My portable external USB harddrive recently failed, and chkdsk didn't fix the problems. So i am resorting to using Linux to recover what files i can salvage.

It has been suggested that i use ddrescue to recover the files from the drive. There are certain distros of Linux made for data recovery, would it be wiser to use one of those instead of debian which i currently have? My drive is 500gb, so i am using a virtual machine with enough space to dump all the files from the failing drive, then i will reformat the drive, then dump the files back into it.

Here is the output from dmesg when i plug the usb drive in.

http://i.imgur.com/Efaa55O.png

Here is the popup i see when it is plugged in.

http://i.imgur.com/xpzFiOl.png

As you can see, things are looking pretty sketchy. I want to save as much as possible from the drive before i reformat it.

I haven't used ddrescue before and i wanna make sure i use it properly. The manual says to do something like:

ddrescue -f -n /dev/hda /dev/hdb logfile
ddrescue -d -f -r3 /dev/hda /dev/hdb logfile
fdisk /dev/hdb
e2fsck -v -f /dev/hdb1
e2fsck -v -f /dev/hdb2

How do i figure out the location of the drive when i plug it in? I assume it would be in /dev/ somewhere? Would those commands be sufficient to recover the data? Thanks for any help.

Right now it's saying you need to run "chkdsk /f" This command won't work from linux system but you should boot a wins system & run it.

The primary tools for data recovery are ddrescue, testdisk, and photorec. If you have those or can install them in your Debian system, you can use them from there.

When you plugged the drive in, the dmesg output showed that it was /dev/sdb with a single partition /dev/sdb1. If you would post the output from "smartctl -A /dev/sdb" that would give a better idea of the overall health of the drive.

ddrescue will attempt to make a sector by sector image of the failing drive, first copying all the sectors that can be read easily and then going back and making repeated efforts to copy the troublesome sectors. The process can take quite a long time. You will end up with an image that is free from I/O errors, but with all zeros filling any sectors that could not be read. You would use /dev/sdb1 as the source, and the destination would be a file or new partition elsewhere on your system. If the data is important, you should then treat that image as precious and make another, working copy elsewhere (on a new drive, or back on the old one if it is healthy enough) for your recovery efforts.

I'm not familiar with the current capabilities for checking/repairing an NTFS filesystem in Linux. It might be best to perform that step on a Windows system, and you would need to have that working image on a partition, not a file, in order to do that.

The need for using testdisk or photorec for file recovery would depend on how well chkdsk was able to repair the filesystem.

Here is the output. Doesn't look very good.

http://i.imgur.com/kJPQYuI.png

smarctl does not work over USB. I would suggest that you remove the disk from the enclosure and attach it to the internal power & sata. An external enclosure with eSATA will work too.

Before you do anything else (such as fsck) I would suggest you copy the image to a larger HDD.

Regards,
Stefan

Actually, SMART may work over USB, it depends on the enclosure. I once bought one that didn't and I took it back for one that did. However, if the disk is failing it may be wise to mount it internally because this produces faster transfer speeds and bypasses a possibly failing USB-SATA converter board.

1 members found this post helpful.

Unless I'm not understanding all the technicalities here I often use a live version of Linux to fix or recover files e.g: Puppy that lodes to RAM so you can remove DVDRW\USB\Etc for backups...

As others have pointed out, the USB<=>SATA bridge chip in some enclosures does not support the SMART commands. You will need to remove the drive from the enclosure and mount it internally or in an enclosure with a compatible interface. I would get rid of your current enclosure just because it does not allow you to check on the health of the drive.

What I don't understand is that your SystemDisk said please check me.
And you have not done so.
It's asking for a
Which would be done thru a wins system.

...

I tried, but it failed at the end.

A lot of you guys are suggesting that i mount the drive internally, i'm not sure that's in the realm of possibilities since i have a laptop.

There is no obvious way to get it out of its enclosure so i'd rather not remove the enclosure unless it's my last resort.

Then just use ddrescue to image the drive to another drive at least as large as it is.

Hiren's bootcd has mini winsxp you can run chkdsk from there.

Those enclosures can be pretty tricky to open if you haven't done it before. Without some way of checking the health of the drive, I wouldn't even consider reusing it. What is the make and model.? Does the manufacturer supply any diagnostics?

I figured out how to open it, everything looks physically healthy.

I am 90% sure that the problem stems from my roommate using it and unplugging it while it was reading/writing data.

I tried running chkdsk twice on it and both times it failed at the very end so i am worried that any more attempts will cause further problems. Most of the stuff on the drive was already backed up so i am not worried about it, it would be convenient to be able to salvage a few files before i reformat though.

The drive holds 500gb and i only had about half of it filled. I made a debian virtual machine with 550gb of harddrive space, can i just run ddrescue on the drive and have it copy all the stuff to my virtual machine, then reformat the drive and dump all the recovered files back into it? Or do i need to save an image of the portable HDD to the virtual machine then run ddrescue on the image?