Recover harddrive data

Question

I have a dell laptop that recently "died" (It would get the blue screen of death upon starting) and the hard drive would make a weird cyclic clicking noises.

I wanted to see if I could use some tools on my linux machine to recover the data, so I plugged it into there.

If I run "fdisk" I get:

Disk /dev/sdb: 20.0 GB, 20003880960 bytes
64 heads, 32 sectors/track, 19077 cylinders
Units = cylinders of 2048 * 512 = 1048576 bytes
Disk identifier: 0x64651a0a

Disk /dev/sdb doesn't contain a valid partition table

Fine, the partition table is messed up. However if I run "testdisk" in attempt to fix the table, it freezes at this point, making the same cyclical clicking noises:

Disk /dev/sdb - 20 GB / 18 GiB - CHS 19078 64 32
Analyse cylinder   158/19077: 00%

I don't really care about the hard drive working again, and just the data, so I ran "gpart" to figure out where the partitions used to be. I got this:

dev(/dev/sdb) mss(512) chs(19077/64/32)(LBA) #s(39069696) size(19077mb)

* Warning: strange partition table magic 0x2A55.
Primary partition(1)
   type: 222(0xDE)(UNKNOWN)
   size: 15mb #s(31429) s(63-31491)
   chs:  (0/1/1)-(3/126/63)d (0/1/32)-(15/24/4)r
   hex:  00 01 01 00 DE 7E 3F 03 3F 00 00 00 C5 7A 00 00

Primary partition(2)
   type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX) (BOOT)
   size: 19021mb #s(38956987) s(31492-38988478)
   chs:  (4/0/1)-(895/126/63)d (15/24/5)-(19037/21/31)r
   hex:  80 00 01 04 07 7E FF 7F 04 7B 00 00 BB 6F 52 02

So I tried to mount just to the old NTFS partition, but got an error:

sudo mount -o loop,ro,offset=16123904 -t ntfs /dev/sdb /mnt/usb
NTFS signature is missing.

Ugh. Okay. But then I tried to get a raw data dump by running

dd if=/dev/sdb of=/home/erik/brokenhd skip=31492 count=38956987 

But the file got up to 59885568 bytes, and made the same cyclical clicking noises.

Obviously there is a bad sector, but I don't know what to do about it!

The data is still there... if I view that 57MB file in textpad... I can see raw data from files.

How can I get my data back?

Thanks for any suggestions,

Solution:

I was able to recover about 90% of my data:

1. Froze harddrive in freezer
2. Used Ddrescue to make a copy of the drive
3. Since Ddrescue wasn't able to get enough of my drive to use testdisk to recover my partitions/file system, I ended up using photorec to recover most of my files

Answer 1

DDrescue is designed to get data off in situations like this. Then try mounting the image, and if files are missing give testdisk and photorec a chance on the image.

Answer 2

Since you are Linux savvy, try running both Testdisk and PhotoRec on the drive. Or even better, try to get a dd image of the drive and have them crawl through it. Hard drives that make noise tends to have serious problems and not last long after the noises begin.

Answer 3

TestDisk is a free open source partition scanner and data recovery tool. It is very useful in recovering lost partitions. PhotoRec is another free commonly used data recovery tool.

TestDisk is a lot more efficient than PhotoRec. The problem with TestDisk is that it doesn't always recover all deleted files. If you accidentally reformat a partition, TestDisk can recover thousands of files without missing a single file, but if you deleted a file by sending it to the Trash and then emptying the Trash, TestDisk can't always recover it.

So use TestDisk first, and if you recovered all of the deleted files with TestDisk, then you're done. If you recovered most of the deleted files with TestDisk, you can decide whether you're done or not. If you're not done after running TestDisk, you can try recovering the deleted files using PhotoRec. PhotoRec can't recover deleted files that have been completely overwritten (for example, with the dd program). In some cases, the filename is stored in the file itself. PhotoRec tries to recover the filename in this case, but most of the time PhotoRec can't recover the filenames.

---

Recover files based on filetype using PhotoRec

It is preferable to boot from a Linux live DVD/USB before following these steps, in order to avoid using the operating system in which the deleted file is located.

1. Install TestDisk if it is not already installed in your OS. In Linux distributions, installing TestDisk will also install PhotoRec along with it.

2. Launch PhotoRec (launch from a terminal in a live CD/USB or launch as root).

3. Select hard disk.

4. Select partition type.

   If your hard disk has Linux partitions, then select [Intel].

5. Select filetype option.

   Move to [File Opt] and press Enter. Here you can disable all file types by pressing s. Use space to toggle the check button. Select filetype(s) to recover.

6. Select options.

   PhotoRec also has a list of different options. Under normal circumstances you don’t need to modify them.

7. Select partition.

   Move the selector to the partition from which you have removed the file. Then press Enter on [Search].

8. Select filesystem type.

   If you are using Linux, it's going to be ext2/ext3/ext4, so the default selection is ext2/ext3. Otherwise if you are recovering files from a partition formatted as FAT or NTFS select Other.

9. Select space for analysis.

   Select Free if you didn’t write to that partition after removing the particular file, otherwise select Whole.

10. Select a directory to recover files.

    Now select the path where the recovered files will be stored. Then press Y.

PhotoRec will show how many files it has recovered.

Answer 4

http://www.grc.com/spinrite.htm

I've heard so many good things about this program.

It costs a pretty penny ($ 89.00 for a lifetime, i believe, licence), and i cannot talk about it from personal experience.

However i hope the community will downvote me if it isn't a good solution to your problem - wait for other responses (and feedback) before spending cash.

That said, the basic idea of the program is that it scans the drive at a deep level, reading every sector, looking for defects, errors, misreads, etc. and subsequently "fixes" them (swaps them for a good sector, or simply lets the HD do it itself).

Irregardless, i suggest the moment you get the data off your drive you get a new one! Clicking is very very bad!

Answer 5

How can I get my data back?

The best tool I've ever used for hard drive recovery is Runtime Software's GetDataBack. It's a Windows program, so you'll have to find a way to plug that hard drive into a desktop machine running Windows. I've used it to recover off a SCSI drive, an IDE drive reformatted with Windows XP (partial recovery), a drive with a partition blown away with FDISK, a disk that BIOS couldn't even detect, etc.

You can run the evaluation version to find out exactly which files you will get back, but it costs around USD 80 to actually begin recovering files. I have both the NTFS and FAT versions, but only used FAT once.