LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices

Reply
 
Search this Thread
Old 08-19-2007, 02:26 AM   #1
brinstar
LQ Newbie
 
Registered: Feb 2007
Posts: 12

Rep: Reputation: 0
Laptop HDD messed up - can i recover the files somehow?


Please can someone help me, my laptop HDD has got messed up and if possible i would like to recover the files that were on there before i scrap it.

So far i have tried restoring it using System
Rescue CD 0.3.7, but i don't really have much experience using those tools. I did notice when i ran the sysresc cd that it does still appear as a disk, only the size is wrong, it show 120mb instead of 20gb, even though the laptop on which it was running no longer recognises that its there. Also in windows it doesn't even get recognised by *most* applications, so i can't really use that to fix. it did however get recognised by one program (stellar phoenix i think), but there were so many errors being flagged that i just gave up.

I have tried rebuilding the boot sector, and repairing the MFT in sysresccd, neither of which worked.

has anyone got any ideas on how to get the data back, which i all i really want? the drive is probably going directly in the bin after this incident.
 
Old 08-19-2007, 02:55 AM   #2
Electro
Guru
 
Registered: Jan 2002
Posts: 6,042

Rep: Reputation: Disabled
Connect a drive to the notebook computer either through USB or IEEE-1394 (aka Firewire or i.Link). Create a partition if is it new and format it with either XFS or JFS. Use dd, ddrescue or dd_rescue to create an image file of the drive. The reason why to create an image of the drive, so you can keep the source intact. You already did some recovery which may decrease the chances of getting the data back.

Use Testdisk and Photorec to try to fix and retrieve the files from the image file.

I suggest finding an recycling facility for electronics, so the materials that are used for the hard drive can be recycled instead of hurting Earth.
 
Old 08-19-2007, 03:34 AM   #3
brinstar
LQ Newbie
 
Registered: Feb 2007
Posts: 12

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by Electro View Post
Connect a drive to the notebook computer either through USB or IEEE-1394 (aka Firewire or i.Link). Create a partition if is it new and format it with either XFS or JFS. Use dd, ddrescue or dd_rescue to create an image file of the drive. The reason why to create an image of the drive, so you can keep the source intact. You already did some recovery which may decrease the chances of getting the data back.

Use Testdisk and Photorec to try to fix and retrieve the files from the image file.

I suggest finding an recycling facility for electronics, so the materials that are used for the hard drive can be recycled instead of hurting Earth.
just want to confirm that i understand your instructions correctly...

i boot up with System Rescue CD, attach my working USB drive, format that to a linux-compatible file system, use dd to backup the broken drive onto the working one, then use Testdisk and Photorec to recover the files?

would System Rescue CD be the best thing to use, or is there a better distro/livecd out there?
 
Old 08-19-2007, 08:02 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,260
Blog Entries: 54

Rep: Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841
my laptop HDD has got messed up
Can you elaborate on how it got messed up?


Quote:
Originally Posted by Electro
Create a partition if is it new and format it with either XFS or JFS.
I think that depends. If there's no need for compat then I'd choose ext2 since you don't need the journalling caps of ext3. IMHO choosing XFS or JFS makes only sense if you're doing more than a few sessions of file ops with hundreds of thousands of files. If you need to be able to also read the filesystem contents on another type of OS and if you are sure you have no files exceeding 2GiB filesize limit, then you could use VFAT instead. If you have files exceeding 2GiB in size and need compatibility then you could use ntfs-3g (if you're using a Live CD like HELIX).


Quote:
Originally Posted by Electro
Use dd, ddrescue or dd_rescue to create an image file of the drive.
I favour 'ddrescue', it's got more relevant options compared to 'dd' and it is faster than 'dd_rescue'.
(Also see http://www.forensicswiki.org/wiki/Categoryisk_imaging for more tools like ')


Use Testdisk and Photorec to try to fix and retrieve the files from the image file.
While you could write to the same drive the backup image is on better write to a separate HD to avoid overwriting anything and for performance reasons.


would System Rescue CD be the best thing to use, or is there a better distro/livecd out there?
Depends on the tools you need. Here's a list showing only forensic Live D's: http://www.livecdlist.com/?pick=All&showonly=forensics. You'll want one that has Photorec, foremost, retriever and maybe PyFLAG for last effort file carving.
 
Old 08-20-2007, 02:13 AM   #5
Electro
Guru
 
Registered: Jan 2002
Posts: 6,042

Rep: Reputation: Disabled
Quote:
I think that depends. If there's no need for compat then I'd choose ext2 since you don't need the journalling caps of ext3. IMHO choosing XFS or JFS makes only sense if you're doing more than a few sessions of file ops with hundreds of thousands of files. If you need to be able to also read the filesystem contents on another type of OS and if you are sure you have no files exceeding 2GiB filesize limit, then you could use VFAT instead. If you have files exceeding 2GiB in size and need compatibility then you could use ntfs-3g (if you're using a Live CD like HELIX).
I rather suggest people to use EXT3 instead of EXT2 because there is no lost of space from the journal. EXT3 and EXT2 has lousy performance when accessing files that are very large. JFS or XFS is the fastest when they access files that are several gigabytes. Though EXT2 and EXT3 does have file size limits for certain kernels, but not XFS and JFS.

The reason of making an image file is keep the source, the failed hard drive, intact.

The following to do data recovery on a failed medium.
1) Create an image file of the source.
2) Set aside the source.
3) Run data recovery programs on the image file.
4) Repeat step three (3) until almost all valuable data is recovered.

More elaborate data recovery is as follows.
1) Dismantle the medium or in this case the hard drive in a clean room
2) Separate and mark the platters
3) Inspect the platters for any debris.
4) If platters are clean, scan them with a laser.
5) The individual image files that make up the platters are put together into one very, very big image file that was done at step 4.
6) Data recovery programs scans the image file, but does not modify the image file.
7) When valuable data is found, it is then copied to a hard drive that works. Failed drive is thrown in the bin.

If you are worry about compatibility of the medium, format the destination hard drive only after doing the data recovery using FAT32. NTFS creates more problems than it is worth.
 
Old 08-20-2007, 02:55 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,260
Blog Entries: 54

Rep: Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841Reputation: 2841
JFS or XFS is the fastest when they access files that are several gigabytes.
So how much faster are you talking about? (Pointers to objective tests will do, if any)


Though EXT2 and EXT3 does have file size limits for certain kernels, but not XFS and JFS.
Since Large File Support, if there's a limit, it would be in the Terabytes, right?


More elaborate data recovery is as follows.
Isn't that somewhat cost-prohibitive for most people?


format the destination hard drive only after doing the data recovery using FAT32. NTFS creates more problems than it is worth.
While I almost always have to choose FAT32 for compat issues, apart from forcing a freshly NTFS-formatted drive to mount under GNU/Linux using ntfs-3g (dirty flag), I haven't encountered "more problems than it is worth".
 
Old 08-20-2007, 02:13 PM   #7
brinstar
LQ Newbie
 
Registered: Feb 2007
Posts: 12

Original Poster
Rep: Reputation: 0
finally solved this one and thank God, i got my files back.

what worked for me was to connect the drive while in Ubuntu 7.04. The drive got recognised (unlike in Winxp), and i quickly backed up the files before it changed its mind. I did have to try more than once, because when it started 'clicking', it wouldn't work any more, so i had to repeatedly disconnect and reconnect until i got everything i wanted. may seem a bit dumb, but it worked for me when nothing else would. I cannot recommend Ubuntu enough after this incident!

i couldn't salvage the actual drive in the end, it was too badly damaged and its now going to be recycled.
 
Old 08-20-2007, 06:37 PM   #8
Electro
Guru
 
Registered: Jan 2002
Posts: 6,042

Rep: Reputation: Disabled
Quote:
Originally Posted by unSpawn
So how much faster are you talking about? (Pointers to objective tests will do, if any)
XFS and JFS are about five times higher throughput than EXT2 or EXT3. On my computers that uses XFS for almost all partitions, it has a throughput about 25 megabytes per second to 35 megabytes per second with only one drive. EXT3 is meant to be used with small files.

I have copied an 8 GB file from one drive and then to another connected on different IDE controllers. I think it took a few minutes. EXT3 will take half an hour to an hour.

brinstar, that is good. Glad we can be of some service.
 
Old 08-21-2007, 01:02 AM   #9
brinstar
LQ Newbie
 
Registered: Feb 2007
Posts: 12

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by Electro View Post
XFS and JFS are about five times higher throughput than EXT2 or EXT3. On my computers that uses XFS for almost all partitions, it has a throughput about 25 megabytes per second to 35 megabytes per second with only one drive. EXT3 is meant to be used with small files.

I have copied an 8 GB file from one drive and then to another connected on different IDE controllers. I think it took a few minutes. EXT3 will take half an hour to an hour.

brinstar, that is good. Glad we can be of some service.
once more, thanks to all of you. on the issue of speed, i have noticed that xfs seems to be faster than the others, but i have had issues when connecting ntfs drives, but don't seem to have the problem when i use ext3. though when you are in my position and have important files that need recovering, speed is the least of your priorities
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Messed up an LVM - is there a way to recover? BrianK Linux - General 3 05-09-2007 06:45 PM
Softraid 5 messed up. Pls help to recover Ossah Linux - Server 5 04-05-2007 10:52 AM
recover data from formatted hdd sebastiano Linux - General 5 03-27-2006 08:40 AM
USB HDD majorly messed up! landfill Linux - Hardware 4 10-25-2005 09:42 PM
Trying to recover HDD space after new kernel compilation adriaanbw Linux - Software 7 10-11-2005 07:06 PM


All times are GMT -5. The time now is 11:10 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration