Hello

Hi, my USB HD has a problem. Actually it was my secondary HD (IDE) in my PC
as the problem started, but now I put it in a USB-Box, so i'm more flexible.
(Unclean Shutdown during installation of new Distro (Ubuntu5.10, currently running) CD, which was badly burnt -> Pressed RESET button)

At the beginning of the Problem I could mount the disk and browse the files,
BUT i couldn't open, copy, execute ALL of the files. I could look at some JPG's on the disk, but I couldn't play or copy any MP3's (I din't try them all) on the disk. It just hung... (This was the case as the HD was in my PC (IDE) and also
as the HD was in the USB-Box).
Meanwhile I can't mount it anymore. But fdisk still recognizes the partitions:
(Update: I can still mount it on an Windows machine)

1.)
#root@tron:/home/danson# /sbin/fdisk -l

#Disk /dev/sda: 122.9 GB, 122942324736 bytes
#255 heads, 63 sectors/track, 14946 cylinders
#Units = cylinders of 16065 * 512 = 8225280 bytes

# Device Boot Start End Blocks Id System
#/dev/sda1 * 1 2550 20482843+ 7 HPFS/NTFS
#/dev/sda2 2551 14945 99562837+ f W95 Ext'd (LBA)
#/dev/sda5 2551 14945 99562806 b W95 FAT32

The data I try to recover is on /dev/sda5 (hope so!).
As you can see its an old HD (It still has a NTFS Part. with XP on it, which I have completely forgotten). I found some usefull information here:
http://new.linuxjournal.com/article/193


...then I tried fsck:

#root@tron:/home/danson# fsck -a /dev/sda5
#fsck 1.38 (30-Jun-2005)
#dosfsck 2.11, 12 Mar 2005, FAT32, LFN
#Got 131072 bytes instead of 99368712 at 16384

...and badblocks:

#root@tron:/home/danson# badblocks -o errorlog.txt /dev/sda5
badblocks is still running.... (since 2 hours..)
errorlog.txt untill now:
192
376 to 443
1392 to 1871
3712 to 4187
5072 to 5679
and so on (seems as if all the blocks are damaged?)

How do I find out what my problem is? Is it the partition table, some bad blocks or something else?

Thank you

If you have the space you could make a copy of the partition using 'dd'. Then you can play with this image without further damaging the original. The various FAT filesystems are documented at

http://www.win.tue.nl/~aeb/linux/fs/fat/fat-1.html

If the data is valuable I would be inclined to just cough up the cash for a commercial recovery tool (Windows-based is all you will find I think). I had good success with the demo version of ZAR (http://www.z-a-recovery.com/) which is restricted to image files (corrupted flash memory and accidentally erased images seem to be a common problem on digital cameras). It was the best of 3 or 4 I tried, but the full version costs money.

Alternatively there are a some linux tools for recovering image files e.g.

http://freshmeat.net/search/?q=jpeg+...ction=projects

Not sure how they go on fragmented files. The one I tried was not as successful as ZAR. Maybe you could modify one to look for mp3 files also.

Actually it was my secondary HD (IDE) in my PC as the problem started, but now I put it in a USB-Box
I think avoiding extra transport layers (USB) is best if you're trying to recover stuff.


(Unclean Shutdown during installation of new Distro (...) -> Pressed RESET button)
OK, you're already past that stage, but if the kernel didn't panic and "magic sysrq keys" are on, next time use these combo's:
ALT+PRNTSCR+S (sync), ALT+PRNTSCR+U (remount read-only), ALT+PRNTSCR+B (reboot).


At the beginning of the Problem I could mount the disk and browse the files
Errors are not there to be neglected. The longer you wait, the more data you *will* loose.


Meanwhile I can't mount it anymore. But fdisk still recognizes the partitions:
(Update: I can still mount it on an Windows machine), / How do I find out what my problem is? Is it the partition table, some bad blocks or something else?
You want to backup your data first. For that you'll unfortunately need space aprox twice the size of the partition, aprox 200GB in your case. 100GB for making a backup copy of the partition and the other as space for recovery. Put the drive back in the machine, boot Linux and remount the drive read-only and use a tool like dd_rescue to get the data off the drive, because "dd" may b0rk on errors. Now there's two paths you can choose, but whatever you choose you must not expect a flawless recovery. And recoverable data doesn't mean *usable* data BTW.

If there is a lot still copyable from Wintendo then I suggest you do that as it will save time and get's you an easy indication if you want/need to recover other files. There are two major with this approach: Wintendo can't mount the drive in read-only mode and a checkdisk autorepair may or may not help. This means that if recovery fails or for recovering the rest you *will need* your backup image.

If most files are not recoverable from Wintendo then boot into Linux, loopmount the backup image read-only and try Fatback which is a "general" FAT undelete tool. If that doesn't get everything you can try Foremost which can only retrieve files based on header/footer combo (like GNU "magic" used by "file").

If there's still more on the drive you need to recover badly it should be time to look at forensic toolkits like The Sleuthkit and Autopsy. You don't want to use those unless you have plenty of time, don't mind steep learning curves and lowered your expectation rate wrt recoverable data.


Good luck.