Thursday, October 4, 2012

Bad sector HDD data rescue effort

Goal: Recover a friends' data from an HDD (Bad sector HDD data rescue effort) which won't boot or mount due to a high number of reported "bad sectors."

Symptoms: Received a computer from a friend which had an error when trying to boot up into Windows XP Home edition.  The specific error was that Windows could not access a particular cabinet file  (I've since forgotten the error, but once I find it I will report it here).

Reason: The disk contained a library of family photos which (unfortunately) had not been backed up previously and the friend was desperate to recover the information.

Result: Successful data recovery AND in addition, the OS was successfully repaired and moved to a new HDD.  Our friends' PC is back up, running, and healthy!

HARDWARE:

  • Broken HDD:  Seagate Barracuda 7200 RPM 160 GB drive - reporting over 288 bad sectors

  • Transitional HDD: 2004 WD160GB Caviar - old but still alive and kicking for repair work.

  • New HDD with an equal or greater size as the original. (Hitachi 250GB CinemaStar)

  • 2 x External IDE to USB adapters for attaching the disk with the errors to a separate machine.

  • ASUS EEE Netbook computer running Ubuntu 10.04 Netbook Edition.

  • NEC Desktop PC dual-boot Windows XP/Ubuntu 10.04.1 Desktop (WUBI)

SOFTWARE:

  • Puppy Linux Bootable CD

  • Ubuntu 10.04 (Netbook and Desktop editions)

  • dd_rescue program (freely available in Linux)

  • Windows XP chkdsk program (part of XP install)

  • Western Digital Acronis True Image Software (Disk Utility)





PROCEDURE:


Note: All attempts to mount the volume and copy the data were unsuccessful, so I'm not going to list all the details here. I tried booting Puppy Linux and mounting - no go. Tried connecting the disk externally to a Windows machine - would hang when mounting. There were a few other efforts, but the end result was the data was not accessible using those methods.

STEP 1: Disable Automount in Ubuntu


  • Open a terminal and from the command line, type:

$ gksudo gconf-editor


  • Then navigate to "apps->nautilus->preferences" and in that window un-check the "media_automount" option.

Note: Be sure to restore that option when you finish the data recovery since it is a bit of a nuisance to have to manually mount all your removable media!

STEP 2: Install the dd_rescue program

  • Using the Netbook, I installed dd_rescue command in Ubuntu by doing the following:

$ sudo apt-get install ddrescue

STEP 3: Plug in the two drives.

  • Using the Netbook, I plugged in the two hard disks. I used two IDE to USB adapters that I bought at the local computer parts store. They were around $10 each.

Note: It doesn't matter which order you plug them in (defective first, transitional second) as long as you know which device is the damaged one and which device is the good one. We'll be copying from damaged to good.



STEP 4: Determine the device names.

  • I used GPARTED to check the devices. Since they aren't mounted, GPARTED only looks to see what the device names are and their basic information. In my case, it didn't cause any problems with the broken drive the way actually mounting it did.


  • For the sake of the documentation:

bad disk: /dev/sdb
good disk: /dev/sdc

STEP 5: Run dd_rescue

  • Now for the moment of truth. Can the drive be parsed completely and how much data have we lost?


  • Type the command (carefully) in a terminal:

$ dd_rescue /dev/sdb /dev/sdc

Note: Make sure the bad disk (in our case, /dev/sdb) is the first entry and the good disk (/dev/sdc) is the second entry.

More notes: Wait a long time. The program will show the progress in the terminal window. When it hits errors, it will try a bit to read and then skip ahead a bit. Be patient! In my case, it took almost 16 hours to complete.

One other note: You might want to set up the disks in a cooler location before you begin. I blew a fan at them near the air conditioner because they heated up quite a bit (especially the broken one).


  • Disconnect the drives when you finish.

  • Check the number of bytes that were unable to be read by the dd_rescue program.

  • In this example, I was only unable to read 1.5mb worth of 160GB drive - not very much missing there and luckily nothing too important.

STEP 6: Run chkdsk

  • Take the interim "good drive" and connect it to a machine running Windows XP.
    Run the following command on the drive:

chkdsk /f /r [drive letter:]


  • This should report and repair the file system.

  • From this point I could see and copy all of my friends' important data.

  • I moved it to a secondary backup drive with which they provided me.

  • MISSION ACCOMPLISHED!!!





RESTORING THE OS:


I could have stopped my efforts at STEP 6 because the mission was essentially accomplished and the data had been recovered. But then my friends would have had no working computer.  Since it was a hand-me-down computer, they also had no accompanying reinstall disks. So the next part tells how I got them back up and running.

FINAL STEPS: Move the data to a nice new (and slightly bigger) disk

  • I tried the interim drive in the computer, and I was able to boot up nicely.

  • However, a scan of the drive using Puppy Linux boot CD and GPARTED showed that the bad sectors were still being reported.

  • In this case the bad sectors were still mapped out by the drive even though the data was now intact.

  • As far as I understand it (which isn't very far) this can only be fixed by either using manufacturer software or by reformatting completely.

  • Downloaded Acronis True Image which is the (free) software for Western Digital drives.

  • Using the tool, I copied the drive image from the interim drive to the new 250GB drive.

  • Acronis lets you resize the partitions you are copying.

  • The new drive (when installed) reported back no bad sectors.

A happy ending!  The look on my friends' face was worth seeing when they received their broken computer back fully functional with all the data recovered!

1 comment:

  1. Note: not a lot of people mention this, and it's very very very important! i racked my brain with NTFSclone trying to figure out which way it was, so I wouldn't overwrite the data.
    which is reversed as in...
    (# ntfsclone --overwrite "destination GOOD" "source BAD")


    "Note: Make sure the bad disk (in our case, /dev/sdb) is the first entry and the good disk (/dev/sdc) is the second entry."

    ReplyDelete