Help Retrieving Data

Forum: Other Help Topics
Topic: Help Retrieving Data
started by: clivesay

Posted by clivesay on Sep. 30 2004,12:45

All -

I am posting here in desperation.

I have a lady that called me the other night in a panic because her WinNT box would not boot. The hard drive had the dreaded clicking death rattle. Of course, she has financial information on the HD with no backup. I went to investigate armed with a DSL CD and my 512mb usb drive to see if I could pull her file. The clicking is intermittent so I was able to get fstab to recognize the hda1 and hda5 partitions but I could not mount them. I put this HD in four different PC's with some recognizing and some not.

My question...is there any hope without her sending away to a data recovery company? I did some googling and tried some of the mount switches but haven't had any luck. This is my first experience with data recovery like this so I would appreciate if anyone has any words of wisdom.

Thanks

Chris

Posted by cbagger01 on Sep. 30 2004,14:08

You could clone the entire hard drive or better yet just the partition.

You can clone it to another hard drive, or you can output the contents to a filename

If you use the "dd" command, make sure to use the noerror AND sync options so that it will continue properly after the disk controller hits a bad sector.

Here is the man page for dd:

< http://www.die.net/doc/linux/man/man1/dd.1.html >

Also, you could grab an alternative program called "dd_rescue" which is designed for the cloning of hard drive data for a damaged hard drive. I believe that this program is included with knoppix, or you could grab it and put it in DSL. Who knows, maybe it is already there.

dd_rescue works almost the same way as the regular dd command, only it is much faster because it copies large chucks of data until it hits an error block. Then it starts copying small chunks of data near the error area so that it can recover as much "good" data as possible. So you get the advantages of FAST reading of the "good" parts of the drive with large block size AND precise recovery of data near the bad sector with small block size.

If you have recovered the data to a file, you should be able to access it something like this (as 'root'):

mkdir /mnt/baddisk
mount -t ntfs -o loop /home/dsl/badimagefilename /mnt/baddisk
emelfm /mnt/baddisk

I wish I could go into more details about the dd/dd_rescue process but I am short on time. The previous discussions on hard drive cloning are a good place to start.

Posted by clivesay on Sep. 30 2004,14:58

Thanks, CB.

Wouldn't I have to have the partition mounted first to use dd? That is my real problem. The two partitions (hda1, hda5) show up (sometimes) under /mnt but I cannot get them to mount using mount /dev/hda1.

Chris

Posted by ke4nt1 on Sep. 30 2004,15:04

Chris..
This may be redundant, but you do mean

" mount /dev/hda1 /mnt/hda1 "

when you type

" mount /dev/hda1 "

Right ??

73
ke4nt

Posted by clivesay on Sep. 30 2004,15:17

Yeah, Ke4nt. I guess I should be more specific. :;):

It's been frustrating. You know that old saying....so close yet so far away......

I had the HD in 4 different PC's with some detecting it and some not.

I can get fdisk to recognize at times but trying to access give me an invalid drive error.

It may be a hopeless cause but it's a challenge I am trying to see if I can conquer.

Take care

Chris

Posted by cbagger01 on Sep. 30 2004,16:27

Nope

You don't need to mount the filesystems in order to do a "dd" on them.

However, your best bet is to do your "dd" command with the hard drive plugged into a computer that can recognize the partition table.

The "dd" and the "dd_rescue" command is a direct device dump to a file or second device, so mounting the filesystem that you are trying to dump is bad. Actually, you shouldn't have your device mounted if you are trying to do a device dump of it.

Keep in mind that if your critical filesystem-related sectors of your dd imagefile are corrupted then you may have some difficulty in mounting the imagefile. This is why you should do your dump on the computer that plays nicest with this hard drive.

Also, hard drive corruption can be a continuing process so your best option is to do a backup before things get any worse. And doing multiple reads on a failing hard drive can make things worse depending on what type of failure that you are experiencing.

Good Luck.