Recover harddrive data

12

4

I have a dell laptop that recently "died" (It would get the blue screen of death upon starting) and the hard drive would make a weird cyclic clicking noises.

I wanted to see if I could use some tools on my linux machine to recover the data, so I plugged it into there.

If I run "fdisk" I get:

Disk /dev/sdb: 20.0 GB, 20003880960 bytes
64 heads, 32 sectors/track, 19077 cylinders
Units = cylinders of 2048 * 512 = 1048576 bytes
Disk identifier: 0x64651a0a

Disk /dev/sdb doesn't contain a valid partition table

Fine, the partition table is messed up. However if I run "testdisk" in attempt to fix the table, it freezes at this point, making the same cyclical clicking noises:

Disk /dev/sdb - 20 GB / 18 GiB - CHS 19078 64 32
Analyse cylinder   158/19077: 00%

I don't really care about the hard drive working again, and just the data, so I ran "gpart" to figure out where the partitions used to be. I got this:

dev(/dev/sdb) mss(512) chs(19077/64/32)(LBA) #s(39069696) size(19077mb)

* Warning: strange partition table magic 0x2A55.
Primary partition(1)
   type: 222(0xDE)(UNKNOWN)
   size: 15mb #s(31429) s(63-31491)
   chs:  (0/1/1)-(3/126/63)d (0/1/32)-(15/24/4)r
   hex:  00 01 01 00 DE 7E 3F 03 3F 00 00 00 C5 7A 00 00

Primary partition(2)
   type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX) (BOOT)
   size: 19021mb #s(38956987) s(31492-38988478)
   chs:  (4/0/1)-(895/126/63)d (15/24/5)-(19037/21/31)r
   hex:  80 00 01 04 07 7E FF 7F 04 7B 00 00 BB 6F 52 02

So I tried to mount just to the old NTFS partition, but got an error:

sudo mount -o loop,ro,offset=16123904 -t ntfs /dev/sdb /mnt/usb
NTFS signature is missing.

Ugh. Okay. But then I tried to get a raw data dump by running

dd if=/dev/sdb of=/home/erik/brokenhd skip=31492 count=38956987 

But the file got up to 59885568 bytes, and made the same cyclical clicking noises.

Obviously there is a bad sector, but I don't know what to do about it!

The data is still there... if I view that 57MB file in textpad... I can see raw data from files.

How can I get my data back?

Thanks for any suggestions,

Solution:

I was able to recover about 90% of my data:

  1. Froze harddrive in freezer
  2. Used Ddrescue to make a copy of the drive
  3. Since Ddrescue wasn't able to get enough of my drive to use testdisk to recover my partitions/file system, I ended up using photorec to recover most of my files

Erik W

Posted 2009-12-24T03:17:54.700

Reputation: 338

Insert hard drive into freezer for best results. – Shotgun Ninja – 2013-10-29T22:46:49.780

Answers

12

DDrescue is designed to get data off in situations like this. Then try mounting the image, and if files are missing give testdisk and photorec a chance on the image.

Journeyman Geek

Posted 2009-12-24T03:17:54.700

Reputation: 119 122

I'm having the same problem as everything else. Ddrescue gets me about a 75mb file before I hear the harddrive noises and it freezes. I can't even CTRL+C out of it. Is there a way to hack this logfile to start a sector after it left off? Or a flag I can set to make it care less about bad sectors? – Erik W – 2009-12-24T05:09:39.193

Further searching I read in an FAQ: "If ddrescue does not refresh the screen nor respond to Ctrl-C it is because the drive is blocked. Give it some time to finish the read request." I guess I'll let it sit overnight... – Erik W – 2009-12-24T05:32:32.033

... no such luck :( – Erik W – 2009-12-25T22:32:51.237

1

its supposed to ignore bad sectors. If a drive has catastropic physical damage though, A last ditch recovery method might involve putting the drive in a freezer. http://lifehacker.com/170257/macgyver-tip--save-your-hard-drive-in-the-freezer

– Journeyman Geek – 2009-12-26T00:32:27.250

I thought the freezer thing was a myth but it worked and helped DDrescue get past the rough spots. Then I used photorec to get my files. I got about 90% of my drive's data. Thanks for your help! – Erik W – 2009-12-26T09:34:26.610

5

Since you are Linux savvy, try running both Testdisk and PhotoRec on the drive. Or even better, try to get a dd image of the drive and have them crawl through it. Hard drives that make noise tends to have serious problems and not last long after the noises begin.

Goyuix

Posted 2009-12-24T03:17:54.700

Reputation: 6 021

>

  • "Hard drives that make noise tends to have serious problems and not last long after the noises begin" very true
  • < – hyperslug – 2009-12-24T03:44:11.523

    I never heard of PhotoRec, it's a pretty cool app! The problem is that it freezes after recovering about 50mb of data, just like testdisk. Is there some way to make these apps skip over this bad sector? – Erik W – 2009-12-24T04:16:39.677

    2

    TestDisk is a free open source partition scanner and data recovery tool. It is very useful in recovering lost partitions. PhotoRec is another free commonly used data recovery tool.

    TestDisk is a lot more efficient than PhotoRec. The problem with TestDisk is that it doesn't always recover all deleted files. If you accidentally reformat a partition, TestDisk can recover thousands of files without missing a single file, but if you deleted a file by sending it to the Trash and then emptying the Trash, TestDisk can't always recover it.

    So use TestDisk first, and if you recovered all of the deleted files with TestDisk, then you're done. If you recovered most of the deleted files with TestDisk, you can decide whether you're done or not. If you're not done after running TestDisk, you can try recovering the deleted files using PhotoRec. PhotoRec can't recover deleted files that have been completely overwritten (for example, with the dd program). In some cases, the filename is stored in the file itself. PhotoRec tries to recover the filename in this case, but most of the time PhotoRec can't recover the filenames.


    Recover files based on filetype using PhotoRec

    It is preferable to boot from a Linux live DVD/USB before following these steps, in order to avoid using the operating system in which the deleted file is located.

    1. Install TestDisk if it is not already installed in your OS. In Linux distributions, installing TestDisk will also install PhotoRec along with it.

    2. Launch PhotoRec (launch from a terminal in a live CD/USB or launch as root).

    3. Select hard disk.

    4. Select partition type.

      If your hard disk has Linux partitions, then select [Intel].

    5. Select filetype option.

      Move to [File Opt] and press Enter. Here you can disable all file types by pressing s. Use space to toggle the check button. Select filetype(s) to recover.

    6. Select options.

      PhotoRec also has a list of different options. Under normal circumstances you don’t need to modify them.

    7. Select partition.

      Move the selector to the partition from which you have removed the file. Then press Enter on [Search].

    8. Select filesystem type.

      If you are using Linux, it's going to be ext2/ext3/ext4, so the default selection is ext2/ext3. Otherwise if you are recovering files from a partition formatted as FAT or NTFS select Other.

    9. Select space for analysis.

      Select Free if you didn’t write to that partition after removing the particular file, otherwise select Whole.

    10. Select a directory to recover files.

      Now select the path where the recovered files will be stored. Then press Y.

    PhotoRec will show how many files it has recovered.

    karel

    Posted 2009-12-24T03:17:54.700

    Reputation: 11 374

    1

    http://www.grc.com/spinrite.htm

    I've heard so many good things about this program.

    It costs a pretty penny ($ 89.00 for a lifetime, i believe, licence), and i cannot talk about it from personal experience.

    However i hope the community will downvote me if it isn't a good solution to your problem - wait for other responses (and feedback) before spending cash.

    That said, the basic idea of the program is that it scans the drive at a deep level, reading every sector, looking for defects, errors, misreads, etc. and subsequently "fixes" them (swaps them for a good sector, or simply lets the HD do it itself).

    Irregardless, i suggest the moment you get the data off your drive you get a new one! Clicking is very very bad!

    Dmatig

    Posted 2009-12-24T03:17:54.700

    Reputation: 1 622

    +1 I have only heard good things about this program. – Steve Rowe – 2009-12-24T03:31:15.537

    1Spinrite can sometimes help, but the first task should always be to make and (partial) image with dd_rescue and after you have a as good copy as you can get, then play with the drive with Spinrite or any other rescue app. – Raynet – 2009-12-24T04:16:07.960

    Yeah, I'm hesitant to play with this program since I can't seem to create an image of the drive with anything. – Erik W – 2009-12-24T05:23:58.663

    0

    How can I get my data back?

    The best tool I've ever used for hard drive recovery is Runtime Software's GetDataBack. It's a Windows program, so you'll have to find a way to plug that hard drive into a desktop machine running Windows. I've used it to recover off a SCSI drive, an IDE drive reformatted with Windows XP (partial recovery), a drive with a partition blown away with FDISK, a disk that BIOS couldn't even detect, etc.

    You can run the evaluation version to find out exactly which files you will get back, but it costs around USD 80 to actually begin recovering files. I have both the NTFS and FAT versions, but only used FAT once.

    hyperslug

    Posted 2009-12-24T03:17:54.700

    Reputation: 12 882

    Well, there were a couple problems using this app. First, Windows things the hard drive is 1TB. Which it is clearly not (20GB) Then when it's done scanning it says it can't find any NTFS files. – Erik W – 2009-12-24T05:24:40.613