dd command, can that help recovering data?
I have foulty hard drive partition which would not mount
so browsing internet I found out that it is posible to use Terminal I'm using mac, so hard is 1tb devided in 2 partitions 1st mac extended, 2nd FAT32 2nd would not mount, when try connect hard to windows pc it freezes everything so decided to use Knoppix from CD using that OS I can see both partition but the faulty one is very slow takes up to 5min to open every folder so tried to connect other hard and copy paste folders but I can not create ot paste anything on new connected hard there is always Access Denied or Permition Denied found post on forume where someone used dd command and I tried that, data goes from sdc2 to sdc1 that's what's happend: knoppix@Microknoppix:~$ dd if=/dev/sdc2 of=/dev/sdc1 bs=4096 conv=notrunc,noerror dd: reading `/dev/sdc2': Input/output error 1496+0 records in 1496+0 records out 6127616 bytes (6.1 MB) copied, 47.1088 s, 130 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 148.795 s, 45.4 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 148.796 s, 45.4 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 148.796 s, 45.4 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 148.797 s, 45.4 kB/s 6754304 bytes (6.8 MB) copied, 148.797 s, 45.4 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 148.797 s, 45.4 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 148.797 s, 45.4 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 194.599 s, 34.7 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 306.372 s, 22.0 kB/s dd: reading `/dev/sdc2': Input/output error 1649+0 records in 1649+0 records out 6754304 bytes (6.8 MB) copied, 306.412 s, 22.0 kB/s and I'm not shure, is it copying, is it still doing something or I should stop this and go to Data Recovery Specialists??? browsin |
dd copies data in raw format---in principle, you CAN use it to find pieces of files, but something like photorec* is much better.
The command you show is simply "cloning" the sdc1 partition to sdc2. That's maybe a good idea, but it won't help recover the files. |
Quote:
why Knoppix do not let my make folders or move anything on working hard drive? and photorec, have anyone tried it? how does it recover files, if I have 40 or 60 GB photoes, will the program recover them as one big mess? |
If you clone a partition, then you can access the files identically on the original and on the clone. In other words, if you can read one, you will also be able to read the other.
If you are running from a Knoppix live CD, you can read the contents of the hard drive. You will have to mount it first. |
Quote:
so why I can not make new folders, or move files??? and sorry mate, but you said: The command you show is simply "cloning" the sdc1 partition to sdc2. That's maybe a good idea, but it won't help recover the files and then: If you clone a partition, then you can access the files identically on the original and on the clone. In other words, if you can read one, you will also be able to read the other. so will I be able to get files or not? |
If you have a disk that you can read and access files using the normal tools, then you will have the same situation when usinhg the clone.
If you can not read the files on a disk (eg because it is damaged or the filesystem is corrupted) then cloning it will not help you. A clone is identical, therefore any problems will be identical. But, you can use dd to see the raw data on the disk--even if you can't see it by normal means. But, as I said, this is not the best way to attempt file recovery. |
ok
I understand that but I found some forumes in internet where people saying that usind dd comand duing clones or disk images they get files from broken hard drives usually broken means that they would not mount in any OS so I thought I'll give it a try If you saying, it's no good, I think it's poinles to me wait days or may be weeks untill my data will be cloned and I wount have access to it may be you know how to stop this dd comand? I'm not familiar with terminal or command prompt just trying every way |
To stop any Linux command, use ctrl-C
I think what you are reading is that people often recommend making a clone or an image before attempting recovery. The point is simply to be working on a copy and not the original. Once again, dd can find data, but not by making a clone. I suggest you try it--eg. Code:
dd if=/dev/sda3 bs=512 skip=10000 | hexdump -C | more Try different numbers in place of 10,000---that is strictly arbitrary. Also, "sda3" was arbitrary---put in the appropriate device ID. |
ok, thanks for info
can you tell me a bit more about photorec is it good recovering pictures? and may be you know why when I run Knoppix from CD and connect external hard (working one) system gives me Read Only permitions I'm not able create folders or move files? sorry for so many questions I just stuck with unmountable partition and the last thing I want to do is going to pay a lot of money but seems that it's coming :( |
Another tool is ddrescue which works much like dd but doesn't quit when it gets a read error. (It has additional recovery options, and the info file should be read before you try using it.)
|
if I will try ddrescue and photorec
and I will not get what I want will I make more damage to data? everytime I try tools to scan hard drive or restor data does it make things worse? |
Quote:
|
thanks guys
it's good to have some answers dd commands runs second day now, it seems stuck on 58GB, I will check it in the evening, if it does not go further I should stop it then I'll try one of suggested recovery progs on weekend if nothing works, it will go to Recovery Specialists, they do free diagnostics and apparently do not charge if cannot get data out... thanks anyway, I'll announce results as this topic might be usefull for someone else |
Quote:
However, with either of those types of problems, it would be quite unusual for the drive to be able to either spin or report any contents. I was just using ddrescue a couple of weeks ago trying to recover a four CD backup set for an NT system created a decade ago. I'd discovered (with some dismay) that the (cheap CompUSA) CDs that had been used for the backup set had deteriorated to the point that they could not be read (even using the drive on which they'd been created). With ddrescue I was able to create a readable image file of each CD (with zero-fill for the unreadable parts) which got me about 90% of the four disks. (Unfortunately, the specific file for which I was looking was not in that 90%, but I was somewhat amused by what else I found in the old backup set.) |
dd command stopped at 58GB and somehow unmounted hard drive
so I stopped dd "Ctrl C" then my other partition (Mac Extended) would not mount it was empty anyway so Disk Warrior did the job, and everithing fine with that still no luck with FAT32 partition is there anything similar to Disk Warrior on PC Windows? it should be may be that can help somehow I think it's problem with allocation tables on FAT32 is there anything to fix them??? dd rescue might be good, but I'm not sure how to use it? if I have 2 partitions on one drive one partition kind of broken can I use dd rescue to copy everithing to other partition? how the command line would look like? |
All times are GMT -5. The time now is 11:37 AM. |