Urgent: Failing NTFS HD - Will ddrescue Read & Write To Windows NTFS Drives?
 

System: Windows XP

One of my hard drives is failing. I would like to get some data off it. I backup regularly, but am missing about 1.5 weeks worth of data. Sometimes the drive clicks and fails to operate, and if it does operate, it has a few errors here and there.

My failing drive runs Windows XP with a NTFS format. I would like to image the failing drive using ddrescue (I've read that works good) to another NTFS hard drive with more than enough space on it to hold data from the failing HD.

I don't even know if this is possible or how to go about this.

* Can ddrescue read from Windows NTFS and write to a NTFS hard drive?

* What do I need to download so I can boot ddrescue from floppy or CD-ROM so I can image one drive to another (perhaps a partition on another)?

* Do I need to download a Linux boot disk or something with ddrescue on it?

* Are there any free or open source Windows programs that do what ddrescue does? This data is important to me, but not important enough to spend a fortune on. It represents about 40 or more hours of work.

I really have no idea what I'm doing so I'm here hoping for some advice.

As a note, I can only get the failing drive to operate if it is set on the primary IDE ribbon and in the first position.

Any assistance will greatly be appreciated, more than you could imagine.

Thank you,

zipgunner (a total Linux newbie)

SystemRescue CD sounds like what you need:

http://www.sysresccd.org/Main_Page

"Can ddrescue read from Windows NTFS and write to a NTFS hard drive?"

With the NTFS driver in the latest kernel, yes, but I haven't presonally put it to the test yet. However, given the HUGE file that will be produced by the ddrescue dump, make sure it's an NTFS version that supports humongous files and that the Linux NTFS driver can in fact support such large files. At any rate, you have absolutely no problem reading with 'ddrescue' because the program isn't even aware of filesystems - it will simply copy all the (raw) data it can.


"* What do I need to download so I can boot ddrescue from floppy or CD-ROM so I can image one drive to another (perhaps a partition on another)?

* Do I need to download a Linux boot disk or something with ddrescue on it?"

I'd recommend booting from a CD. But for now, completely disconnect your bad HD until you've convinced yourself that the rest of the system is set up to do what you want. If you have yet another HD to play with, I would recommend using it as a dummy in place of the faulty HD just to make sure that it is never mounted.

I have no idea which Live CDs have ddrescue on them. Maybe google can help you locate one.


"* Are there any free or open source Windows programs that do what ddrescue does?"

I have no idea; I find WinDuhs totally uninteresting, absolutely useless, and incredulously deficient in good tools. If you can find a LiveCD which can do the job for you, then do that. WinDuhs tries to do too much behind your back anyway - you will probably find that the computer attempts to mount the defective HD as read/write and totally trashes the already faulty disk. You need a "stupid" system which won't mount an HD unless you specifically request it to. Like I said before, you don't even need to mount the HD to use ddrescue - and in fact you should not attempt to mount it at all.

SystemRescue CD has ddrescue, ntfs-3g, and ntfsprogs - so it should be able to accomplish whatever's needed. I've never needed to use it myself, so I'm only guessing.

Thanks for the tip. I'll check that out. I don't know if this will try to reread damaged sectors like ddrescue will.

I do not see ddrescue listed anywhere on the webpage you provided in the System Tools Included section, though you mention that it is included.

http://www.sysresccd.org/Main_Page

I have another question. My original intent was to image the failing drive to a partition on another drive instead of a single massive 38GB data file so I could then boot up windows and access the files that I need (which is about 25 GB of the total amount of data).

If I create a single image file with a Linux program, is there anyway to extract individual files from that image using a program in Windows?

Otherwise I imagine that I'll need a fresh drive or a fresh partition so I can extract the image onto it.

Thanks for your help and the suggestion from pinniped.

It's mentioned on this page, showing all packages included on the CD:

http://www.sysresccd.org/Detailed-packages-list

I've never had any experience of rescuing data, partitions, or anything. So I can't really help, but I'm sure similar problems and questions have cropped up on these forums before, try the Search button at the top of the page. Good Luck.

I tried searching before I posted this thread. There were others who had issues with failing drives and questions about ddrescue, but I didn't find any posts in my particular situation. Most of the ones I found with failing Windows drives were using Linux and were going to image to use with Linux. I'm looking to image and use on Windows.

They have a forum over at sysresccd.org. I'll ask more questions over there.

Thanks for your help and thank you for pointing me to SystemRescue CD, brianL. I really appreciate it. :)

What you want is possibly a free/open source equivalent of Norton Ghost, for Windows. Google for that, I'm sure I've seen something, but can't remember the name.

Is your HD clicking? In my days working as tech support, I've seen this many a time.
Try this at your own risk - it's worked before for me:

First put your HD in the fridge - yes, stick it in your refridgerator. If it's clicking that often means the drive head and/or a bearing is out of whack. The temperature difference will help to pop things back into place allowing you to use the drive for a while.

While the drive is in the fridge, download and burn a copy of KNOPPIX. You need this, or at least some boot CD (or to another HD), because you need to use the HDD as little as possible - the more usage it gets, the sooner it heats up and fails again, and if you don't boot from it then the only usage it gets is from you copying the data.

It seems like usually about 30 minutes is enough, but longer won't hurt. Before you pop the drive in again, allow some time for condensation to evaporate or you may damage the drive further (or another component). You want the drive to be nice and cold, but you want the condensation off of the plate and other drive components - DON'T touch the plate, though, if you can see it.

Hook the drive back up (preferably using an external case, but pop it back in your PC if you don't have one). Then hook up your external drive or whatever you will be copying your data to. Turn the PC on and boot to KNOPPIX, and start copying.

Now, I myself like to do a bit-by-bit copy of the partition using "dd if=/dev/sdb1 of=/media/sdc1/backup" or something of the sort - this way you don't get the errors which I guarantee you will see by doing a direct file copy (remember, each of these errors just stalls the computer, using up time and making your drive more likely to fail again before you finish). Then you can mount the newly-created file as a loopback filesystem to copy individual files and folders at your leisure once all the stuff's been pulled from your old HD. If you don't want to do this, or don't have the drivespace, then go ahead and drag-and-drop the files to a new folder, but be warned - I can almost guarantee that you'll get many copy errors. Also, to save time, you might want to decide not to copy the "System Volume Information" folder - you shouldn't need it, and when you make the partition on your replacement drive it'll pop up again.

Hope that helps!

If you still haven't done anything, I've just found this:

http://sourceforge.net/projects/freeghost/

There's a misconception here.

dd (and by extension ddrescue) can write or read no matter what fs are you talking about, because they don't read at fs level, they read raw block devices (like partitions). Being that said, I don't think that dd (and specially, ddrescue) are the best thing for this task.

You should be picking as much files are you can instead, because:

1. if you save a filesystem, ddrescue will skip errors, this means a corrupted fs, even if you dump it into a clean disk
2. if you save a filesystem, all the filesystem needs to have consistency, if you save files, even if some of them are broken, the rest will be ok.
3. if you save the whole fs, you will be stressing your hd unnecessarily because you will read it entirely, instead of reading only the needed bits
4. in addition, you will need less space if you use regular cp
5. note that ddrescue will not do any black magic, it just skips where dd would abort, so, you will lose the same amount of data

dd is recommended when the fs fails, but the disk is ok. Then you can make a backup to play with. But if the disk is failing, dd is just a way to break it even more.

I disagree. The system will stop copying on file copy errors. If you're copying all the files from a Windows partition, I guarantee you will get errors. This only eats into your time, and it means you have to try copying all over again (after you go find that one particular file and delete it or deselect it) and will most likely encounter such errors multiple times.

If you use dd to copy the whole disk/partition, you'll have a copy of it exactly as-is and will have no further need to worry about whether or not you got the files you need, etc. as you will have a copy of the partition (and therefore all its files) which is as perfect as you'll be able to get, and which you can use to pick and choose which files you need (rather than making a spur-of-the-moment "this folder doesn't want to copy so should I just leave it behind and lose all those files" type decision you may regret). You're right that the filesystem needs to be consistent, but if you make a direct copy of it then it will be exactly as consistent as it was when it was first read (as in, the copy won't be inconsistent unless the FS you're copying is inconsistent). The system treats this file as another partition, so it'll be just like copying files from your old drive, without the drive thrashing and grinding.

I guess it depends on how important this stuff is. I'd recommend copying the full partition, like I said - assuming you have the space. If you don't, I suppose you don't have that option.

If you don't like that idea. . . hey, all I'm saying is it's worked for me in the past, and I think it's better to guarantee that you've got all the files (by just copying the entire partition) than to be forced to make a rash decision about what files to copy. But hey, it's your choice.

Exactly. The poster to which you reply meant well, but he is misguided on this issue. I have thousands of files to retrieve. Reading the disk from back to front won't cause the arm to thrash around all over the disk like reading individual files will because they are not sequentially stored.

I have the space. I really still haven't figured out how exactly I'm going to do this.

I think you've got the right solution. No argument there.

Now I got to decide on which tool to use then figure out how to use that tool.

I appreciate the input from you people. :)

You ought to be able to use the "dd" command.
For example if the partition in question is at /dev/sda1 and you're in KNOPPIX trying to get it copied to a file on a partition mounted at /media/sdb1:
If you want to copy the whole drive:
Now it's been a while since I've had to do it - but I believe that's all you will need to do.
!MAKE SURE! you DON'T mix around "if" and "of" - "if" indicates the file/device you're copying from; "of" indicates the file/device you're copying to - mixing them around will overwrite it!

That was supposed to work in ye ancient times but in my experience it doesn't work on modern drives. At least for me it didn't. Don't get your hopes up is all I'm saying.


IMHO Click of Death symptoms should be handled with a wee bit more urgency than that (just imagine it's the last time you'll be able to read the drive). I'd opt for a more robust tool like dd_rescue, ddrescue, dcfldd or rdd-copy instead of using "dd" which doesn't allow for read retry (all), reverse direction copying or resuming operations (dd_rescue), hashing, verification or native file splitting (dcfldd, rdd-copy), native client-server and compression support (rdd-copy). Granted, tools like dcfldd, rdd-copy or linen won't do much for the OP here but it's good to illustrate there's more tools with different features than ddrescue. You just got to know them.

Wrt mixing up "if" and "of" that's a good point and sadly we've seen that here before. Would be a good thing to practice a bit.

OK I have brought this thread back from the dead.....and hopefully I can do the same to my HDD ;)

IIt crashed yesterday and I have been dreading not being able to save any data. I have done heaps of research, hence my arrival here, and I am up to the stage of running ddrescue. First off though I just want to ask a few questions to make sure I have got it right.

The situation. My laptop hdd died, bad sectors after diagnosis tests. I did have a spare 2.5 inch external drive so I pulled it out of the casing and put it into my laptop. I have done a fresh install and am now at least back on line. I put the dead hdd into the casing so I could use it via the usb adapter. I have got knoppix 6 on a cd and have bootedit up for a sticky beak. I logged into the ltxterminal as a root user. got another external hdd that i want to copy to. So I have 2 external hdd now, the dead one, and the one i want to copy to.

This is where I am getting a bit nervous because I have read a lot in 24 hrs about the best ways to do the next step.

Some say put the -r command in to make the drive read backwards, some say just get good sectors first then try for the bad ones as well. I am kinda lost now.

I am expecting to boot knoppix, plug both hdd in and then in the ltxterminal enter a commands as suggested at (http://www.forensicswiki.org/wiki/Ddrescue) like:

First you copy as much data as possible, without retrying or splitting sectors:
ddrescue --no-split /dev/hda1 imagefile logfile
Now let it retry previous errors 3 times, using uncached reads:
ddrescue --direct --max-retries=3 /dev/hda1 imagefile logfile
If that fails you can try again but retrimmed, so it tries to reread full sectors:
ddrescue --direct --retrim --max-retries=3 /dev/hda1 imagefile logfile

except I was thinking of also putting in the path to the good ext hdd to copy to straight away.

I guess I am seeking some clarity on this process and the correct syntax I should be using.

Many thanks to any that can help..My head hurts.

Thanks.