problem with dd/foremoste+usb-hdd - trying to rescue data
 

Hello,
I'm trying to recover some data from hda, with windows installed.

I tried with knoppicilin 4 as basis (live-cd), since I don't want to interfere with the data and it was the latest linux I had on cd available. I connected the usb-hdd (larger than hda), and typed in something like

dd if=/dev/hda of=/dev/sda bs=2048k

In preperation, I've tested which bs value results in the best performance, and came up with the mentioned (or maybe 1024k, I don't think it matters too much). When I used a high (>100 aprox.) count of blocks to test, it sort of freezed, and I tried to copy the whole thing, let the machine run for around 40h (I extrapolated the time needed from my benchmark and expected something like 2h max), but it didn't do the job. TOP showed strange values, cpu was 99% wa, not idle, and the rest was used for dd...

So, since I couldn't get an image done, I tried to run foremost on /dev/hda with output to a reiserfs on the usb-hdd...
... went nice, but after some time it also stopped and TOP showed the same strange values.
Foremost (1.0, self compiled, tested succesfully on other machine) did find some files, but it looks like it crashed before it actually wrote something usefull on the usb-hdd, since all the files have 0 bytes in them.

Both application did not write any errors, so I suppose it's not a i/o error. hda is 170Gb.

Any ideas what could be the reason, and what I can do to recover the data?
greetings
Barkpingu

If you can, try dcfldd (search Sourceforge for FIRE or BIATCHUX) or dd_rescue instead of plain dd if you expect the drive to contain errors. Next to that I'd try Fatback first for quick wins and then use Foremost to do a header/footer search. I prolly don't need to tell you as you've started off the right way, but still I'd like to emphasise it's crucial to get that image first.

Good luck!

the solution was that I used another Distri with the old 2.4 Kernel. I tested and it was looking good, I started copying the whole thing (170Gb) and a few hours laters it was done.
Now I'm looking forward to analyse the image on one of my pcs - since all of them have just USB1.1 it will take at least 32h...
Why is it so crucial to get the image first?
thanks anyway,
barkpingu