Best chance of recovery

[mrapoc]

Got my aunts hard drive in. Parted magic can't open the partition. She tells me its been getting slower and slower. So they have been using and using a failing drive. Not good.

What's my best chance here. Linux mint and gddrescue? Never used it before but she tells me professional recovery is too expensive hence why I'll give it a go. Disk management crashes in windows so its a baddy.

As always no backups but now I have their attention all that changes

 

[katz]

I hear you...my sis in law has a failing drive that is making noise, they continue to use it with three kids baby pics up through 16 yrs. old and no backups...I just can't get through to them...

As lcoughy preaches, create an image first & work from that. Recover my files recently did a great job for me. Aside from that, I like Photorec.

 

[lcoughey]

It has been my experience that in cases like these, professional recovery is too expensive because it is misrepresented as being expensive. I recommend you first contact Sean at PCImage.co.uk and discuss the case, if his minimum is confirmed to be too expensive, then go nuts. Once you start at it and if the drive fails, it will then be too expensive.

As for the safest things to do, clone with ddrescue. If you run into very large zones of errors or are unable to get very far with the clone, you are unlikely to recover the data.

Good luck!

 

[pctutor]

I've had success with doing a drive repair with Spinrite first also. I've had some drives that have crashed pretty hard, and Spinrite got them working at least to the point where I could get the data off.

 

[lcoughey]

I've had success with doing a drive repair with Spinrite first also. I've had some drives that have crashed pretty hard, and Spinrite got them working at least to the point where I could get the data off.

I've posted many times why Spinrite is NOT to be used as a data recovery program.

Spinrite = remap sectors, permanently losing data forever. If drive crashes, even at 99.99% completion, 100% of the data is lost.

ddrescue = full sector-by-sector clone of a drive. If a sector is bad, you can go back and keep retrying in hopes to recover the one sector. If the drive crashes as 99.99%, you have 99.99% of the drive recovered.

 

[phaZed]

ddrescue. Everytime. No excuses.

 

[tankman1989]

added & changed some things

Well if it can mount on linux I would see if the files can be pulled off. I use an Ubuntu flavor or Kali for this. If it you can't see the files I would do a dd copy of the drive to either a file or another drive.

First run fdisk:

su fdisk -l

This will show you what the drive is named (sde here) and how many partitions and the sizes of them.

If you want to monitor the progress (I would suggest for a HD image as they can get stuck) install PV on the system (can't help here, it is distribution dependent - Ubuntu & Mint are:

su apt-get install pv

or

su aptitude install pv

Here is a dd command that would work:

dd if=/dev/sde conv=sync,noerror bs=64K |  pv -tpreb -s 8192M | dd of=/home/user/sde.bin

or this to copy just the partition (no MBR)

dd if=/dev/sde1 conv=sync,noerror bs=64K |  pv -tpreb -s 8192M | dd of=/home/user/sde.bin

or this to copy to another device:

dd if=/dev/sde conv=sync,noerror bs=64K | pv -tpreb -s 8192M | dd of=/dev/sd?

with size changed to 8 Gigs instead

dd if=/dev/sde1 conv=sync,noerror bs=64K | pv -tpreb -s 8G | dd of=/dev/sd?

pv switches:
t - timer
p - progress
r - rate
e - eta
b - show bytes transfered.
s - estimated size of data to transfer (must be whole numbers Use M, G & T for Mega, Giga, Tera)

 

[lcoughey]

Well if it can mount on linux I would see if the files can be pulled off. I use an Ubuntu flavor or Kali for this. If it you can't see the files I would do a dd copy of the drive to either a file or another drive.

Here is a dd command that would work:

dd if=/dev/sde [B]conv=sync,noerror bs=64K[/B] | gzip -c > /home/user/sde.img.gz

If you want to vie progress and stats to see keep track if it is working, use the PV command.

pv /dev/sde | dd of=/home/user/sde.bin bs=100M

In both of these /dev/sde is the input device/file (if). I'm trying to find out how to incorporate the bolded part into the pv command.

I see what you are trying to do here but why not just use ddrescue with a log file? Also, isn't the compression slowing down the mirror process and making the file system recovery somewhat more complex? What happens if the drive is unstable and you are required to restart multiple times, I don't see how you can pickup where you left off.

Just the same, I like the idea of compression if you just want to make a full backup image of a healthy drive...especially if the drive is large and not very full.

It is an interesting concept that I will have to think about.

 

[tankman1989]

I see what you are trying to do here but why not just use ddrescue with a log file? Also, isn't the compression slowing down the mirror process and making the file system recovery somewhat more complex? What happens if the drive is unstable and you are required to restart multiple times, I don't see how you can pickup where you left off.

Just the same, I like the idea of compression if you just want to make a full backup image of a healthy drive...especially if the drive is large and not very full.

It is an interesting concept that I will have to think about.

Thanks for pointing that out. I cut & pasted the wrong line from my recover notes. This is ideal for making a backup with progress stats. I'm going to post how to make it show time remaining once I figure that out.

dd if=/dev/sde conv=sync,noerror bs=64K | pv | dd of=/home/user/sde.bin

This will show throughput, cumulative data transferred, running time and a "in progress" motion cursor.

 

[tankman1989]

Updated first post on thread with much better method.

 

[glennd]

i went in search of ddrescue and discovered http://www.bootmed.com/

is this a reasonable tool to use? from what i can tell it's a gui front end to ddrescue.

edit: apparently BootMedPlus is a live Ubuntu gui front end. He asks $10 for the download. includes some nice recovery tools in addition to ddrescue.

BootMed (ordinary) is a live command line driven cd. all the essential disk recovery tools.

and it's on the PartedMagic cd !

 

[mrapoc]

Interesting. Bootmed is on parted magic? And its a GUI to ddrescue? I thought gddrescue was the one to use nowadays?

 

[glennd]

Interesting. Bootmed is on parted magic? And its a GUI to ddrescue? I thought gddrescue was the one to use nowadays?

sorry, ddrescue is on the parted magic cd, not bootmed. i went looking and discovered i have the parted magic cd already in my toolkit. that cd has a bunch of other nice tools as well which i'd forgotten about. that was kind of like a little christmas finding all that stuff

anyway command line is fine for me, i don't need no steenking gui

 

[mrapoc]

Ohhh nerdy! I'll give cmd line a go then! Via sata not USB caddy is best? If so I need to get a recovery rig with easy access sata cables Or esata

 

[frase]

ddrescue. Everytime. No excuses.

2nd this but can take forever depending on HDD integrity and size, prepare to wait days.
I have a linux based workstation designated for this task, so wont take up other systems.

Direct SATA is best as USB reading and transfer is much slower. If it is within a external HDD - take it apart and direct connect to the SATA ports of your system.
Best way to unclip most external hard drive case cases is to run an old credit card type card around the inner joins. This will release the clips on the inner and outer case, then simply remove HDD and connect to SATA on your system.

 

[mrapoc]

Cheers. System spec make much of a difference? Sata3? Distro make much difference? Giving it a crack later

 

[mrapoc]

Bit of a bump. Got ddrescue going. Easy peasy! No GUI and its simple enough!

Anyway. Its still going and there's a fair amount of errors. Once its done I hear rstudio would be a good purchase. Which version should I go for? The license is per machine on non tech so is it physically not going to work if I change my recovery rig or Am I simply not supposed to. Also there's Linux variants which may be useful on parted magic

 

[lcoughey]

Bit of a bump. Got ddrescue going. Easy peasy! No GUI and its simple enough!

Anyway. Its still going and there's a fair amount of errors. Once its done I hear rstudio would be a good purchase. Which version should I go for? The license is per machine on non tech so is it physically not going to work if I change my recovery rig or Am I simply not supposed to. Also there's Linux variants which may be useful on parted magic

Take note that if ddrescue is finding "A LOT" of read errors, you may be dealing with a drive with a weak head. Just be absolutely sure that you and your client understand that if the drive fails during your clone process, it will likely be too late outsource afterwards.

I suspect that you are okay on your own, but I cannot see the ddrescue log to interpret the amount of read errors.

 

[mrapoc]

Already confirmed that professional recovery was not an option for them. Luckily it was the start of the college year so minimal work is at risk. More of an exercise really.

Which version of rstudio you reckon I should pickup?

 

[TimM]

I'd recommend trying to mount the ddrescue image first. If the file system is intact, you may well be able to recover the data without needing to use a recovery tool like R-Studio.
You can mount the image from within PartedMagic, (use the third part of the Technibble DDRescue guide for instructions) or you can use OSFMount from Windows.