Data recovery (again)

[Big Jim]

Have WD Mybook that the owner suspects has been knocked off a shelf by his children.

I have extracted the drive inside (WD Green 1TB)
I have an image of the drive taken with DDRescue that has been written to another 1TB Drive using DD
File system is EXT4.

neither the disk itself or the spare drive with the newly written image is accessible by parted magic. (shows up an error when you try to access it, complaining about FStype)
I suspect the customers fears are correct that the drive has been dropped, as it detects several errors whilst scanning it.

What do I need to do now to get the partition visible again ?
I have tried testdisk to re-write the partition table but that didn't actually seem to do anything

 

[britechguy]

Have you tried PhotoRec (part of Test Disk, and it recovers far more than photos)? That's what I use when Test Disk hits the wall, and it does on occasion.

You are not likely to be able to repair, but that doesn't mean you won't be able to recover. But if you must use PhotoRec be aware that you will be sorting through duplicate files, thumbnails, etc., for a very long time afterward. It does "brute force" recovery and doesn't even recover using the original file names. It is the tool of last resort (at least unless you want to turn to a professional data recovery shop).

 

[Joep]

So, you think a bump actually shuffles some bits a bit resulting in partition table corruption? What kind of errors, read errors during the clone?

A bump is most likely to cause physical damage.

/I have an image of the drive taken with DDRescue that has been written to another 1TB Drive using DD
File system is EXT4./

Did you create a disk image or create a sector-by-sector copy? Where, how do you determine the partition isn't visible?

/Have you tried PhotoRec /

That's really last resort if software like R-Studio, UFS Explorer, ReclaiMe fails to reconstruct a directory tree.

 

[britechguy]

I agree that it's a last resort, but my experience with Test Disk is that it's an awfully robust utility and when it fails others seldom (not never, but seldom) succeed.

But if you've got any other options to try before PhotoRec you absolutely should try them.

 

[britechguy]

I am also presuming that there are sole copies of certain data on that drive, but it's worth asking the owner about that.

I have had the rare occasion where someone loses all composure because their backup drive has been destroyed only to find out, when I ask about it, that none of the source material that was backed up to that drive is gone. The relief when you can say, "Well, then, just get another backup drive ASAP and begin backing up on it," both for yourself and the client is palpable. Distressed individuals often don't think things through.

 

[Joep]

/ my experience with Test Disk is that it's an awfully robust utility and when it fails others seldom (not never, but seldom) succeed./

In doing what exactly?

 

[Larry Sabo]

I have an image of the drive taken with DDRescue that has been written to another 1TB Drive using DD
File system is EXT4.

neither the disk itself or the spare drive with the newly written image is accessible by parted magic. (shows up an error when you try to access it, complaining about FStype)

What does ReclaiMe File Recovery yield against the image drive? (I wouldn't even bother if the original files are available and good, as @britechguy suggests.)

 

[britechguy]

/ my experience with Test Disk is that it's an awfully robust utility and when it fails others seldom (not never, but seldom) succeed./

In doing what exactly?

In recovering data. I don't know exactly what you want me to say. If it can't either reconstruct lost partitions and recover their contents, then other utilities have not had much luck in that pursuit, either in my experience (and observation - such as it is).

I've been really impressed at what PhotoRec can find and recover if push comes to shove and professional data recovery services are not going to be engaged for whatever reason.

If others' experience differs, I'm certainly open to hearing about them. I am not all-knowing, nor do I make any claims of being so. There could be better ways and better utilities. It's venues like these where we learn about same from others.

 

[lcoughey]

Have WD Mybook

How are you handling the encryption?

 

[Joep]

I see. Recovering data is rather vague. And the number of cases and types of corruption where you could rely on Testdisk is rather limited I am not saying it's a bad tool. I was kinda interested in what type of cases you see or get to deal with. I am also not trying to start a war on which is the best tool or question your experiences with it.

PhotoRec as a RAW recovery tool is indeed excellent, I fully agree. But in many scenarios the original directory tree with original filenames is a huge bonus. I know Testdisk is also capable of this, but only on fairly intact file systems.

FWIW I know and have used a great deal of data and file recovery tools. Basically any tool I can lay my hands on I like to test out. Although many I would not recommend even to my worst enemies, picking ONE and say that's the best or always works there is close to impossible.

If I had to pick today it would be from this lot: R-Studio, UFS Explorer, ReclaiMe File Recovery and DMDE. Broad file system support, NAS, RAID etc..

R-Studio: Has got a lot going for it. Used a lot by data recovery pros and a tool really benefits from the real-world feedback and experience. The same goes for UFS Explorer and ReclaiMe (Pro). Linux and Mac versions too. Integration with hardware imagers.

UFS Explorer: Very actively developed based on real-world feedback from professional data recovery techs. Excellent support for virtually every file system you can think of. I have witnessed an engineer running into an issue and the problem being fixed a few hours later. Like R-Studio, good integration with hardware imagers.

ReclaiMe File Recovery: Benefits from feedback from professionals via it's big brother ReclaiMe Pro. Broad file system support, super quick, good results and easy to use. I have often seen reconstruct a directory tree where other tools failed. I tend to recommend this to end users that are new to data recovery because of the combination of features, good results and ease of use.

DMDE: A bit of an odd one, if you like Testdisk I guess you may like this one too. Apart from Windows, Mac and Linux versions there even is a DOS version.

/I've been really impressed at what PhotoRec can find and recover if push comes to shove and professional data recovery services are not going to be engaged for whatever reason./

These can't have been serious labs.

 

[britechguy]

I have no desire for a war, either.

And you misunderstood my statement that you quoted. Most of my clientele is composed of home users, and a great many of them on a budget. What I meant by "professional data recovery services are not going to be engaged" was just that: They're not being used. From where I sit it doesn't matter why they aren't going to go pro with data recovery, but if a client says they won't/can't or similar I will at least try PhotoRec if TestDisk (and/or other tools) have simply not been effective. I am not called upon to do data recovery on a routine basis, for which I am grateful. I also appreciate the synopses regarding the tools you've mentioned.

A lot of people are not going to pay 3 (sometimes 4) figures in USD to recover data that, while painful to lose, they can live with losing.

 

[Porthos]

Most of my clientele is composed of home users, and a great many of them on a budget. What I meant by "professional data recovery services are not going to be engaged" was just that: They're not being used. From where I sit it doesn't matter why they aren't going to go pro with data recovery

Same here, I have had 2 in 17 years want/wish to pay for pro services.

 

[Joep]

Ah, I see. Sorry about that, the misquote, I misunderstood.

 

[Markverhyden]

How are you handling the encryption?

This. The obvious indicator of this is the image showed up as EXT4 but M$ can't read any other file systems without special software added to the OS. Been a while but when I last looked at some of those you would see a few really large files, as in hundreds of GB's in R-Studio.

 

[coffee]

Have WD Mybook that the owner suspects has been knocked off a shelf by his children.

I have extracted the drive inside (WD Green 1TB)
I have an image of the drive taken with DDRescue that has been written to another 1TB Drive using DD
File system is EXT4.

So, This is a linux partition. It would help to see the command (DD) that you used to image the bad drive. Typically, I will do this:

DD if=/dev/sda of=/dev/sdb conv=noerror,sync bs=2048 status=progress

I assume /dev/sda is the bad drive and /dev/sdb is your good recovery drive.

After the clone is done run fsck on the cloned partiton - /dev/sdb2

fsck.ext4 -Va /dev/sdb2

a = just fix it - no interaction from you.
V = Verbose

When complete see if you can mount it read only

mount -t ext4 -ro /dev/sdb2 /mnt/baddrive

Hope this helps

 

[Big Jim]

to wrap this up, all tools mentioned in this thread (bar one) really didn't get very far.

The winner/saviour was R-Studio. not only did it recover the data, it managed to retain the original folder structure, it also separates the files it gets read errors on so they can be put in a separate folder.

another great tool to add to the arsenal

 

[Larry Sabo]

At $900 USD/year for a Technician license (required for service providers), it's not going to get added to my arsenal. Did you try with ReclaiMe File Recovery or Recovery-Explorer? They have much more realistic licensing options and costs.