d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
Still stuck, no idea how to proceed. Google returned information on the "drive busy" error, but none of the commands mentioned worked 
GNU ddrescue, ridiculous learning curve
- Thread starter d3v
- Start date
codegreen
Well-Known Member
- Reaction score
- 34
- Location
- New Brunswick, Canada
Linux can't unmount a disk when it's in use, such as when your current working directory is on the disk. Type "cd /", then "sudo umount /dev/sdb1" (or replace with whatever drive you mounted; use "df" to check if not sure).
I've never tried it. Most disk imaging software is designed for backup, and is not suitable for data recovery. However, this software features include a "SafeRescue" mode. It has a limited functionality free version, so it might be worth testing for future jobs.
d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
You have saved me once again. I'm now fully unmounted and and awaiting my next orders. Can I exit ddrescue and reboot in to windows now? Or must I do execute other commands or anything??
How do I use this image file? Is it like an ISO that I can see the recovered files in all their glory or is it in some sort of RAW format that requires extra work??
How do I use this image file? Is it like an ISO that I can see the recovered files in all their glory or is it in some sort of RAW format that requires extra work??
Galdorf
Well-Known Member
- Reaction score
- 501
- Location
- Ontario, Canada
Its pretty simple really with hdclone pop in the rescue cd hook up an external drive or remove the drive and put it on bench computer run hdclone say no to try to recover data on bad sectors, create a standard image file load up f-studio or similar recovery software mount or run recovery on image.
For recovery of data where bad sectors are there is really no software suitable for that you need hardware like deepspar disk imager it's about $2000-$3000 dollars.
There is a course you can take from myharddrivedied.com they give you manuals,videos and tools and some software its $3000.
Distance Learning Kit hardware list
1x Book that is the Lecture and Slides used in the class, also includes 20 labs.
1x Head Platter Replacement Tool that includes a Lab Bench Stand,
1x 3.5” Platter tool,
1x 2.5” Platter tool,
1 Magnetic Voice Coil removal tool.
1x Set of Screwdrivers that includes Torx drivers necessary for small hard drives from T4-T8 for 2.5 in hard drives.
1x Set of Screwdrivers that includes Philips and Flathead drivers needed for small hard drives.
1x Set of MP3’s that includes 40 hours of class that can be used in mobile players or computer, or car CD player.
4x Hard drives for practice and are the items used in the class room and on the Videos. 1x Set of Straws, Post It Notes, Plastic for Head Assemblies
1x USB hard drive connector that includes 2.5”, 3.5” and SATA connectors
1x Fine Metal Tweezers
1x Static Mat
1x Set of Static Gloves
2x Bootable CDs with additional Software
1x Flash Memory Stick with Special Format for Discovery in the Class
1x Voucher for the Certification Test
1x Set of Videos of how to use the DeepSpar Disk Imager and the Forensic Disk Imager.
Distance Learning Kit software list
The software and licenses for the recovery software that will be your property for the items designed for the class and are taught in the manual. It will include licenses of
R-Studio,
R-Studio for Linux,
Runtime GetDataBack NTFS,
Disk Explorer for NTFS,
GetDataBack for Fat,
DiskExplorer for Fat,
Raid Reconstructor,
Captain Nemo Pro,
SpeedClone 2003
And copies of these other great packages:
Victoria,
MHDD,
TestDisk,
FTK Imager,
HFS Explorer as well as 20 others I have collected.
Video and Audio
1x Set of High Quality Videos and MP3 audio recordings of the classes. It is an actual video of the class with all 40 hours.
Mentoring
The ability to converse with Scott Moulton via email to help mentor and answer specific questions.
Data Recovery Expert Certification
After passing the certification exam with a 70 or better, you will also be sent a high quality sealed certification for framing. If you fail the certification exam, you can retake the exam for $50.
$3000 might sound like alot at first but if there are no data recovery companies where you live like where i am, i make quite a bit of money doing data recovery as long as the drive is visible i can recover data.
For recovery of data where bad sectors are there is really no software suitable for that you need hardware like deepspar disk imager it's about $2000-$3000 dollars.
There is a course you can take from myharddrivedied.com they give you manuals,videos and tools and some software its $3000.
Distance Learning Kit hardware list
1x Book that is the Lecture and Slides used in the class, also includes 20 labs.
1x Head Platter Replacement Tool that includes a Lab Bench Stand,
1x 3.5” Platter tool,
1x 2.5” Platter tool,
1 Magnetic Voice Coil removal tool.
1x Set of Screwdrivers that includes Torx drivers necessary for small hard drives from T4-T8 for 2.5 in hard drives.
1x Set of Screwdrivers that includes Philips and Flathead drivers needed for small hard drives.
1x Set of MP3’s that includes 40 hours of class that can be used in mobile players or computer, or car CD player.
4x Hard drives for practice and are the items used in the class room and on the Videos. 1x Set of Straws, Post It Notes, Plastic for Head Assemblies
1x USB hard drive connector that includes 2.5”, 3.5” and SATA connectors
1x Fine Metal Tweezers
1x Static Mat
1x Set of Static Gloves
2x Bootable CDs with additional Software
1x Flash Memory Stick with Special Format for Discovery in the Class
1x Voucher for the Certification Test
1x Set of Videos of how to use the DeepSpar Disk Imager and the Forensic Disk Imager.
Distance Learning Kit software list
The software and licenses for the recovery software that will be your property for the items designed for the class and are taught in the manual. It will include licenses of
R-Studio,
R-Studio for Linux,
Runtime GetDataBack NTFS,
Disk Explorer for NTFS,
GetDataBack for Fat,
DiskExplorer for Fat,
Raid Reconstructor,
Captain Nemo Pro,
SpeedClone 2003
And copies of these other great packages:
Victoria,
MHDD,
TestDisk,
FTK Imager,
HFS Explorer as well as 20 others I have collected.
Video and Audio
1x Set of High Quality Videos and MP3 audio recordings of the classes. It is an actual video of the class with all 40 hours.
Mentoring
The ability to converse with Scott Moulton via email to help mentor and answer specific questions.
Data Recovery Expert Certification
After passing the certification exam with a 70 or better, you will also be sent a high quality sealed certification for framing. If you fail the certification exam, you can retake the exam for $50.
$3000 might sound like alot at first but if there are no data recovery companies where you live like where i am, i make quite a bit of money doing data recovery as long as the drive is visible i can recover data.
Last edited:
d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
It's certainly a lucrative market that's for sure, but there's no way in hell I could afford $3000. I barely get any work, in fact the two jobs yesterday ended a full two week dry spell. I regulary go without work for 2-3 weeks. The past year has been terrible for me!
I intend to learn ddrescue further, so that I will be able to accept more data recovery work. This learning package does look like a properly thought-out course and the kit you get looks top notch, but I don't think I'll EVER make enough money to afford the $3000 price tag.
I intend to learn ddrescue further, so that I will be able to accept more data recovery work. This learning package does look like a properly thought-out course and the kit you get looks top notch, but I don't think I'll EVER make enough money to afford the $3000 price tag.
Last edited:
d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
Ok I exited the ddrescue terminal becuase I badly needed the use of the PC. As soon as I booted in to Windows I checked for the hdimage.img and rescue.log files and sure enough they are there in the root of my primary hard drive.
Now I just need to be able to open and navigate hdimage.img to be able to actually extract this guys files! I was hoping UltraISO would open the file, but did not work
I will wait for codegreen
Now I just need to be able to open and navigate hdimage.img to be able to actually extract this guys files! I was hoping UltraISO would open the file, but did not work
I will wait for codegreen
Galdorf
Well-Known Member
- Reaction score
- 501
- Location
- Ontario, Canada
Ok I exited the ddrescue terminal becuase I badly needed the use of the PC. As soon as I booted in to Windows I checked for the hdimage.img and rescue.log files and sure enough they are there in the root of my primary hard drive.
Now I just need to be able to open and navigate hdimage.img to be able to actually extract this guys files! I was hoping UltraISO would open the file, but did not work
I will wait for codegreen
You need to either mount the image or have a data recovery software that can run recovery on the image.
for free you could try Data Disc Recovery or
PC Inspector File Recovery i use this software seems to be the best free software.
Last edited:
codegreen
Well-Known Member
- Reaction score
- 34
- Location
- New Brunswick, Canada
Linux can mount such images directly. However, you'll probably do better to use Windows-based tools from this point on, especially since you need to use your computer for other things. 
Before doing anything with the image, make a copy of it. Do any recovery work from the copy; don't touch the original. The reason is, if you mess up in your recovery efforts, you simply make another copy from the original and try again. If you work directly from the original image, any mistakes will force you to take another image from the failing drive. Save yourself a world of hurt and work only from a copy.
Windows can't mount imaged filesystems directly. You'll need additional software to do it. OSFMount is a free utility that should do the trick. Virtual CloneDrive is pretty popular, but it is primarily meant for mount ISO files; I'm not sure how well it handles raw drive images.
Once you have the image copy mounted, you can proceed with file recovery. You can safely run chkdsk now, since if chkdsk trashes the filesystem, you can just make another copy of the image and try something else. If you're not able to copy files off using standard Windows methods, you'll have to try some kind of file/partition recovery software. I do most of my data recovery in Linux, so I can't really offer much help past this point. R-Tools seems to be highly regarded around here, but it's not free. Search the forums for previous discussions. However, watch out for this article. It gives a lot of advice I would consider... questionable, at best.
Good luck, and let us know how it turns out!
Before doing anything with the image, make a copy of it. Do any recovery work from the copy; don't touch the original. The reason is, if you mess up in your recovery efforts, you simply make another copy from the original and try again. If you work directly from the original image, any mistakes will force you to take another image from the failing drive. Save yourself a world of hurt and work only from a copy.
Windows can't mount imaged filesystems directly. You'll need additional software to do it. OSFMount is a free utility that should do the trick. Virtual CloneDrive is pretty popular, but it is primarily meant for mount ISO files; I'm not sure how well it handles raw drive images.
Once you have the image copy mounted, you can proceed with file recovery. You can safely run chkdsk now, since if chkdsk trashes the filesystem, you can just make another copy of the image and try something else. If you're not able to copy files off using standard Windows methods, you'll have to try some kind of file/partition recovery software. I do most of my data recovery in Linux, so I can't really offer much help past this point. R-Tools seems to be highly regarded around here, but it's not free. Search the forums for previous discussions. However, watch out for this article. It gives a lot of advice I would consider... questionable, at best.
Good luck, and let us know how it turns out!d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
THANK YOU SOO MUCH!
I just mounted the image in OSForensics and can now navigate and copy all the files perfectly, thank god there dosn't seem to be any need for a filesystem repair or any other further hassle.
I'm just transfering his massive 50GB user account so I hope it transfers ok without error!!
Will keep updated!!
edit: ALL DONE! Transfer was flawless.
Massive thanks to codegreen. If you lived closer I'd cook you one of my my speciality chicken korma's, but instead I will put in a reccomendation to the vatican that you be no less than sainted. This should be a sticky becuase I would imagine this would be very usful for a lot of us here!
I just mounted the image in OSForensics and can now navigate and copy all the files perfectly, thank god there dosn't seem to be any need for a filesystem repair or any other further hassle.
I'm just transfering his massive 50GB user account so I hope it transfers ok without error!!
Will keep updated!!
edit: ALL DONE! Transfer was flawless.
Massive thanks to codegreen. If you lived closer I'd cook you one of my my speciality chicken korma's, but instead I will put in a reccomendation to the vatican that you be no less than sainted. This should be a sticky becuase I would imagine this would be very usful for a lot of us here!
Last edited:
codegreen
Well-Known Member
- Reaction score
- 34
- Location
- New Brunswick, Canada
d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
Good idea, this is a life saver for us Windows user's.
Galdorf
Well-Known Member
- Reaction score
- 501
- Location
- Ontario, Canada
Most forensic software has an imager that is capable of creating an image while skipping the bad sectors allowing for data recovery, most are free here is a list.
FTK Imager part of ftk forensics
OSForensics
Guymager
for mounting images:
OSFmount
P2 eXplorer Free
Other useful tools:
Encrypted Disk Detector
Live View
FTK Imager part of ftk forensics
OSForensics
Guymager
for mounting images:
OSFmount
P2 eXplorer Free
Other useful tools:
Encrypted Disk Detector
Live View
d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
thanks Galdorf, I'll bookmark them links in my data recovery folder.
Here's a rough guide that I made by consolidating codegreen's advice throught this thread. This will be essential for a Windows user with minimal Linux knowledge like myself!
1. SELECTING DRIVES
-----------------------------
Connect the faulty drive to your PC, boot to ddrescue then type the following commands to determine the designation ddrescue has assigned to all your connected storage devices
sudo fdisk -l
sudo df
I can give you more specific help once I see that info. You have to be very careful to write the data to the right place. In Linux, you do not write files to a raw storage device (like /dev/sda), but to a mounted filesystem.
2. MOUNTING
-------------------
OK. Now you need to mount one of your internal drives so that Linux can write the image file to it. So, if you want to write the file to a folder on your 640 GB drive:
sudo mkdir /media/storage
sudo mount -t ntfs-3g /dev/sdb1 /media/storage
Linux can now write to your 640gb drive. Change /dev/sdb1 with /dev/sda2 if you want to write to a folder on the 500 gb drive instead.
cd /media/storage
ls
You should see the list of folders on the drive. Use the "cd" command to move to the folder you want to save the rescue image and log file to. Use "mkdir" to create a new folder if needed. Once you're in the right place:
3. DATA RECOVERY
----------------------------------
ddrescue /dev/sdc hdimage.img rescue.log
Let that run its course, and then:
ddrescue -d -r3 /dev/sdc hdimage.img rescue.log
I saw that fdisk is throwing an error trying to read the partition table on the damaged drive. However, the drive itself is beng recognized. ddrescue does a sector-by-sector copy and doesn't work with the filesystem, so it may be able to get an image. You'll still have to do filesystem recovery after that.
if you do get the image, and you need help mounting it and recovering files and/or partitions, let me know.
PLEASE NOTE: ddrescue is very powerful, but also dangerous. It is possible to overwrite your own data if you are not careful. I'm happy to help, but I can't take any responsibility if things don't go as planned.
UNMOUNTING
---------------------------
Originally Posted by d3v
I've just tried to unmount the drive that the clone was saved to, but was told it was busy and could not unmount, no idea what to do now, will check google while awaiting response here.
Linux can't unmount a disk when it's in use, such as when your current working directory is on the disk. Type "cd /", then "sudo umount /dev/sdb1" (or replace with whatever drive you mounted; use "df" to check if not sure).
Linux can mount such images directly. However, you'll probably do better to use Windows-based tools from this point on, especially since you need to use your computer for other things.
Before doing anything with the image, make a copy of it. Do any recovery work from the copy; don't touch the original. The reason is, if you mess up in your recovery efforts, you simply make another copy from the original and try again. If you work directly from the original image, any mistakes will force you to take another image from the failing drive. Save yourself a world of hurt and work only from a copy.
Windows can't mount imaged filesystems directly. You'll need additional software to do it. OSFMount is a free utility that should do the trick. Virtual CloneDrive is pretty popular, but it is primarily meant for mount ISO files; I'm not sure how well it handles raw drive images.
Once you have the image copy mounted, you can proceed with file recovery. You can safely run chkdsk now, since if chkdsk trashes the filesystem, you can just make another copy of the image and try something else. If you're not able to copy files off using standard Windows methods, you'll have to try some kind of file/partition recovery software. I do most of my data recovery in Linux, so I can't really offer much help past this point. R-Tools seems to be highly regarded around here, but it's not free. Search the forums for previous discussions. However, watch out for this article. It gives a lot of advice I would consider... questionable, at best.
Good luck, and let us know how it turns out!
Here's a rough guide that I made by consolidating codegreen's advice throught this thread. This will be essential for a Windows user with minimal Linux knowledge like myself!
1. SELECTING DRIVES
-----------------------------
Connect the faulty drive to your PC, boot to ddrescue then type the following commands to determine the designation ddrescue has assigned to all your connected storage devices
sudo fdisk -l
sudo df
I can give you more specific help once I see that info. You have to be very careful to write the data to the right place. In Linux, you do not write files to a raw storage device (like /dev/sda), but to a mounted filesystem.
2. MOUNTING
-------------------
OK. Now you need to mount one of your internal drives so that Linux can write the image file to it. So, if you want to write the file to a folder on your 640 GB drive:
sudo mkdir /media/storage
sudo mount -t ntfs-3g /dev/sdb1 /media/storage
Linux can now write to your 640gb drive. Change /dev/sdb1 with /dev/sda2 if you want to write to a folder on the 500 gb drive instead.
cd /media/storage
ls
You should see the list of folders on the drive. Use the "cd" command to move to the folder you want to save the rescue image and log file to. Use "mkdir" to create a new folder if needed. Once you're in the right place:
3. DATA RECOVERY
----------------------------------
ddrescue /dev/sdc hdimage.img rescue.log
Let that run its course, and then:
ddrescue -d -r3 /dev/sdc hdimage.img rescue.log
I saw that fdisk is throwing an error trying to read the partition table on the damaged drive. However, the drive itself is beng recognized. ddrescue does a sector-by-sector copy and doesn't work with the filesystem, so it may be able to get an image. You'll still have to do filesystem recovery after that.
if you do get the image, and you need help mounting it and recovering files and/or partitions, let me know.
PLEASE NOTE: ddrescue is very powerful, but also dangerous. It is possible to overwrite your own data if you are not careful. I'm happy to help, but I can't take any responsibility if things don't go as planned.
UNMOUNTING
---------------------------
Originally Posted by d3v
I've just tried to unmount the drive that the clone was saved to, but was told it was busy and could not unmount, no idea what to do now, will check google while awaiting response here.
Linux can't unmount a disk when it's in use, such as when your current working directory is on the disk. Type "cd /", then "sudo umount /dev/sdb1" (or replace with whatever drive you mounted; use "df" to check if not sure).
Linux can mount such images directly. However, you'll probably do better to use Windows-based tools from this point on, especially since you need to use your computer for other things.
Before doing anything with the image, make a copy of it. Do any recovery work from the copy; don't touch the original. The reason is, if you mess up in your recovery efforts, you simply make another copy from the original and try again. If you work directly from the original image, any mistakes will force you to take another image from the failing drive. Save yourself a world of hurt and work only from a copy.
Windows can't mount imaged filesystems directly. You'll need additional software to do it. OSFMount is a free utility that should do the trick. Virtual CloneDrive is pretty popular, but it is primarily meant for mount ISO files; I'm not sure how well it handles raw drive images.
Once you have the image copy mounted, you can proceed with file recovery. You can safely run chkdsk now, since if chkdsk trashes the filesystem, you can just make another copy of the image and try something else. If you're not able to copy files off using standard Windows methods, you'll have to try some kind of file/partition recovery software. I do most of my data recovery in Linux, so I can't really offer much help past this point. R-Tools seems to be highly regarded around here, but it's not free. Search the forums for previous discussions. However, watch out for this article. It gives a lot of advice I would consider... questionable, at best.
Hi All You Saints
a month ago, my 1.5TB HDD went mad = became RAW, was making noises...etc
oh happy me!!
my life was in there (photos and videos of my family, my mariage, my sons...my life I told you)
no windows based software was able to save my data (get data back...etc)
Check dsk was useless, Tesdisk : same thing
and I found this forum
And the light was
Since last Friday (10th feb 2012 night) I'm running, god bless it, DDrescue!
Even if I'm quite confident, I ask my self : is it normal that it takes all this time? 4 days running, and only half way to do the job!
well I know, 1.5TB is not little, but ...
I'll Join to this reply a screen shot oh my pc screen (taken yesterday)
so my questions, if I may ask, are:
1- Is it normal to take all this time?
2- Is the size of errors alarming?
3- If one of you was a medium: Am I having any chance to recover my presious data?
even if I do not have answers to all these questions, I want to thank you all for the great help I found here!
so ThnX
NeMo
a month ago, my 1.5TB HDD went mad = became RAW, was making noises...etc
oh happy me!!
my life was in there (photos and videos of my family, my mariage, my sons...my life I told you)
no windows based software was able to save my data (get data back...etc)
Check dsk was useless, Tesdisk : same thing
and I found this forum
And the light was
Since last Friday (10th feb 2012 night) I'm running, god bless it, DDrescue!
Even if I'm quite confident, I ask my self : is it normal that it takes all this time? 4 days running, and only half way to do the job!
well I know, 1.5TB is not little, but ...
I'll Join to this reply a screen shot oh my pc screen (taken yesterday)
so my questions, if I may ask, are:
1- Is it normal to take all this time?
2- Is the size of errors alarming?
3- If one of you was a medium: Am I having any chance to recover my presious data?
even if I do not have answers to all these questions, I want to thank you all for the great help I found here!
so ThnX
NeMo
Attachments
codegreen
Well-Known Member
- Reaction score
- 34
- Location
- New Brunswick, Canada
Hi All You Saints
Not saints, just technicians.
The Technibble forums are for technician to technician conversations; this isn't a place for end users to get support. However, some quick answers...No. Normally, ddrescue skips unreadable sectors and continues on. the "-r 3" option you used has ddrescue retrying each unreadable sector three times before moving on. You don't want to do this for a first pass.
Yes. Sadly, your drive seems badly damaged.
Hard to say. You may want to stop your efforts and look into professional data recovery services. Or, you could try this forum for some end-user help.
OK OK
even if I'm not a Pro Technician, I love solving by my own my problems...
of course, if it's not possible, I'm refering to a "real" pro...
I know there is little chance to recover "all" my data, my hope is to save the maximum
well, Thanks any way,
I'll try to keep you informed
even if I'm not a Pro Technician, I love solving by my own my problems...
of course, if it's not possible, I'm refering to a "real" pro...
I know there is little chance to recover "all" my data, my hope is to save the maximum
well, Thanks any way,
I'll try to keep you informed
parker.casey
New Member
- Reaction score
- 2
- Location
- Washington State
I'm trying to image a badly damaged 3.5" SATA hard drive using the free Ubuntu Rescue Remix 11.5 live CD and have printed off all the DD rescue documentation and have the thing running in a virtual machine for practice, but there's not a single damm word on how one would actually list all devices and paritions connected the the PC.
Why would such a basic and fundamentally important step not be covered in the literature? This is why I never bothered to learn Linux becuase it's shell commands fetish and the program makers' infuriating habbit of only telling you half of what you need to know is downright bloody ridiculous, why the hell havn't they developed a UI yet? ARRRRRRRGH so infuriating
No GUI because GUI's add a bunch of requirements to a program. It's meant to be able to be scripted and whatnot.
Basically, Linux was intended for the server market. If you need a monitor, keyboard, and mouse to work with a server, you need a desktop instead.
d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
Good to see this thread is getting use, thanks to codegreen. I don't think there is another guide on ddrescue as good as this thread!
Ok I'm in need of some advise on what to do with this data rescue from a friends SD flash card!
I took this photo when it was 8 hours in to the ddrescue recovery process and as you can see if you follow the commands I typed, it's not even past the first stage of recovery. This morning it has been running for 18 hours and STILL absolutely no data has been rescued.
The SD card is connected to the PC via a Hama 35 in 1 card USB 2.0 card reader...
And the screen photo...
Should I let it continue to run in the hope it will eventually start to recover data or should I pull the plug and declare it a fail??
Ok I'm in need of some advise on what to do with this data rescue from a friends SD flash card!
I took this photo when it was 8 hours in to the ddrescue recovery process and as you can see if you follow the commands I typed, it's not even past the first stage of recovery. This morning it has been running for 18 hours and STILL absolutely no data has been rescued.
The SD card is connected to the PC via a Hama 35 in 1 card USB 2.0 card reader...
And the screen photo...
Should I let it continue to run in the hope it will eventually start to recover data or should I pull the plug and declare it a fail??
Last edited:
d3v
Member
- Reaction score
- 8
- Location
- Nottingham, UK
Ok nearly 24 hours and still 0 bytes recovered. Should I pull the plug, try something different, or what?