This one's for a friend of a friend of mine who posted the following to a group I'm a part of on Facebook, and he posted the following, since it is kind of Unix/Linux related, in a roundabout way, since it involves a Mac:

Regards failing Harddrives, there's one important rule - don't work too much with the original drive, but work on a copy of it. The way I deal with broken drives is:

1. use dd to make a binary equivalent copy of the original harddrive to a file on a good harddrive.
2. loop mount the file I just dd'd
3. do all the manipulations on the loop mounted copy.

1. DD

DD is a program to read a storage device sector by sector and to write the information onto another device / file. To dd a drive I would do something like:


Where <orig device node> is the specifier of the original storage device and /path/to/my/copy would be the file name of the binary equivalent copy on my known good storage device. For example, to copy the first partition of my first harddrive (/dev/sda1) to the file /home/user/dumps/myharddrive.img I would issue:

where /home/user/dumps is located on the known good hardware. This would read the first partition of the drive sda sector by sector and write the data to the file myharddrive.img

The resulting file myharddrive.img would contain the entire partition sda1. Note that the original partition has to be unmounted before doing the dd copy. dd will run a while - maybe an hour or so (depending on the size of the original partition). Once finished, I would disconnect the original bad drive so it won't incur further damage.

2. Once the bad drive is copied with dd we can loop mount the copy. I would create a directory first:

And then I'd loop mount the copied image in read only mode:

Now the entire partition will be accessible in /home/user/mymountpoint, i.e. I'd be able to read the files just as if I used the original bad harddrive.

Hope this helps! Sorry for any mistakes, I wrote this in a bit of a haste. Corrections welcome!

mv and cp are only some of the utils available. There's rename that's part of the perl package in debian (prename).

Make a dd copy and work your magic there. If you don't have the wiggle room for a copy and recovering the data isn't time sensitive, you might set the disk aside and ignore it until you have the wiggle room.

I guess it depends on what you mean by failing. Sometimes the drive is fine, but the filesystem got corrupted. You still want to minimize the modifications to the original until you have what you need from it. You can use the testdisk package and the photorec utility if the filesystem is really bad. But I'd still try to do that on a dd copy of the partition. Unless you trust the drive to "NOT" fail while extracting the data from it. And even then you might want to use a copy. The utility might improve later and recover more of the data if run against it again at a later date.

When it is a failing drive you better use ddrescue instead of dd to minimize stress on the disk and read as many sectors as possible.
Then work from that copy as described above.