a package (but that's beside the point, we only need to know the names of the packages themselves to know what's been installed).

So what you can do is connect the drive (could be SATA to USB connector or live CD/USB ) mount your broken drive's partition (with udisksctl mount -b /dev/sdb1 , note to replace sdb1 with actual disk), navigate to the mount point where partition was mounted, and run

 find ./var/lib/dpkg/info/ -name "*.list"  -type f -printf "%P\n" |  awk -F'.' '{print $1}'  

For instance, I've another partition on my drive where I've got 15.10 Ubuntu. Here's what I'd do:

DIR:/xieerqi
skolodya@ubuntu:$ udisksctl mount -b /dev/sdb5                                                                                
Mounted /dev/sdb5 at /media/xieerqi/0ca7543a-5463-4a07-8bbe-233a7b0bd6251.

DIR:/xieerqi
skolodya@ubuntu:$ cd /media/xieerqi/0ca7543a-5463-4a07-8bbe-233a7b0bd6251   

DIR:/0ca7543a-5463-4a07-8bbe-233a7b0bd6251
skolodya@ubuntu:$ find /var/lib/dpkg/info/ -name "*.list"  -type f -printf "%P\n" |  awk -F'.' '{print $1}' | head
libbuzztard0
linux-headers-3
indicator-bluetooth
python-twisted-mail
netpbm
mtp-tools
javahelp2
firefox-locale-zh-hant
gir1
libqapt2

Side note

This approach produces the list that shows packages of all installed packages as of the last boot of the system. Example from my running system

DIR:/xieerqi
skolodya@ubuntu:$ find  /var/lib/dpkg/info/ -name "*.list"  -type f -printf "%P\n" |  awk 'END{print NR}'                     
2837

DIR:/xieerqi
skolodya@ubuntu:$ dpkg --get-selections | awk 'END{print NR}'
2837
Sergiy Kolodyazhnyy
  • 105,154
  • 20
  • 279
  • 497
  • Does this produce the list of all the currently installed applications or all the applications from the time that the system was installed? – Raphael Jan 24 '16 at 06:22
  • @Raphael As far as I know , it produces all currently installed packages (i.e. what was there since last boot). The list of packages from the original installation may be hard to find since logs may or may not be rotated, i.e. removed by the system from time to time. I would assume basic list of packages is available online. – Sergiy Kolodyazhnyy Jan 24 '16 at 06:25
  • Oh! I didn't know that. +1 from me. – Raphael Jan 24 '16 at 06:26
  • @Raphael sorry I have to change the edit - find has to search path, meaning if I'm in /media/$USER/my-drive , find command has to search the var directory that is there, not /var which refers to root of the running filesystem – Sergiy Kolodyazhnyy Jan 24 '16 at 06:31
  • Oh! sorry then I ran your command and that threw an error so edited it. – Raphael Jan 24 '16 at 06:32
1

Boot to a live environment and do this:

sudo mount /dev/sdaXY /mnt

Change XY to your specification.

sudo find /mnt/var/log/ -type f -iname dpkg.log*

Here, you will get a list of files such as:

dpkg.log
dpkg.log.1
dpkg.log.2.gz

and so on...

Copy those to another folder/drive that you have access to (Also if there are any archives such as dpkg.log.2.gz, extract them).

Now to get the lists of all the packages that were installed in your system:

grep " install " /path/to/dpkg.log | awk -F' ' '{print $4}'
grep " install " /path/to/dpkg.log.1 | awk -F' ' '{print $4}'
grep " install " /path/to/dpkg.log.2 | awk -F' ' '{print $4}'

and so on...

N.B.:- The downside to this is that it will list all the packages you ever installed previously (even the ones that you removed after installation).

Raphael
  • 8,035
  • Nice approach, though it is possible old logs have been deleted, as Sergiy Kolodyazhnyy pointed out. You'll need zgrep rather than grep on the .gz log files, and you don't actually need find because ls will work here. To put it all together in one line: zcat -f $(ls -vr /mnt/var/log/dpkg.log*) |grep " install " |awk -F' ' '{print $4}' – bitinerant Feb 27 '19 at 10:37