Take Image of Damaged Partition?

[TechguyUK]

I have a customer with a WinXP desktop which is failing to boot (no system disk etc). I booted with UBCD4Win and about the only app that could even see data on the drive was Testdisk which found a System and Recovery partition on the drive and was able to display files and folders in these partitions. My question is this...

Before I set about fixing the partitions on this drive with Testdisk, I want to take an image of the drive so that I protect the clients data and at least have something to revert back to if it all goes pear shaped. However the usual tools (Acronis / Ghost / DriveImage XML) simply don't see this drive.

Does anyone have any recommendations for what I should use for taking a low level image of the bad drive / corrupt partitions ??

 

[NYJimbo]

How software sees it sometimes is confusing. I know if I use Acronis Migrate Easy and it doesnt know what the heck it is looking at it will go sector by sector. Providing of course it can see sectors at all. If it does you get a clone of whatever it found, but its still up to you to make sense of the results.

So at the very least the drive has to be functional enough so the software can tell it to just start sucking up whatever the heck is out there. If the software is not sophisticated enough it might not "see" the drive simply because it cannot determine the format or O/S or something.

Did you try to slave it and try something like "getdataback". I know it has found entire windows installs when others could not.

 

[rogerthehart]

Use ddrescue from a Linux live distro. I use Parted Magic from usb.

Mount your usb partition for the log file.

I use the following command lines:

if the damaged drive is hda
if the new drive is hdb

step 1: ddrescue --no-split /dev/hda /dev/hdb /path/to/log/file
step 2: ddrescue --direct --max-retries=5 /dev/hda /dev/hdb /path/to/log/file
step 3: ddrescue --direct --retrim --max-retries=5 /dev/hda /dev/hdb /path/to/log/file

Do a Google search for ddrescue for more info.

 

[vdub12]

Use ddrescue from a Linux live distro. I use Parted Magic from usb.

Mount your usb partition for the log file.

I use the following command lines:

if the damaged drive is hda
if the new drive is hdb

step 1: ddrescue --no-split /dev/hda /dev/hdb /path/to/log/file
step 2: ddrescue --direct --max-retries=5 /dev/hda /dev/hdb /path/to/log/file
step 3: ddrescue --direct --retrim --max-retries=5 /dev/hda /dev/hdb /path/to/log/file

Do a Google search for ddrescue for more info.

Just dd alone could do it couldn't it?

 

[Crgky127]

Just dd alone could do it couldn't it?

Depends on the damage, some times dd would work just as well, but usually if you suspect errors you're better using ddrescue. http://www.garloff.de/kurt/linux/ddrescue/

 

[vdub12]

Depends on the damage, some times dd would work just as well, but usually if you suspect errors you're better using ddrescue. http://www.garloff.de/kurt/linux/ddrescue/

I may be reading this wrong but that page states that it does not support non-seekable in or output. So if the partition is unreadable would this still work.

 

[Laimbo]

If the drive can't be read by any software I would be trying to recover and data to a new drive asap, I agree getdataback is very good. It can detect drives even when they can't be detected by the bios!

 

[vdub12]

even when they can't be detected by the bios!

How does this work, the normal reason a drive cannot be detected is due to a bad controller and if that's the case how can the software possibly read from it?

 

[MobileTechie]

I think I'd try with dd or ddrescue first and do a sector level copy of the whole drive. If linux can't see the drive then we have problems.

 

[TechguyUK]

Thanks guys - I'm gonna give ddrescue a go later today when i've looked through the FAQ's, then have a go at repairing the partition on the bad drive. Never used ddrescue before though so I have a quick question for those that have...

Does it allow me to create an img file of the first drive on a second drive that I could then mount and work with (repair/copy files etc) or does it simply attempt to copy one drive to another, overwriting any data/partition info already on the second drive?

I just want to be sure I'm not about to nuke my 2TB backup drive that has all my other customer backups on it

 

[TechguyUK]

ok - I found my answer, if my understanding is correct, DDRescue will either make a copy of the drive/partition on an alternate drive/partition, overwriting any data already on the destination....or if you specify a destination and include a filename it will write the source drive/partition to an image file on the destination drive/partition.

example:

ddrescue -r3 /dev/hda /dev/hdb logfile ...... copy hda drive to hdb drive

hdb drive must be equal or greater than the size of hda drive

ddrescue -r3 /dev/hda /dev/hdb2/image logfile ...... create image of hda drive on hdb2 partition with filename of 'image'

hdb2 partition must be equal or greater than the size of hda disk