1
A student gave me a hard drive that he says no longer works. I told him I'd at least take a look at it, since I run Ubuntu 13.10 on my desk computer. I didn't make any promises, but I'd very much like to help this student recover his data.
sudo fdisk -l
shows:
Disk /dev/sdf: 250.1 GB, 250059350016 bytes`
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xa6c460d8
Device Boot Start End Blocks Id System
/dev/sdf1 * 2048 409599 203776 7 HPFS/NTFS/exFAT
/dev/sdf2 409600 448610303 224100352 7 HPFS/NTFS/exFAT
/dev/sdf3 448610304 488183807 19786752 7 HPFS/NTFS/exFAT
/dev/sdf4 488183808 488395119 105656 c W95 FAT32 (LBA)`
/dev/sdf2
is the partition I'm hoping to recover! So I'll run ntfsfix
to tackle any issues.
Unfortunately, sudo ntfsfix /dev/sdf2
results in:
stead@ws-stead:/media/usb$ sudo ntfsfix /dev/sdf2
Mounting volume... $MFTMirr does not match $MFT (record 3).
FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... FAILED
Correcting differences in $MFTMirr record 3...OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Failed to sync device /dev/sdf2: Input/output error
Error opening '/dev/sdf2': No such device or address
Remount failed: No such device or address
I've been googling this error for a little bit - both the "Failed to sync" error and
"Remount Failed", to no avail. Looking at the output, "No such device or address" leads me to believe that the device is disconnecting and reconnecting or shorting out in some way. fdisk -l
again returns the same table for this device as listed above.
Is there another tool I should be using for a next step from here? Does this look like physical device damage and I should throw in the towel?
Here's some nasty notices in the syslog:
Oct 21 10:54:43 ws-stead kernel: [250925.728715] end_request: critical target error, dev sdf, sector 2936
Oct 21 10:54:43 ws-stead kernel: [250925.728721] Buffer I/O error on device sdf1, logical block 111
Thanks! I'd be happy to provide any more information or clarify anything!
Does
sdf
even show up again (infdisk -l
orlsblk
) after you physically reconnect it (assuming it's a USB hard drive)? Use-d sat
forsmartctl
btw. – Tom Yan – 2016-04-04T13:04:58.413Assuming that professional recovery services are out of discussion, the first thing you should have done was to create an image of the disk if possible then play around with various destructive methods. – Cristian Ciupitu – 2013-10-21T18:35:01.227
1just out of curiosity, have you checked the smart stats on the disk to determine if it is mechanically healthy? if not, image it before proceeding. also ntfsfix is a handy tool, but its no replacement for windows chkdsk. have you considered putting it in a windows box and running 'chkdsk -r' to check for and mark bad blocks on the disk? – Frank Thomas – 2013-10-21T18:36:39.093
Thanks Frank! It's a laptop hard drive, and I don't have the necessary adapters to get it connected up to any of my Windows Desktops. The user reported that Windows repeatedly suggests to format the drive on his laptop every time it's plugged in. I'll see if chkdsk is available at that stage. – SteadH – 2013-10-21T18:38:17.450
1Oh... SMART reports back:
Read Device Identity failed: scsi error medium or hardware error (serious)
. I'm guessing I have a physically sad drive. – SteadH – 2013-10-21T18:56:24.987then I would recommend you use ddrescue to attempt to take an image of the partition you want to recover. if you can get a decent image, you can probably recover most of the partition, if the bad blocks aren't in the filesystem meta tables themselves, though some files will likely be damaged. – Frank Thomas – 2013-10-21T19:28:09.233
Get the ISO version of mhdd and run it on the hard drive. Run it and see how many errors there are. If the program runs longer than 24 solid hours there are a lot of bad sectors. – cybernard – 2013-10-22T01:10:03.800