LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
LinkBack Search this Thread
Old 05-28-2004, 10:25 PM   #1
kc8tbe
Member
 
Registered: Feb 2003
Location: Cleveland, Ohio (USA)
Distribution: Gentoo, Kubuntu 6.06
Posts: 179

Rep: Reputation: 30
recover data from physically damaged drive


I'm trying to salvage some data from a physically damaged drive. I know, I know... if I were serious I would spend lots of money to get the platters read; spare me the lecture, this is more for curiosity than anything else.

I was hoping to use something like dd_rescue to extract some data off of the drive. Unfortunately, the partition table on the drive is not readable and, of course, simply doing "dd_rescue /dev/hdb /some/file" won't work (has to be /dev/hdb1 or /dev/hdb2, etc.).

I know what the partition table ought to look like, but I don't know how to fool the kernel into thinking that it's there. Obviously, fdisk returns errors on startup (unable to read from device). If I could somehow create a device file for the partition I'm after (i.e. /dev/hdb1) then maybe a recovery effort could have a chance. Otherwise it's to the scrap heap with this hard drive. Ideas anyone?
 
Old 05-29-2004, 02:13 AM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 22,950
Blog Entries: 11

Rep: Reputation: 860Reputation: 860Reputation: 860Reputation: 860Reputation: 860Reputation: 860Reputation: 860
How do you know it's the surface and not circuit or motor?
 
Old 05-29-2004, 02:28 AM   #3
Kroppus
Member
 
Registered: Aug 2003
Location: Norway
Distribution: Debian UNSTABLE + latest 2.6.kernel
Posts: 391

Rep: Reputation: 30
If it's the circuitvoard under,,, You can take teh card from a same disk or something close to it..
Check that it's the same card...
I did that when my 100 gig was destroyed in the airport security....
got a WD 120 gig witht he same card and changed it with the damaegd one and OPPPS?All my mp3's was there and ready to copy.

If it's the disksurface you'd better tryt o look at some of the live-cd's that has to do with forenxic's
Should be something on some of them that let's you "recover" the data. Or at least try to

Good luck
 
Old 05-29-2004, 03:41 AM   #4
kinasz
Member
 
Registered: Mar 2004
Location: Brisbane, Australia
Distribution: FreeBSD, Suse
Posts: 103

Rep: Reputation: 15
is it possible to dd if=/dev/hdb of=drive.dd
and then try and search for partitions on the file with the partition table recovery HOWTO
 
Old 05-29-2004, 08:25 AM   #5
kc8tbe
Member
 
Registered: Feb 2003
Location: Cleveland, Ohio (USA)
Distribution: Gentoo, Kubuntu 6.06
Posts: 179

Original Poster
Rep: Reputation: 30
Kroppus & Tinkster:

There is no indication that this is a circuit board problem (no visible corrosion or damage, no smell of burning electolyte, no trouble recognizing data on the circuit board itself such as model number and vendor name). There is every indication that I am dealing with a crashed read head or possibly even physically damaged platters (the drive used to be readble but became gradually undreadable with continued use). Because the hard drive is no longer manufactured, I would have to spend about $200 to get a duplicate or wait a long time for it to show up on eBay. What indicates to you that this is a circuit board thing?

kinasz:

Uh-uh. /dev/hdb is a device file that points to /dev/null. I could let a program like dd try to copy it somewhere until my face turns blue and still wind up with an output file of size 0. That's why I need to, by hook or by crook, create a /dev/hdb1 to suck data off of.

Also, I've been in the partition table recovery howto. It details how to find out what partitions used to exist on the drive; I already know that. I need to create that partition on the drive, something that is proving difficult since "fdisk /dev/hdb" yields "Unable to read from drive!"
 
Old 05-29-2004, 09:08 AM   #6
Kroppus
Member
 
Registered: Aug 2003
Location: Norway
Distribution: Debian UNSTABLE + latest 2.6.kernel
Posts: 391

Rep: Reputation: 30
I know what you men abut buying a new disk... I had to do tha, 'cause i needed a new disk anyway.. Actually it took me over a year from the disk was destroyed in the "safe scanning" area until i found one that i could use. Don't belive what they say in airports about the scanner is safe for computer equipment. I've had 4 hardisks + one Creative Nomad beeing destroyed by that..
"We're not sure what it is so we run it through another time, and one more time..."
*is an islamic terrorist, disguised as a black-metal guy*

One sure indicator to that it's the circuitboard is that the disk comes up with the right name but it doesn't show the right size. Another one is that it's fully working in BIOS but not when you try to acess it..
maybe you should search for "The Ultimate Boot CD" it's a great cd.. Not a huge file either.. But it got a lot of tools for testing disks and so on...

It can jsut be that it's the /dev/hdb file that is corrupted,,, I don't really think so. But there should be a way to make a new file instead of the old one...
makedev or something like that... *can't remember the command*
 
Old 05-29-2004, 09:49 AM   #7
kc8tbe
Member
 
Registered: Feb 2003
Location: Cleveland, Ohio (USA)
Distribution: Gentoo, Kubuntu 6.06
Posts: 179

Original Poster
Rep: Reputation: 30
Makedev isn't intelligent enough to fake partition tables. Whatever goes on, it probably has to happen kernel-level - not in userland.

I will give UBCD a try. Thanks for all your help!
 
Old 05-29-2004, 10:51 AM   #8
Kroppus
Member
 
Registered: Aug 2003
Location: Norway
Distribution: Debian UNSTABLE + latest 2.6.kernel
Posts: 391

Rep: Reputation: 30
As i said.. I can't remember what it was we used that one time after our teacher wiped ur entire /dev/ folder...

There's disk-check programs on that one for most brands of disks..
Usually they gie you a great answer about the disk
 
Old 05-29-2004, 11:00 AM   #9
kc8tbe
Member
 
Registered: Feb 2003
Location: Cleveland, Ohio (USA)
Distribution: Gentoo, Kubuntu 6.06
Posts: 179

Original Poster
Rep: Reputation: 30
Kroppus:

I see what you are saying. For people that didn't build an automounting /dev filesystem into their kernel, there is makedev. An example of makedev in action is the Knoppix hardware detection scripts. Makedev works by talking to the kernel and creating the appropriate device files.

My problem is that I need to create a device file for something that doesn't exist. The kernel doesn't see a partition table on /dev/hdb (the disk is damaged, remember?) so I want to create a fake partition (i.e. a partition table that resides on ramdisk) with a device file (/dev/hdb1) pointing to it. Only then can I get data off of the damaged hard drive.
 
Old 05-29-2004, 11:50 AM   #10
Kroppus
Member
 
Registered: Aug 2003
Location: Norway
Distribution: Debian UNSTABLE + latest 2.6.kernel
Posts: 391

Rep: Reputation: 30
i see the problem...
I've been searching through my books about RedHat and can't find the damned name of the command that we used...

What disk is it? Brand, sise, ID-number and so on?
Maybe someone has that dsk in their pc an can send you their /dev/hd? file?
It's worth a shot
 
Old 05-29-2004, 12:01 PM   #11
kc8tbe
Member
 
Registered: Feb 2003
Location: Cleveland, Ohio (USA)
Distribution: Gentoo, Kubuntu 6.06
Posts: 179

Original Poster
Rep: Reputation: 30
Here is what's written on the disk:
Code:
40.0 GB AT Maxtor D540X-4K
[bar code]
Maxtor GLTA: LE04011-01-B
[bar code]
Maxtor P/N MX4K040H2
[bar code]
P/N t SG-012341-12547-1BU-291T       [bar code]
[bar code]                                             Rev: A00
CT: 246B5502QMNZJ6     P/N: 327400-001
[bar code]
P/N 3: 11S06P5330ZJ1H9X3[??]T5H     FRU: 1961562
The [??] represents two characters that were rubbed off of the disk label.

The first and only partition on the disk is a bootable NTFS partition.

I'm not really sure how anyone can send me /dev/hdb1, though. The device file points to the physical disk itself.
 
Old 05-29-2004, 01:58 PM   #12
Kroppus
Member
 
Registered: Aug 2003
Location: Norway
Distribution: Debian UNSTABLE + latest 2.6.kernel
Posts: 391

Rep: Reputation: 30
I was just thinking that if yougot the file for the disk then fsckheck or some other progs could use that "damaged" file to rebuild it...
I'm just throwing out ideas here
Anyway the UBCD has tools for Maxtor disks..
So at least you should get something from that one..
Or maybe they have some tools at their site too...
Be glad you don't have WesternDigital...
All their tools for disks demands that you eithe have a DOS partition on the dameged disk or at least the first partition on hd0 is a DOS partition.. Even from bootfloppies..
That really sucks...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Software to acess and recover data on Fat32 data NeoSpawn Linux - Software 2 09-04-2005 11:37 AM
Recovering data from damaged CD corn Linux - Hardware 4 09-23-2004 12:32 AM
trying to recover a notebook with a damaged keyboard clau_bolson Linux - General 4 04-10-2004 12:39 AM
Using Linux to recover data on a damaged Windows partition? Korff Linux - General 5 12-29-2003 11:35 AM
RH 7.3 Install damaged 2nd drive,, can I recover??? dmkelly Linux - General 3 08-02-2002 02:04 PM


All times are GMT -5. The time now is 07:02 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration