When a machine will not boot or behaves badly, work from the outside in: get a shell, see the disk, then repair the smallest broken thing. Most recoveries follow the same arc: boot rescue media, mount or `chroot` into the install, fix the bootloader, filesystem, or config, then reboot.
Almost every repair starts from a second environment, so a broken install is not running while you fix it. Boot a live USB (any distribution's installer works) or your distribution's dedicated rescue image, then drop to a terminal.Write a live image to a USB stick from another machine.
Many distributions also ship a rescue entry in GRUB, and systemd offers built-in recovery shells you can request from the boot menu (see *Rescue & Emergency Mode* below). Use a live USB when the bootloader itself is gone.Match the live system's architecture and, ideally, its toolset to the broken install. An Arch live USB has `mkinitcpio`; a Debian one has `update-initramfs`.
Before mounting anything, identify the partitions. `lsblk` shows the block-device tree, and `blkid` prints filesystem types and UUIDs so you mount the right thing.
If the root filesystem lives on LVM or LUKS, the live system will not see it until you bring it up. Unlock an encrypted partition first, then scan for volume groups.
If you only need to copy data off, stop here and grab the files. If the root filesystem refuses to mount cleanly, run a check on it first (see *Filesystem Repair*).Mount read-only with `mount -o ro` when you only want to rescue data from a questionable disk, so you cannot make things worse.
To run the broken system's own tools (its `grub`, its package manager, its `passwd`), `chroot` into it. First bind-mount the kernel's pseudo-filesystems so those tools work, including the EFI variables for UEFI bootloader fixes.
The bind mounts are not optional. Without `/dev`, `/proc`, and `/sys` mounted, tools like `grub-install` and `update-initramfs` fail in confusing ways. After each `--rbind`, run `mount --make-rslave /mnt/dev` (and the same for the others) so the later `umount -R /mnt` cannot propagate back and unmount the live system's own `/dev` and `/sys`.
A missing or broken bootloader leaves you at a `grub>` prompt or with no menu at all. From inside the chroot, reinstall GRUB to the disk, then regenerate its config.For a legacy BIOS system, install to the whole disk (not a partition).
If a kernel update was interrupted or the early-boot image is broken (a "cannot find root device" or kernel panic on boot), regenerate the initramfs from inside the chroot. The command depends on the distribution.
You do not always need a live USB. systemd ships two recovery targets you can request at the GRUB menu: rescue (single-user, most services stopped) and emergency (a bare shell, root mounted read-only, almost nothing else).At the menu, highlight the entry, press `e` to edit, append to the `linux` line, then press `Ctrl-X` (or `F10`) to boot it:
$ systemd.unit=rescue.target
copy
$ systemd.unit=emergency.target
copy
To bypass init entirely and get a root shell with no password, append this instead, then remount the root filesystem writable.
Careful: after `init=/bin/bash`, the normal shutdown path is gone. Run `sync` and reboot with the magic SysRq keys or `mount -o remount,ro /` before a hard reset, so you do not corrupt the filesystem.
On SELinux systems (Fedora, RHEL): run `touch /.autorelabel` after changing the password this way. Otherwise the rewritten `/etc/shadow` keeps a wrong security label and can lock you out again on the next boot.
A dirty or corrupt filesystem can block boot. Always check an unmounted filesystem, never the live root. Boot rescue media, leave the partition unmounted, then run the right checker.For ext2/3/4, `fsck` (or `e2fsck`) replays the journal and fixes structure. `-f` forces a full check, `-y` answers yes to every prompt.
Careful: `fsck` on a mounted, writable filesystem will corrupt it. If you must check the root device, do it from rescue media or before it is remounted read-write.
A typo or a missing device in `/etc/fstab` drops the boot into emergency mode. From the emergency shell, remount root writable and fix or comment out the bad line.
An interrupted upgrade can leave packages half-configured and the system unbootable or unusable. Run these from a chroot if the system will not boot, or directly if it limps to a shell.On Debian and Ubuntu, finish pending configuration and resolve broken dependencies.
Before guessing, read what the system recorded. `journalctl` shows the boot log; `-x` adds explanations, `-b` selects a boot, and `-b -1` shows the previous (failed) boot.
A failing Reallocated_Sector_Ct or Current_Pending_Sector in `smartctl -a` means: stop, image the disk with `ddrescue`, and replace it. Repairs on dying hardware only buy minutes.
When the problem is lost data rather than a broken boot, work on a copy of the disk, never the original. `testdisk` rebuilds damaged partition tables and recovers whole partitions.
If the install is too broken to repair, salvage what you can and start fresh. Image the failing disk before it gets worse, then mount the image to extract files at your own pace.
A whole-disk image holds a partition table, not a single filesystem, so attach it read-only with `losetup -P` to expose its partitions, then mount the one you need.
Copy the data you need off the image, reinstall the OS, then restore from backups. A clean reinstall is often faster and safer than chasing a deeply corrupted system.Every recovery is easier with a current backup and a tested restore. The work you do here is the price of not having one: see the Backup & Imaging page.