recovering a potentially fried hard disk?

zero79 · 08-06-2006, 10:51 PM

hello,

my friend's computer likely suffered a lightning strike (his computer was fine, there was a storm, the computer no longer boots), and i am trying to recover the data on his hard disk. the disk is now hooked up in my box on IDE1 master and is enumerated as /dev/hdc.

none of the disk utilities that i am familiar with are being helpful. for example:

Code:

# sfdisk -V /dev/hdc
read: Input/output error

sfdisk: read error on /dev/hdc - cannot read sector 0
 /dev/hdc: unrecognized partition table type

sfdisk: no partition table present.

# fdisk /dev/hdc

Unable to read /dev/hdc

however, i can coerce some information (global drive info) out

Code:

# sfdisk -s /dev/hdc
29316672

# sfdisk -l /dev/hdc

Disk /dev/hdc: 58168 cylinders, 16 heads, 63 sectors/track
read: Input/output error

sfdisk: read error on /dev/hdc - cannot read sector 0
 /dev/hdc: unrecognized partition table type
No partitions found

and finally, this is what i see via dmesg

Code:

# dmesg
.
.
.
hdc: task_in_intr: status=0x59 { DriveReady SeekComplete DataRequest Error }
hdc: task_in_intr: error=0x10 { SectorIdNotFound }, LBAsect=0, sector=0
hdc: task_in_intr: status=0x59 { DriveReady SeekComplete DataRequest Error }
hdc: task_in_intr: error=0x10 { SectorIdNotFound }, LBAsect=0, sector=0
hdc: task_in_intr: status=0x59 { DriveReady SeekComplete DataRequest Error }
hdc: task_in_intr: error=0x10 { SectorIdNotFound }, LBAsect=0, sector=0
hdc: task_in_intr: status=0x59 { DriveReady SeekComplete DataRequest Error }
hdc: task_in_intr: error=0x10 { SectorIdNotFound }, LBAsect=0, sector=0
ide1: reset: success
hdc: task_in_intr: status=0x59 { DriveReady SeekComplete DataRequest Error }
hdc: task_in_intr: error=0x10 { SectorIdNotFound }, LBAsect=0, sector=0
end_request: I/O error, dev hdc, sector 0
Buffer I/O error on device hdc, logical block 0

i've tried using both LBA and Large mode in the BIOS as well as the "noapic" kernel option, but have made no progress.

does anyone have any suggestions on what else i might try to breath life into this half-dead disk? thank you so much for any assistance.

mike

runnerfrog · 08-06-2006, 11:20 PM

Quote:

i am trying to recover the data on his hard disk.

Well, as you must know, forensic recovery is no laughing matter unless you laugh at engineers work or at something very boring, sort of same thing at last :-p
Here in Helix site: http://www.e-fense.com/helix/ you have forums, links to docs you _have_ to read, and a CD containing GPL and freeware to forensics and incident response tasks.
You need: good luck.

Matir · 08-07-2006, 12:26 AM

The big question is: is there noise? If there's noise, the head's likely fubared and the data is toast. If it sounds like a 'normal drive' (no scratching, clicking, etc.) the drive controller could be dead, which is the better of the two. It would require finding an IDENTICAL (model number identical) hard drive and swapping the controller boards. Most just plug right in and are held down by a few torx screws.

zero79 · 08-07-2006, 10:55 PM

thanks for the thoughts. i'm not hearing bad noises. it sounds like the disk is spinning up normally actually. so each hard drive controller is specific to that hard drive model? so there's no way to just go out and get a replacement controller by itself?

i was hoping for something like fsck that operates on entire disks rather than just partitions (or the likes of scandisk from the good ol' days of win9x). is there anything like that? any other links to useful tools?

i'm not going to spend too much time on this, nor spend much money. so i'm really only looking for software suggestions.

thanks again.

mike

Matir · 08-07-2006, 11:33 PM

Quote:

Originally Posted by zero79

i was hoping for something like fsck that operates on entire disks rather than just partitions (or the likes of scandisk from the good ol' days of win9x). is there anything like that? any other links to useful tools?

Even scandisk operated only on a single partition. But that aside, if the partition table is all that is fubar, you could try 'testdisk'.

Electro · 08-08-2006, 01:09 AM

I suggest either using reverse dd to try to make an image of the drive or use gparted to guess where the partitions starts and ends. At the last resort use the hard drive manufacture's utility to repair the sectors. My hard drive recently (about a week ago) had problems like this but the first sector was not damaged. I just ran the hard drive utility from the manufacture to check and repair the sectors. Some files got corrupted and others were badly damage that they vanished. The files that vanished were not valuable, so I did not care.

Matir, nobody has a clean room and the patience to open up a hard drive to replace the heads. Most people will just faint if they attempt to do this. The heads will likely to hit the platters when removing and putting new headss in.

Note to everybody:
Back up, back up, back up your data. Plan backing up the data every week or every month. Use Norton Ghost for Windows and dar for Linux. Also Ghost for Linux can be replacement for Norton Ghost that can be use for both Windows and Linux.

jschiwal · 08-08-2006, 01:35 AM

You could try to copy an image of the drive using dd_rescue.