recover data from physically damaged drive
 

I'm trying to salvage some data from a physically damaged drive. I know, I know... if I were serious I would spend lots of money to get the platters read; spare me the lecture, this is more for curiosity than anything else.

I was hoping to use something like dd_rescue to extract some data off of the drive. Unfortunately, the partition table on the drive is not readable and, of course, simply doing "dd_rescue /dev/hdb /some/file" won't work (has to be /dev/hdb1 or /dev/hdb2, etc.).

I know what the partition table ought to look like, but I don't know how to fool the kernel into thinking that it's there. Obviously, fdisk returns errors on startup (unable to read from device). If I could somehow create a device file for the partition I'm after (i.e. /dev/hdb1) then maybe a recovery effort could have a chance. Otherwise it's to the scrap heap with this hard drive. Ideas anyone?

How do you know it's the surface and not circuit or motor?

If it's the circuitvoard under,,, You can take teh card from a same disk or something close to it..
Check that it's the same card...
I did that when my 100 gig was destroyed in the airport security....
got a WD 120 gig witht he same card and changed it with the damaegd one and OPPPS?All my mp3's was there and ready to copy. :)

If it's the disksurface you'd better tryt o look at some of the live-cd's that has to do with forenxic's
Should be something on some of them that let's you "recover" the data. Or at least try to

Good luck :)

is it possible to dd if=/dev/hdb of=drive.dd
and then try and search for partitions on the file with the partition table recovery HOWTO

Kroppus & Tinkster:

There is no indication that this is a circuit board problem (no visible corrosion or damage, no smell of burning electolyte, no trouble recognizing data on the circuit board itself such as model number and vendor name). There is every indication that I am dealing with a crashed read head or possibly even physically damaged platters (the drive used to be readble but became gradually undreadable with continued use). Because the hard drive is no longer manufactured, I would have to spend about $200 to get a duplicate or wait a long time for it to show up on eBay. What indicates to you that this is a circuit board thing?

kinasz:

Uh-uh. /dev/hdb is a device file that points to /dev/null. I could let a program like dd try to copy it somewhere until my face turns blue and still wind up with an output file of size 0. That's why I need to, by hook or by crook, create a /dev/hdb1 to suck data off of.

Also, I've been in the partition table recovery howto. It details how to find out what partitions used to exist on the drive; I already know that. I need to create that partition on the drive, something that is proving difficult since "fdisk /dev/hdb" yields "Unable to read from drive!"

I know what you men abut buying a new disk... I had to do tha, 'cause i needed a new disk anyway.. Actually it took me over a year from the disk was destroyed in the "safe scanning" area until i found one that i could use. Don't belive what they say in airports about the scanner is safe for computer equipment. I've had 4 hardisks + one Creative Nomad beeing destroyed by that..
"We're not sure what it is so we run it through another time, and one more time..."
*is an islamic terrorist, disguised as a black-metal guy* :)

One sure indicator to that it's the circuitboard is that the disk comes up with the right name but it doesn't show the right size. Another one is that it's fully working in BIOS but not when you try to acess it..
maybe you should search for "The Ultimate Boot CD" it's a great cd.. Not a huge file either.. But it got a lot of tools for testing disks and so on...

It can jsut be that it's the /dev/hdb file that is corrupted,,, I don't really think so. But there should be a way to make a new file instead of the old one...
makedev or something like that... *can't remember the command*

Makedev isn't intelligent enough to fake partition tables. Whatever goes on, it probably has to happen kernel-level - not in userland.

I will give UBCD a try. Thanks for all your help!

As i said.. I can't remember what it was we used that one time after our teacher wiped ur entire /dev/ folder...

There's disk-check programs on that one for most brands of disks..
Usually they gie you a great answer about the disk :)

Kroppus:

I see what you are saying. For people that didn't build an automounting /dev filesystem into their kernel, there is makedev. An example of makedev in action is the Knoppix hardware detection scripts. Makedev works by talking to the kernel and creating the appropriate device files.

My problem is that I need to create a device file for something that doesn't exist. The kernel doesn't see a partition table on /dev/hdb (the disk is damaged, remember?) so I want to create a fake partition (i.e. a partition table that resides on ramdisk) with a device file (/dev/hdb1) pointing to it. Only then can I get data off of the damaged hard drive.

i see the problem...
I've been searching through my books about RedHat and can't find the damned name of the command that we used...

What disk is it? Brand, sise, ID-number and so on?
Maybe someone has that dsk in their pc an can send you their /dev/hd? file?
It's worth a shot

Here is what's written on the disk:
The [??] represents two characters that were rubbed off of the disk label.

The first and only partition on the disk is a bootable NTFS partition.

I'm not really sure how anyone can send me /dev/hdb1, though. The device file points to the physical disk itself.

I was just thinking that if yougot the file for the disk then fsckheck or some other progs could use that "damaged" file to rebuild it...
I'm just throwing out ideas here :)
Anyway the UBCD has tools for Maxtor disks..
So at least you should get something from that one..
Or maybe they have some tools at their site too...
Be glad you don't have WesternDigital...
All their tools for disks demands that you eithe have a DOS partition on the dameged disk or at least the first partition on hd0 is a DOS partition.. Even from bootfloppies.. :(
That really sucks...