Bad NTFS or FAT32 drive, badblocks and fsck to the rescue?

anon091 · 06-30-2017, 12:03 PM

Have a bad hard drive, was used on a Windows machine so probably NTFS or maybe FAT32. I think it may have been throwing CRC errors previously. Is there any combination of badblocks, fsck, or anything else I could use to try to rescue the data on there?

Right now on sdc, it easily mounts and shows data on 2 of the 3 partitions, and of course the third partition is the one with the data this person needs. blkid doesn't even show the partition either I don't believe, so it must be in real bad shape.

hydrurga · 06-30-2017, 12:08 PM

Before you attempt any data recovery, I would suggest that you first clone the disk so that you can revert to it if any of the data recovery attempts cause more damage.

anon091 · 06-30-2017, 12:09 PM

Should I just use dd or something to do the entire sdc? if that one partition is really hosed will it even back that up?

hydrurga · 06-30-2017, 12:25 PM

dd doesn't care about partitions - https://wiki.archlinux.org/index.php/disk_cloning - but you could also consider using gddrescue which "copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors." - https://datarecovery.com/rd/how-to-c...with-ddrescue/ (ignore the marketing).

anon091 · 06-30-2017, 12:39 PM

gddrescue sound intriguing, I might give that a shot, thanks.

hydrurga · 06-30-2017, 01:03 PM

Quote:

Originally Posted by rjo98

gddrescue sound intriguing, I might give that a shot, thanks.

Please let us know how you get on. And of course, come back to the thread once you're ready to launch into data recovery proper.

anon091 · 06-30-2017, 01:15 PM

haha, will do. just downloaded and installed the deb for gddrescue, trying to figure out how to actually use it now

anon091 · 06-30-2017, 02:07 PM

ddrescue has begun. i couldn't find a gddrescue command anywhere, so i'm must be missing something or misunderstanding even though it installed right. but i'll see where this gets me and post back when it finishes, or if it ever does

hydrurga · 06-30-2017, 02:26 PM

It's useful to remember that a package name is not necessarily reflected in the name(s) of the command(s) provided by that package. In this case, the package is gddrescue but the principal command supplied is ddrescue.

Just to muddy the waters (purely for info - skip this bit if you don't want to get confused), there are actually two parallel but separately-developed packages - dd_rescue and GNU ddrescue (gddrescue) - see https://askubuntu.com/questions/2115...-and-dd-rescue

Perhaps you could go and watch some flowers grow while the cloning is taking place.

anon091 · 06-30-2017, 02:40 PM

Yeah, i guess I assumed gddrescue would give a gui or something extra on top of ddrescue, but looks like it just installed that. ah well.

At the rate it's going, I could plant a tree and watch it grow to be taller than me before this will finish

anon091 · 07-05-2017, 01:08 PM

to give an update, ddrescue is now on the "splitting failed blocks" phase. of the 500GB drive it says it rescued about 499.5GB with about half a GB of errors. It's going on 16 hours since time of last successful read though. I guess I can keep letting it run, but what should my next steps be once it finishes?

hydrurga · 07-05-2017, 01:21 PM

Quote:

Originally Posted by rjo98

to give an update, ddrescue is now on the "splitting failed blocks" phase. of the 500GB drive it says it rescued about 499.5GB with about half a GB of errors. It's going on 16 hours since time of last successful read though. I guess I can keep letting it run, but what should my next steps be once it finishes?

I would say back up the recovered data to another device asap. Then check the data to determine what has actually been recovered, randomly checking that files are valid by opening them. If you feel that there are any missing files which are absolutely crucial then you can try other recovery procedures on the original disk but you may not be successful. After you've gone as far as you can go, throw the old hard disk away and take some photos of the tree you planted in a previous post.

anon091 · 07-05-2017, 01:23 PM

thanks for all the help with this.

sundialsvcs · 07-05-2017, 02:22 PM

The first thing that I would do with any modern device is to check the SMART logs. This is firmware on-board the device itself which is constantly watching for problems, and which can perform various operations such as swapping-out bad sectors (invisibly to the host).

anon091 · 07-05-2017, 03:44 PM

thanks