data recovery using linux boot disks?
 

Hey everyone,

I have a western digital 250Gb hard drive that has failed badly. It has windows xp on it, I dont know if its FAT or NTFS but I have been asked to recover some files from it. none of the usual data recovery techniques are working. Cant boot to it, cant access it as a slave drive, cant get it to pass any western digital data lifeguard utilities, the motor does spin so I am still hopeful. I see that there is a possible solution using a thin version of xp on a cd called Barts PE that might be able to see the drive and grab the data but I would rather use a linux solution if possible.
Is there a linux Cd that is bootable that can see disks on the IDE controller and recover the data even though it is on a windows file system?
I could even go for a byte-level recovery solution if it would suite my needs.

Does anybody know of any good linux solutions for this delima?

-vbsaltydog

try using back track. It supports ntfs and fat filesystems and it will automatically mount any partitions that it detects at start up. If you cant get to it with this bart pe wont work. I have used it before and found that it only really helps if your problem is a sluggish windows system and you need to clean it up. It will see the same stuff windows does. I have not explored backtrack that much but it has a bunch of utilities that might help you with a bit by bit solution.
you could also look at System Rescue CD. It has similar features. When i go and make pc repairs i usually bring both. Sometimes one will work and the other wont.

If anything else fails, you can take it to a professional data recovery company; however, that will more than likely come at a cost.

Thanks for the suggestions everybody. I built BartPE with getdataback and ran it on the HD in question. I got a ton of 23 and 25 error codes. When I called the getdataback people they said it was physical damage on the disk if those codes are the output and the only way to recover the disk is to see about resurfacing which is not a viable option so its junk.

Thank to everyone for helping,

-vbsaltydog

Assuming you're trying to recover everything you can off the failing disk, I would try a Linux LiveCD with dd_rescue and dd_rhelp. Of course with this method you'll need something equally as large as the failing disk to store the recovered data on (another harddisk or a networked disk somewhere else).

If you use Linux I'm sure you're familiar with the dd command. Can be used to copy a disk to another, sector by sector. When dd detects an error it usually stops. That's where dd_rescue comes in. I will continue trying to copy after encountering errors. But it still slows down and retries problem areas. Sometimes taking forever as it retries and retries.

And this is where dd_rhelp steps in. dd_rhelp wraps around dd_rescue. When an error is encountered, dd_rhelp jumps forward figuring its not an isolated error, but rather a "clump" of errors. It is trying to jump over bad areas. I believe it jumps forward hoping to find a good area, then works backwards until it runs into that bad area again. It then flags that as a "come back later" area and continues on. Recovering the easy and good stuff first, then coming back later to go after the tough or impossible stuff. This is a good thing if your disk is failing, and getting worse. Don't waste what precious time you have trying to recover the lost cause areas. Come back to them later ... if your disk is still spinning by then.

I believe dd_rescue comes on Knoppix LiveCD. May not be the most current version however. If you can boot Knoppix on this dieing computer, you've got everything you need to do the downloads/installs. You can maybe apt-get the newest version of dd_rescue, but you might have to manually download it from the site listed below. I don't know if dd_rhelp will be found in any of the default Knoppix repositories. Probably a manual download of that one will be required. See link below.

dd_rescue: http://www.garloff.de/kurt/linux/ddrescue/

dd_rhelp: http://www.kalysto.org/utilities/dd_rhelp/index.en.html

After you've recovered the data off of the bad disk, you will probably have to run Window's chkdsk on the recovered data. Or maybe a Linux fsck (there's probably an fsck variant for VFAT, I don't know about for NTFS.)

p.s. - I have never been unlucky enough to actually need these tools for myself, so I have no practical experience with either of them. but I did some research on them a while back, and they look quite handy.

Thank you for the informative post.
If it is pulling from a 250Gb drive but is only able to read/recover 50Gb then would a 100Gb target drive work or would dd still need space to write the sectors that it cant read?

Thanks again,

-vbsaltydog

It would need the full space. The dd-type commands know nothing about files and directories. They are doing raw sector-by-sector copies. They don't know if any given sector they are copying is part of some file, or a piece of freespace.

I didn't consider that you might have your failing disk partitioned into smaller chunks. You could use dd/dd_rescue/dd_rhelp on one partition at a time, so your output device would only have to be big enough to hold that particular partition you are recovering. But if your 250Gb drive is just one huge partition, you'll need that same amount of target space to recover it to.

It sounds like you're doing this recovery for somebody else. Just tell them they need to buy you a new 250Gb or 300Gb drive to work with. You specify the brand/model, and tell them you get to keep the drive after the recovery - whether your efforts succeed or fail. Give them their recovered files on a CD-R. Then dutifully explain to them the necessity of backups, and why one big 'ol honkin' partition is not always the best choice. Not for backups ... not for recovery-after-failure.

A new drive solves your space problems, and you get something out of it for your efforts! Of course the computer owner then has to go buy ANOTHER drive to copy the recovered files on that CD-R to, but live and learn ;)

See this post http://www.linuxquestions.org/questi...d.php?t=366442 for some really good info on how to use the dd command.

It is a disater recovery service for a client. The partition being recovered is 120Gb. Thanks for the advice.
So I need to build knoppix with the newest version of dd? or just download and burn knoppix to CD/DVD ?

I guess if this is a client, you shouldn't go asking for a new harddisk for your computer! :eek:

---

The version of the "dd" command doesn't matter. You don't need to rebuild Knoppix. Just boot it, then install an additional program from there. It's simple. The new program doesn't install to a harddisk - just into ram.

The newest Knoppix, version 4.02, contains dd_rescue, version 1.11-1, which is the newest version available.

You will need to download and install dd_rhelp manually. I just checked and it's not present on Knoppix 4.02. The procedure should be simple. Fire up a web browser from a Knoppix boot. Download dd_rhelp from http://www.kalysto.org/utilities/dd_rhelp/index.en.html Right now, it looks like the newest version is dd_rhelp-0.0.6.tar.gz Put this downloaded file somewhere, then run something like the following from a terminal window:
Then you should be ready to go. Run "dd_rhelp --help" for a help message on program usage. There is also a FAQ on the dd_rhelp website. Having never actually used the program, I can't tell you what happens after this.

Greatly appreciated. I will try it and post my results.

OK. I am ready to use DD from knoppix to recover partitions from one hard drive to another but I have a problem. Knoppix can mount the target drive but it cannot mount the source drive. If I cannot mount the source drive can I use DD to copy data from it?

Thanks to all,

-vbsaltydog

You don't mount it. You're doing a raw disk copy with dd. So you reference the raw device. Although you can dd a mounted drive, it's preferable NOT TO!

Example:

Say your SOURCE drive is hda and you DESTINATION drive is hdb:
WARNING! Do NOT mix up the "if" and "of" parameters!!! "if" means "INPUT file" (or INPUT drive in your case) and "of" means OUTPUT file (drive).

Search these forums for a post titled "Learn the DD command". It's excellent, and should be required reading.

I am attempting to follow your advise but yet another hurdle must be crossed. I am setting the target as a partition on another drive (data recovery purposes) and have to resize the target drives partitions before the move using dd. I have tried to resize the target drive's partitions using qtpart and it fails so I tried from the cli using ntfsresize but get the same error. Error (95) when opening /dev/hda1 as NTFS Operation not supported. Apparently the NTFS journal is unclean.

Any ideas?