HD Recovery

adri_ht_ · 03-12-2009, 10:00 PM

Hey guys,

Well, I got an HD which I previously pulled out data from when it crashed, but this time is more of a daunting task. Physically the device seems to be in good shape. It spins good and sounds good overall. It gets recognized without problem by the linux kernel.

Code:

Disk /dev/sdb: 80.0 GB, 80060424192 bytes
255 heads, 63 sectors/track, 9733 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0xb2a4199a

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *           1        9732    78172258+   7  HPFS/NTFS

The first thing I tried:

Code:

mount -t ntfs-3g /dev/sdb1 /mnt/sdb1 -o force

It just hangs there and does nothing.

Second:

Code:

dd if=/dev/sdb1 of=/mnt/usb/hector.img bs=4k conv=noerror,sync

It was copying at a very low rate 1MB/s and it got stuck once again after copying 3GB/s of data.

Third:

Code:

dd_rescue /dev/sdb1 /dev/sda9

Does nothing. I made sda9 a partition with the same size. I'm really out of ideas here. Any hint will be greatly appreciated. Thanks

Update: dd_rescue started working after installing through debian... Anyways ddrescue gets stuck at the same spot dd did. I guess is hitting a really bad block in there. I can hear a click-click sound if I put my ear close to it. This is how dd_rescue output looks when it gets stuck:

Code:

dd_rescue /dev/sdb1 /dev/sda9
dd_rescue: (info): ipos:   3109888.0k, opos:   3109888.0k, xferd:   3109888.0k
                   errs:      0, errxfer:         0.0k, succxfer:   3109888.0k
             +curr.rate:    25540kB/s, avg.rate:    14732kB/s, avg.load: 13.5%

JulianTosh · 03-13-2009, 07:52 AM

just curious... what happens if you use skip or seek with dd to "continue" from where it dies at the 3G mark?

onebuck · 03-13-2009, 09:07 AM

Hi,

You could try 'TestDisk' to recover what you can. Look at the 'Tools, Recovery, Diagnostic, Emergency' section of 'Slackware-Links'. More than just Slackware® links!

adri_ht_ · 03-14-2009, 06:53 PM

Quote:

Originally Posted by Admiral Beotch

just curious... what happens if you use skip or seek with dd to "continue" from where it dies at the 3G mark?

If I skip too close to the 3G range it goes to the click-click thing. Anyways I just started copying after 4G(so far is good):

Code:

dd if=/dev/sdb1 of=/mnt/usb/hector.img bs=4096 skip=1048576 conv=noerror,sync

Now my question is, let's say I'm able to dump everything after 4GB(I doubt it), and I get the first 3G of the beginning(just 1GB missing). How would I put those two images together? If I do that, would copying the resulting image to a partition work? Would be able to mount it and at least recover some files? Thanks

Code:

root@imperio:~# hdparm -I /dev/sdb

/dev/sdb:
 HDIO_DRIVE_CMD(identify) failed: Input/output error

unSpawn · 03-14-2009, 09:33 PM

Quote:

Originally Posted by adri_ht_

If I skip too close to the 3G range it goes to the click-click thing.

Note dd_rescue can read back to front as well. Potentially can get more out of it than skipping 1GB...

Quote:

Originally Posted by adri_ht_

How would I put those two images together?

Basically you could just 'dd' both images to the device, the second write skipping past the position the first image was written to. But you don't need to do that.

Quote:

Originally Posted by adri_ht_

If I do that, would copying the resulting image to a partition work?

I somehow doubt that. Kind of Brundlefly.

Quote:

Originally Posted by adri_ht_

Would be able to mount it and at least recover some files?

After fixing the directory structure it might. Or it just might not.
Point is you don't need to.
File recovery tools work from supplied images pretty well.

JulianTosh · 03-14-2009, 10:23 PM

If you cant get the images back together, then use one of these to recover your important files from the individual partial images:

http://www.forensicswiki.org/wiki/Foremost
http://www.forensicswiki.org/wiki/Scalpel

adri_ht_ · 03-14-2009, 11:12 PM

Quote:

Originally Posted by onebuck

Hi,

You could try 'TestDisk' to recover what you can. Look at the 'Tools, Recovery, Diagnostic, Emergency' section of 'Slackware-Links'. More than just Slackware® links!

Thanks a lot. I'm currently using PhotoRec and as of now is pulling out tons of pictures.

Code:

Note dd_rescue can read back to front as well. Potentially can get more out of it than skipping 1GB...

I tried using dd_rescue but it didn't work. Once the HD hits a bad spot it goes unresponsive, dd_rescue is not able to skip automatically. I couldn't get dd_rescue nor ddrescue to write to an image like I've been doing w/ dd.

Thanks unSpawn for your answers.

Code:

 	If you cant get the images back together, then use one of these to recover your important files from the individual partial images:

http://www.forensicswiki.org/wiki/Foremost
http://www.forensicswiki.org/wiki/Scalpel

I'll give them a try. Thanks.

Well, I ended up w/ 5 images and a Gib or so in between them. Now, I have a question. When dd dumps an image, is that image compressed in some way? I just want to make sure I don't have to restore the image before using a recovery utility. I'm saving all the images to /dev/sda9 which is mounted on /mnt/usb/ (ext3) and running recovery in that partition. Thanks

JulianTosh · 03-14-2009, 11:24 PM

dd reads/writes the stream of data as it is on the disk. under average circumstances, you should be able to use all forensic type tools to recover files from the stream...

Also, if all you're concerned about is images, then photorec is sufficient. foremost and scalpel are used for recovering all known files types - not just images.

unSpawn · 03-15-2009, 04:45 AM

Quote:

Originally Posted by Admiral Beotch

under average circumstances, you should be able to use all forensic type tools

Slightly OT but it does beg the question what the definition of "average" would be...

Quote:

Originally Posted by Admiral Beotch

Also, if all you're concerned about is images, then photorec is sufficient. foremost and scalpel are used for recovering all known files types - not just images.

That statement is not correct. Photorec does not limit itself to "just images". Besides it is way less demanding in terms of adding header/footer magic compared to scalpel or its predecessor.

JulianTosh · 03-15-2009, 05:04 AM

I stand corrected on PhotoRec.. thanks.

Quote:

Originally Posted by unSpawn

Slightly OT but it does beg the question what the definition of "average" would be...

I meant most users probably dont use full disk encryption. I do, which renders these tools useless if a disk's structure can't be rebuilt.

unSpawn · 03-15-2009, 05:24 AM

Quote:

Originally Posted by Admiral Beotch

II meant most users probably dont use full disk encryption. I do, which renders these tools useless if a disk's structure can't be rebuilt.

I see. Good point.

adri_ht_ · 03-18-2009, 04:21 PM

Hey guys,

After I finished recovering the HD, I wrote zeros to the entire HD. To my surprise, dd was able to do it in less than an hour at 25MB/s without stopping. At first I thought the hard drive was physically bad, but now I'm totally clueless.

Doesn't dd only fails when there are bad sectors (physically damaged sectors) in the HD? Thanks.

syg00 · 03-18-2009, 04:34 PM

80 Gig would take more than an hour - I'd say it hit your problem area and stopped.