Safest snapshot of a failing harddrive?

Question

I have a headless machine that stopped booting, so I pulled it out for diagnostics and got a message that one of the harddrives was about to fail, so I pulled them all out and I need to get everything off, before figuring out which I need to get rid of. I wasn't sure which drive was failing, because it only said "Harddrive 1" and I don't know which it referred to.

I'm wondering the best way to get everything off. I'm worried if I copy everything, I could get corrupt data and not realize some files are wrong until the drive is completely out of commission. What are my best options to get everything off in a way I can safely move to new storage?

Answer 1

First, Copy Most Critical Data Fast

If you have another hard drive in your system, quickly copy your most critical files to that drive. At least you will have a duplicate of your critical data. If you get corrupted data, that is still better than waiting while the situation could be further deteriorating.

Second, Do a Full Image Backup

Then, I would get as much of the bulk of information off the drive as soon as possible. I would try a disk imaging program (like Acronis True Image). That is the quickest way I know to get as much information off of the hard drive as quickly as possible. If there is corruption, you will get that, too... but at least you will have something to work with.

Third, Find and Recover Corrupted Data

If the backup is good, you can restore the image to a new hard drive. If you find corruption, then I would try a program like SpinRite. That program is designed to work tirelessly on your hard drive at the lowest level (even below the operating system level) and really dig into your hard drive data and retrieve every last little bit of data that is ever going to be retrieved.

Answer 2

I've got limited experience with this scenario, but my typical approach is to get as much off the drive ASAP; usually I drop it in a linux box and run a full dd image of the drive.

Once I've got the image I baby the actual drive; put it in an antistatic bag and keep it offline until I can determine if the image was complete/corrupted/etc... if there's anything that's wrong with the image I can decide if I need to bring the drive back online to go after specific data or whether to try another image with a different approach.

Answer 3

ddrescue can be used to first read whatever parts of the disk can be read with no errors, then retry just the problematic sectors. That way if your disk fails completely, you have a good chance of having copied off the unproblematic sectors.

Answer 4

I've heard that refrigerating the drive ahead of time yields better success rates. Don't know by how much though.