LinuxQuestions.org - Data recovery from external HDD

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - Data recovery from external HDD (https://www.linuxquestions.org/questions/linux-newbie-8/data-recovery-from-external-hdd-4175492905/)

Data recovery from external HDD

Dear Forum,

Although I've been using Kubuntu now for some three years, I still consider myself a rookie, so here goes...
I have an external Freecom HDD of 300 GB of almost 10 years old. It still functioned well until some weeks ago. All of a sudden, Dolphin would not open the disk anymore, although the percentage of the disk that was used (shown in a little blue bar underneath the disk label) did show. I have all sorts of data on it, and would like to create an image on another external HDD to rescue what I need and see if a good format would make it usable again (is this a correct train of thought ?)

A quick search on the web showed me that ddrescue, or gddrescue as it is called, was the place to be.
I tried following the advice on https://help.ubuntu.com/community/Da...ystem_or_drive

So I freed up a lotof space on another external of 1 TB (My Book). My damaged FREECOM HDD is 300 GB, and about 50% occupied. On the 1 TB HDD, I have about 240 GB free, so that should work.
The syntax I used is:

Code:

sudo ddrescue -r 3 /media/FREECOM HDD /media/My Book/Backups/freecom/image /media/My Book/Backups/freecom/logfile

To which I got:

Code:

ddrescue: Too many files.

So, I resorted to:

Code:

sudo ddrescue --no-split /media/FREECOM HDD /media/My Book/Backups/freecom/image /media/My Book/Backups/freecom/logfile

Which resulted again in:

Code:

ddrescue: Too many files.

Now, I can tell you I've looked all over the place and more of that, but that's not true. I'm wondering if I'm doing fundamentally wrong, or that it something with ddrescue...

Any ideas ?
Thanks heaps in advance !

Quote:

Originally Posted by Nederjaard (Post 5106996)

Code:

sudo ddrescue -r 3 /media/FREECOM HDD /media/My Book/Backups/freecom/image /media/My Book/Backups/freecom/logfile

To which I got:

Code:

ddrescue: Too many files.

So, I resorted to:

Code:

sudo ddrescue --no-split /media/FREECOM HDD /media/My Book/Backups/freecom/image /media/My Book/Backups/freecom/logfile

Which resulted again in:

Code:

ddrescue: Too many files.

looks like you arent using escape characters when using spaces. indead of FREECOM HDD try FREECOM\ HDD and My\ Book

Additionally I should point out you shouldn't do that:

Quote:

Originally Posted by Nederjaard (Post 5106996)

My damaged FREECOM HDD is 300 GB, and about 50% occupied. On the 1 TB HDD, I have about 240 GB free, so that should work.

ddrescue (as well as plain old dd, dcfldd, linen and dd_rescue) will just "nibble" the source disk and write to the target image, period. They have no concept of file systems (and therefore not of actual disk usage) so they'll write until they encounter an unrecoverable error, until all data is written or until the target file system is full.
*With plain old 'dd' you should be able to write to stdout and compress the output stream but you will only benefit from that if you know for sure (no "thinking", "guessing" or whatever else inaccurate assumption) the source disk contained a significant amount of repetitive data. Needless to say you would then either need a tool that can deal with compressed disk images or be forced to decompress the disk image anyway.

Because it is an external drive, you may want to mount it internally if possible before recovering. This is often faster in terms of read speed, and it may help exclude broken controllers that are part of the SATA to USB conversion.

If you can't mount it internally, then continue recovering files, but as said above ddrescue requires at least as much space as the entire disk you are recovering.

Hi all,

Thanks for all the advice. I first tried to mount the external hdd, using:

Code:

sudo mkdir /media/freecom

sudo mount -t ntfs-3g /dev/sdb /media/freecom

When that didn't work, I did a check:

Code:

sudo ntfsck /dev/sdb

Which gave me the following rather disturbing message:

Code:

Boot sector: Bad jump.

Boot sector: Bad NTFS magic.

Boot sector: Bytes per sector is not a multiple of 512.

sectors_per_cluster (190) is not a power of 2.

file record corrupted at offset 0 (0x0).

Loading $MFT runlist failed. Trying $MFTMirr.

file record corrupted at offset 0 (0x0).

Loading $MFTMirr runlist failed too. Aborting.

NTFS signature is missing.

This sounds like it sucks, right ? Any ideas what to do next ? Should I continue using ddrescue or is this senseless ?

Many thanks, much appreciated !

You have a few different options.
As ntfs is a Microsoft file system, it is potentially possible that Microsoft's own file system repair tools may be more successful. (sorry, I can't help their as I've never used them)

You could try Photorec, part of TestDisk, to recover the data files. But keep in mind that Photorec will use generic numbered file names and figuring out which file is which is half the challenge/nightmare.

You could try using TestDisk itself to recover the partition(s)

I don't think ddrescue will be much use here unless the 'corruption' is purely the result of read errors from a damaged drive. If the file system is actually corrupted, both dd and ddrescue will simply copy the corrupted bits as-is.

In data recovery and forensics, it is standard practice to make an as-is copy of the source drive onto a 'work' drive and then proceed to recover onto a third 'recovery' drive. However this assumes that you have at least two large drives each with more space available than the source drive.

Your next step depends on how valuable the lost data is to you as recovering data can be a lot more work than it's worth for more trivial data.

I'm recovering files using Photorec at the moment, and it's looking good !
Thanks again people, I hope I can take it from here and actually access my files tomorrow (14 h recovery to go)

All the best !