ddrescue fails to correctly end transfer

[FascistNation]

I recently had a friend with a new Hitachi 2TB 32MB 7200RPM 3.5" SATA 6.0Gb/s Internal Desktop Hard Drive with Win7 Pro OS that was reported by Windows as failing. He asked me to recover it and replace the drive. This was not a boot drive. It still had a few days to return it to the vendor.

I was unable to access it with anything in a new PC (with different known working SATA controller and SATA data and power cables).

Interestingly, Hitachi's DFT reported everything was fine:
SMART Status : Healthy

Test Log

ReadErrStat : Done
Result : Pass


SMART QT : Done
Result : Pass


Despite 3 Windows Events indicating the same SMART failure.
Description:The driver has detected that device \Device\Harddisk3\DR3 has predicted that it will fail. Immediately back up your data and replace your hard disk drive. A failure may be imminent.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

I used ddrescue 1.18.1 on System Rescue CD.

Because the HDD was new I expected all the data/files would be in the first quarter of the drive. ddrescue took about 25 hours to burrow its way through the 2TB drive and write to a new 2TB drive (I suspect some now know what my issue will be). I didn't have any bigger drives.

ddrescue -n -f /dev/sdb /dev/sdc resq.log

ddrescue recovered all but 347 files (about 0.5%), but reported it could not properly finish because it ran out of drive space on the destination drive. The slow transfer rate as well as the rising count of non-recovered files ended about one quarter into the recovery process indicating it was past where the--or at least most--data files were present and was literally now recovering virgin territory.

These were both NTFS formatted, single partition of the entire drive drives (new one was a new Toshiba 2TB HDD).

On Linux, I cannot mount the recovered drive to copy it, nor view it. Keep getting NTFS format error.

I do not want to see if anything is visible on a Window OS due to the propensity of such to offer to fix things, which I do not want it to attempt.

To make matters worse, I bought and GPT formatted a 4TB drive and started to repeat the ddrescue and the failing HDD completely failed less than 10% of the way in.

I have been reading the ddrescue manual as well as several forums and cannot find for certain instructions on how to repair the "full" destination drive so it is accessible. I do not want to make any mistakes that could corrupt data further. Anyone have any ideas on rescue/repair so I can make a copy and then see what was recovered and where things stand?

 

[NYJimbo]

Are you looking to start a computer business, already have one, working for someone else or something else?
nope
​

This forum is for professional computer technicians or people who are starting a business.

 

[Mainstay]

Seems harsh @NYJimbo. Sending some Southern Comfort your way to lighten things up.

Don't have your answer @FascistNation. Best of luck.

Have you tried an alternative data recovery method?

 

[NJW]

@Mainstay: not really – @NYJimbo was quoting the OP's introductory post.

Pity, because the OP raises a couple of interesting points, not least, why having huge hard drives is a bad idea from a recovery and backup point of view.

 

[lcoughey]

Sounds like it is beyond ddrescue. You should contact a data recovery pro, assuming that the data is worth at least $350 CAD. There is a list of trusted data recovery labs in the resources section.

 

[coffee]

Actually, To recover the files he used the right program but used it the wrong way.

Do a recovery on the single partition that holds the filesystem.

dd if=/dev/sda2 of=/home/user/windows.iso conv=sync,noerror

dd'ing a whole drive you will not be able to mount it because it consists of multiple partitions then.

 

[trevm999]

Sounds like the donor drive wasn't quite standard size, usually happens with refurbished drives. What I would do is DO connect it to Windows and get it to try and repair the filesystem. Alternatively you could use a data recovery program to try and piece together the raw data into files.

 

[bgrove77]

You can try to run ddrescue on the drive image you created. I know you mentioned that it would be missing 347, but those files could be system files that are not usually what your trying to recover.
If you run ddrescue again on the drive cloan, you will want to image it to your 4TB drive. Make sure you use ddrescue to make a disk image file rather than just cloan one drive to another. After you have successfully imaged the drive to a file, you should be able to mount that disk image in any windows machine and browse. I use osfMount.

To write to a disk image file my command looks something like this:
ddrescue -v -n /dev/sda /dev/sdb/driveImage.dd /dev/sdb/driveLog.txt

 

[Porthos]

You can try to run ddrescue on the drive image you created. I know you mentioned that it would be missing 347, but those files could be system files that are not usually what your trying to recover.
If you run ddrescue again on the drive cloan, you will want to image it to your 4TB drive. Make sure you use ddrescue to make a disk image file rather than just cloan one drive to another. After you have successfully imaged the drive to a file, you should be able to mount that disk image in any windows machine and browse. I use osfMount.

To write to a disk image file my command looks something like this:
ddrescue -v -n /dev/sda /dev/sdb/driveImage.dd /dev/sdb/driveLog.txt

That person"not a tech" has gone long ago and wont ever see this.

And posting just to reach a post count is frowned upon. Digging up old threads, Not too good either

 

[bgrove77]

That person"not a tech" has gone long ago and wont ever see this.

And posting just to reach a post count is frowned upon. Digging up old threads, Not too good either

Actually, this post popped up for me on the first page under the Linux forum. Looked like something i could contribute to, so i did. I didn't really check the dates, thinking that a post displayed in this position, would be pretty current. On top of that, the string is not closed. Wouldn't you think that if we weren't supposed to comment then the string would be closed?

What, in my post, makes you think that I was "posting just to reach a post count"? Does it look like i didn't read the whole string? Is my response somehow not inline with what the OP asked?

I certainly didn't "dig up" this thread, I'm so new to this site that i haven't even done a search yet.

Is this community not allowed to reply to people who are "not a tech"? How is that determined?

I hope your post is not indicative of how this community works. I don't appreciate being scolded for something that I didn't do, like digging up threads and posting just to reach a post count.

I like getting feedback, even constructive criticism, however I don't feel like your response was warranted, especially in how you presented it.

 

[Porthos]

From the forum rules when you signed up...

No End Users
These forums are for either current computer technicians, or soon to be computer technicians. We do not provide computer help to any non-technicians.


It takes a certain post count to see hidden forums and people just post to get there.
Might want to look at the dates on threads before posting. (we have ALL made that mistake.)

Sorry you feel scolded. But from your intro you are not a tech either. It is up to the Mods to decide if you are eligible to be here.

 

[bgrove77]

Looks like i met the TechNibble hall monitor. If the mods need more information about me, I'll be happy to oblige.

 

[Porthos]

I can only go by the intro. If you qualify I will apologize in advance.
http://www.microimagingsource.com/ is not a computer repair company.

Looks like i met the TechNibble hall monitor

And we all watch out for the integrity of this forum.

 

[trevm999]

It might not be a computer repair company, but they look like they provide IT services to me.
And with experience with LabTech and 3CX phone systems, it looks like he's a enough of a tech to me.
I don't think it is a bad thing to broaden the knowledge available from these forums. He might have some specialized knowledge that will be very handy some day.

 

[Kitten Kong]

Although the website itself is not tech related (as we would class it), they do have a managed IT division, which is tech related (as we class it). Therefore under the forum rules, @bgrove77 is a welcome member.

 

[Porthos]

I will apologize in advance.

Although the website itself is not tech related (as we would class it), they do have a managed IT division, which is tech related (as we class it). Therefore under the forum rules, @bgrove77 is a welcome member.

See enough said. And welcome to Technibbble.