LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 02-09-2013, 10:28 PM   #1
lshantz
LQ Newbie
 
Registered: Oct 2011
Location: Phoenix, AZ
Distribution: Opensuse
Posts: 19

Rep: Reputation: Disabled
How to recover data from a broken hard drive (ddrescue)?


I have a known bad hard drive with bad sectors and I am trying to recover data from it. I tried ddrescue, but the image is trash. I compared the bad drive to the ddrescue drive and they are identical. Doing a e2fsck -b superblock change, just fails on the rescue image. On the bad drive, it is attempting to fix it, but I continually am getting the above error. I keep hitting yes to ignore the error and force a rewrite, hoping that it will fix, but dont want to waste my evening if it is futile. It seems I have to partially fix this drive, before I can do a ddrescue on it. ??
 
Old 02-10-2013, 11:20 AM   #2
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Rep: Reputation: 127Reputation: 127
Quote:
Originally Posted by lshantz View Post
It seems I have to partially fix this drive, before I can do a ddrescue on it. ??
No. That is -NO! DON'T try that!
If you want to rescue stuff from a faulty drive you do *not* do anything on the drive itself! Each failed try will make rescuing more difficult.
You are on the right track with ddrescue, it simply makes a raw copy of the drive - complete with all errors.
When you have this copy, copy it to new image file and work on that.
When all is screwed up, just copy original image again - much faster than doing a new ddrescue.
I have rescued data from a few drives myself with this method, unfortunately I haven't used it enough to be able to guide you in what steps to take.
I just felt a need to tell you to never try anything directly on a faulty drive! *Always* take a copy to work on.
If everyting fails you might have to let professionals do the rescuing (only company I know of that can do this is Swedish IBAS, surely you have a few in your country). Every little attempt you've made on the drive itself will make their bill higher, and if you're very unlucky you might make rescuing impossible.
 
Old 02-11-2013, 11:08 AM   #3
lshantz
LQ Newbie
 
Registered: Oct 2011
Location: Phoenix, AZ
Distribution: Opensuse
Posts: 19

Original Poster
Rep: Reputation: Disabled
I understand what you are saying. I did make a dd image of the drive, and I then restored that on a good drive. ANY attempts to do anything to it, failed. Yet, when I went to the failing drive, it let me fix it. Very odd. In any event, in this manner I was able to recover 98% of the files. I got very little from the image. I must have done something wrong. In any event, I wished I had more time to play with this. The problem is now a days, a 2-4TB drive takes FOREVER to do anything with.
 
Old 02-11-2013, 11:14 AM   #4
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Rep: Reputation: 127Reputation: 127
Ok, glad you got most of it back!

Let me just say that you don't need to put the image on a new drive, instead mount it directly:
mount -o loop /path/my.iso /mnt/whatever
You can then do anthing on it just as if it was a real drive.
 
Old 02-11-2013, 01:08 PM   #5
lshantz
LQ Newbie
 
Registered: Oct 2011
Location: Phoenix, AZ
Distribution: Opensuse
Posts: 19

Original Poster
Rep: Reputation: Disabled
Really! I did NOT know that. I thought a dd image was not mountable. That would be cool. I will have to go try that. As luck would have it, I had done a complete backup just 3 days prior. That drive with my backups I thought was the one that for some reason lost it's mind at the same time I had hard drive failure. Unknown partition and test disk just can't seem to figure it out. Since I have the file backed up, I didn't want to waste any time on it, but wanted to "educate" myself on restore. I finally gave up that too. I wonder if it is because the head count is wrong. Something just is not making sense. I don't know if it is these new drives, or what. It thinks there is 255 heads, which of course it does not. Since ide translates, it is hard to know without doing a LOT more digging, and I am growing weary of banging my head against the wall when I don't need to. If I have room, I may dd it to play with later.
 
Old 02-11-2013, 01:14 PM   #6
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Rep: Reputation: 127Reputation: 127
Thumbs up

Quote:
Originally Posted by lshantz View Post
If I have room, I may dd it to play with later.
Or maybe, if you just want to educate yourself, I humbly suggest you play around with a smaller disk.
As you said earlier - "The problem is now a days, a 2-4TB drive takes FOREVER to do anything with."

And you had a backup, way to go!
That is far too unusual, thumbs up to you!
 
Old 02-11-2013, 01:22 PM   #7
lshantz
LQ Newbie
 
Registered: Oct 2011
Location: Phoenix, AZ
Distribution: Opensuse
Posts: 19

Original Poster
Rep: Reputation: Disabled
LOL... 80gb drives are all gone my friend. The smallest thing I have is a 750TB drive these days. I wished I DID have a smaller drive that was going. The one thing I DO have is a 28gb sda1 partition that I have dd'd, so I can play with that later. It just doesn't have the puzzling issue with a missing partition, like that 2tb drive has. Oh well... It has still been an educational experience. I am learning the kiss principle applies!!! I used to do RAID arrays for the boot disk, but in the end, it just makes recover 4 times harder to impossible. I had my /tmp, and /home directory on another drive. I think that too complicates things. I put the /tmp on a big drive, because if /tmp fills up on a small partition, it brings the drive down. So I need to come up with a plan to warn me when it starts getting full. I am now migrated to a bigger drive so that I can have /home and /tmp on the same drive.

Say, I have a question for you. I have used rsnapshot for a couple of years now, but I was not backing up bin, dev, lib, lib64, opt, proc, and run. Clearly I cut it too thin, because the restore didn't work out too well. I'm thinking I need lib and lib64 as well, what else? Thanks for the quick response. Have a great day.
 
Old 02-11-2013, 01:39 PM   #8
pingu
Senior Member
 
Registered: Jul 2004
Location: Skuttunge SWEDEN
Distribution: Debian preferably
Posts: 1,350

Rep: Reputation: 127Reputation: 127
Yep, you definitely need lib and lib64. Also bin and opt - IIRC, only skip dev, proc & run, backup everything else.
(Well, otoh, just reinstalling goes pretty fast if you keep the system separated from user-files which I believe you do.)
You can actually try it:
Boot from a live-cd (or from another system if you have more than one installed).
Then copy first system except /dev /proc /run to a new partition - you'll have to create these directories on new system but leave them empty.
Edit grub & /etc/fstab.
Boot new system, check that everything works.

And that about the "kiss principle", how about this:
2 years ago I built a storage server for my music & movies.
I was very broke, so I took 5 smaller disks and "bunched them together" using LVM (same principle as raid0, several physical disks creates one logical).
After a few months one disk crashed...
It took me DAYS to recover from that!
---
Edit:
And if you want, I can send you a bunch of ide-disks, 20-40GB in size!
(Just don't ask why I still have them... )

Last edited by pingu; 02-11-2013 at 01:43 PM. Reason: Forgot creating of dir's
 
Old 02-11-2013, 04:17 PM   #9
lshantz
LQ Newbie
 
Registered: Oct 2011
Location: Phoenix, AZ
Distribution: Opensuse
Posts: 19

Original Poster
Rep: Reputation: Disabled
Thanks, I'll tweak my script to include those from now on. If there is a next time, then it should be MUCH less painful. At least I didn't lose any critical data. I just lost way more time than I should have. This is good info to have. I appreciate it.

==========
And that about the "kiss principle", how about this:
2 years ago I built a storage server for my music & movies.
I was very broke, so I took 5 smaller disks and "bunched them together" using LVM (same principle as raid0, several physical disks creates one logical).
After a few months one disk crashed...
It took me DAYS to recover from that!
==========
OH yes... been there done that!! NOT fun. I have a couple of old used drobos... they are flakey, but half the time when a drive fails, I can recover. :/


===========
---
Edit:
And if you want, I can send you a bunch of ide-disks, 20-40GB in size!
(Just don't ask why I still have them... )
==========

Hahah.. I still have an old st225 drive. Those old 20mb drives. I have one big full height 500mb drive that weighs about 5 pounds. I have kept an old read write opptical I bought. Cost like $3,500 in the day and was a disaster. Kind of the predecessor to the cdrom I think. The first two I keep for fun, the last one just takes up space but can't bare to throw it away. hahah

PS. To anyone contemplating a multi drive system.... document!!! I figured I'd never forget. After all I was the one that set it all up, but over time, things change and memories fade. I started out with a 1TB drive... ran out of room and added a 2tb drive. Moved /home there. Then /tmp kept filling up, so I moved that to another drive. Well.. all those drives, not labeled, and not documentation, after I figure out what drive has failed, and cables get moved.. well you get the idea. Just label the cables, document what you have done, and tuck it into the case. At least it won't get lost, and it may help rebuilding later. Ask me how I know.

Last edited by lshantz; 02-11-2013 at 04:21 PM. Reason: add
 
Old 02-11-2013, 04:31 PM   #10
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,912

Rep: Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513
Mounting loopback works only if you copy a single partition.

IF you copy an entire physical drive, then you also get the partition table of that drive... and cannot mount it because the partition superblock is not at the right place of the image copy.

To mount disk images with a partition table requires you to decode the partition table to compute the necessary offset to the beginning of the partition...
 
Old 02-11-2013, 04:42 PM   #11
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
No it doesn't: just use 'kpartx'.
 
Old 02-11-2013, 05:34 PM   #12
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,912

Rep: Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513Reputation: 1513
Thanks, had not need that yet. Good to know.
 
Old 02-11-2013, 07:46 PM   #13
lshantz
LQ Newbie
 
Registered: Oct 2011
Location: Phoenix, AZ
Distribution: Opensuse
Posts: 19

Original Poster
Rep: Reputation: Disabled
I know this has started drifting, and I'm sorry for that. As you know I have a dd image of a partition on a drive that was going bad.

I attempt to mount as explained above.

mount -o loop image.dd /mnt/tmp and I get
I get mount: unknown filesystem type '(null)'

So since it is damaged, I'm guessing that I have to somehow fix it with a tool. ??
 
Old 02-11-2013, 08:02 PM   #14
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
If you have 'disktype' run
Code:
disktype /path/to/image.dd 2>&1 | tee /tmp/disktype.txt
then read (and attach?) "/tmp/disktype.txt".
If you have 'testdisk' run
Code:
cd /tmp && testdisk /debug/ log/ /path/to/image.dd
select Proceed > Intel > Analyse > Quick Search > N > (Enter) and press "q" until you have exited the application, then read (and rename to ".txt" extension and attach?) "/tmp/testdisk.log".
 
Old 02-11-2013, 08:51 PM   #15
lshantz
LQ Newbie
 
Registered: Oct 2011
Location: Phoenix, AZ
Distribution: Opensuse
Posts: 19

Original Poster
Rep: Reputation: Disabled
--- image.dd
Regular file, size 28.61 GiB (30720131072 bytes)
First 1 MiB (1048576 bytes) are blank

I then brought up testdisk as you suggested and it saw the partition. I selected W to write it to the image. It says you have to reboot, but since it is an image, I'm thinking a reload attempt is not in order.

mount -o loop image.dd /mnt/A
mount: unknown filesystem type '(null)'

Surely a reboot isn't needed. I'm in the middle of some data moving to finish cleaning up my "mess".
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Forgot how I imaged my hard drive, dd, ddrescue, ntfsclone??? antares4141 Linux - Software 3 01-24-2013 09:56 PM
Dead hard drive, and failing ddrescue tromboneman Linux - Hardware 2 01-01-2010 07:12 PM
how to recover data from a dead hard drive mariav Linux - General 3 03-19-2007 05:37 AM
LXer: Recover Data From a dead hard drive using ddrescue LXer Syndicated Linux News 0 11-28-2006 02:03 PM
how do i salvage/recover unerased data on my hard drive? nickleus Linux - General 8 01-19-2006 09:59 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 12:17 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration