RSS Feed

The way of data recovery


Beginning

Recently, I accidentally dropped down my 320G USB external hard disk. This make me very sad. Because I got some precious data in the hard disk. The hard disk is unable to be detected on Windows 7. Then I tried to connect with two USB ports to provide more power to the hard disk, hopefully it was detectable. Yes, it was detected. Then I immediately used

CHKDSK /v /f /x f:

This was to hope to fix any file system problem. Then I went to sleep. Late in the night, I found that the CHKDSK was not responding, and the hard disk was stop operating. Unplugged the hard disk, and shut down computer. So, I knew that it was really a bad sign.

Linux

Next day, I boot into the Linux, and tried to use USB 3.0 port for the connection, thinking that it might provide more power for the hard disk. Right, it was detectable with the USB 3.0 port. Then, I mounted the hard disk and preparing to copy out the data. Now, copying the data did not work well, because the hard disk might stop operating and undetectable suddenly. So, I failed to copy out all the files. Then I looked for a better solution.

Unstoppable copier

I found a software, that is unstoppable copier. At first, I found that it was not bad. Because it will automatically skip the unreadable file and continue the copying. However, the problem of hard disk undetected was still existed. As a result, unstoppable copier did not work also.

(Note about unstoppable copier for Linux. The time stamp of the files are not copied with the original time stamp, but I am not sure about Windows version. This will cause the problem, if we want to do the synchronization in the future. Meaning that, if we copy out a corrupted file, since the time stamp is newer, this will overwrite the older file during the synchronization.)

safecopy: partition only

So, I tried for alternative, that was “safecopy“. This is a low level copying utility. By using this, I needed a hard disk greater than the 320G, so that it can copy the whole data to the location. At first, I entered

sudo safecopy /dev/sdb1 data.img --stage1

This was to copy the partition to a file called data.img.

However, at around 93%, then there is a message something like “cannot read from source”. Because, again, hard disk was not detected. Then, I tried to mount this partially recovered image, but failed.

safecopy: whole hard disk

Next, I tried to enter

sudo safecopy /dev/sdb data.img --stage1

This was to copy the whole hard disk to a file called data.img.

Yeah. With this command, I was able to copy the whole hard disk to the image file with 100% done. Then, the next problem was coming. I was not able to mount the image file. So, I posted the question to unix.stackexchange.com.

Mounting

To mount the file, firstly, I used

fdisk -lu data.img

to see the hard disk image partition. Then, it produced,

Disk data.img: 310.8 GB, 310798626816 bytes
255 heads, 63 sectors/track, 37785 cylinders, total 607028568 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xb1bec32c

   Device Boot      Start         End      Blocks   Id  System
data.img1              63   625137344   312568641    7  HPFS/NTFS/exFAT

From here, I thought that everything should be okay. But I failed to mount the partition. I mounted with this command,

sudo mount -o loop,offset=32256 -t ntfs data.img /mnt/temp

This mount the NTFS partition from the hard disk image with offset 32256. This 32256 comes from 512*63.

Then, the following output was produced,

Failed to read last sector (625137281): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Then, I thought it was partition problem.

Partition problem

Continue to read from other resources for data recovery of NTFS, some mentioned about using parted command, I tried. But it could not print the partition of the hard disk image. That means, the hard disk image has some problem. I then tried the testdisk. It is a tool to solve the partition problem. But I tried, yet it did not work for my case.

Some of the resources mentioned about fsck.ntfs. For your information, there is no such thing yet. Do not waste your time to search for it. They also mentioned about ntfsfix. But it did not work for me, and it will asked for CHKDSK. I also tried ntfsresize, to resize the partition, but not worked also.

Since everything point to the CHKDSK again, I tried to boot into Windows to CHKDSK the disk image, but this command does not work to the image file!

Back to Linux, I tried to use VirtualBox and installed a virtual Windows XP. Hopefully to mount the data.img as a hard disk for the virtual Windows XP, and then can use CHKDSK. But failed again upon mounting the hard disk image.

I also tried gparted with gpart to fix the drive. But failed also.

I think most of the ways, I already tried. So, if you have the similar problem as mine, tried all the utilities I mentioned above.

safecopy again

Since there was no way to mount the hard drive image, I just try to use safecopy again for stage 2. I didn’t tried it, because safecopy with 320G needs too much time for me. And I thought that it was nothing more but just recover a little more. And also, my faulty hard disk might stop operating suddenly. So, I didn’t take this step at the beginning. But then, as a last choice, safecopy again,

sudo safecopy /dev/sdb data.img --stage2

I went to sleep. Then see the result. Right, the safecopy was not completed, and stop responding, and the hard disk was stop operating. So, the worst case was, I lost most of my data. But, before giving up, try again.

sudo mount -o loop,offset=32256 data.img /mnt/temp

It works! Yes, it really works.

So, I tried to mount again with my ownership to copy out the file.

sudo mount -o loop,ro,offset=32256,uid=myusername,gid=users,umask=002,noatime data.img /mnt/temp

Hooray, safecopy! Now I am copying out the files. But, still, some files are not able to be copied. But I solve the faulty hard disk problem.

About Allen Choong

A cognitive science student, a programmer, a philosopher, a Catholic.

7 responses »

  1. Glad you got your data back. I came here looking for more information on safecopy, which is a bit dated as a utility–2009 is the last update. The tool that would be most appropriate for your whole disk imaging recovery is ddrescue (not to be confused with another similar tool, dd_rescue).

    Reply
    • Thank you for your comment. I didn’t know that ddrescue is different from dd_rescue. And I once read a post, mentioned that ddrescue (or dd_rescure, I forgot already) is slower if compared to safecopy. That is why I was using safecopy.

      Reply
  2. Great article Allen. Thank you for sharing your experiences so others may learn as well. dd_rescue (written by garloff) and ddrescue (written by Antonio) are actually different. You were reading about dd_rescue (I saw that posting as well). Although unfortunately, if you are searching for it in the Ubuntu repository, dd_rescue still appears as the ddrescue package. If installing from the repository, you actually want the gddrescue (the real ddrescue – which is about twice as fast as dd_rescue).

    https://bugs.launchpad.net/ubuntu/+source/gddrescue/+bug/161126

    http://mac.freecode.com/projects/addrescue/comments

    Reply
  3. JPII/Totus Tuus !

    -Cheers🙂

    Reply
  4. Hi … I need some advise from you. When I run the –stage1 of safecopy, then I fdisk -lu data.img, I got the following response:

    root@desktop-ubuntu:/media/sibarhm/My Book 1230# fdisk -lu data.img
    Disk data.img: 1,8 TiB, 2000398934016 bytes, 3907029168 sectors
    Units: sectors of 1 * 512 = 512 bytes
    Sector size (logical/physical): 512 bytes / 512 bytes
    I/O size (minimum/optimal): 512 bytes / 512 bytes
    root@desktop-ubuntu:/media/sibarhm/My Book 1230#

    It seems that the safecopy can’t read the partition table information from –stage1 process. Shall I proceed with –stage2 or –stage3 then?

    Reply
    • I suggest to use ddrescue. I don’t use safecopy anymore. ddrescue will just copy the whole partitions, whether they are bad or good, as long as it can be copied. Then after ddrescue, then you can try to mount or testdisk. stage2 or 3 I don’t think they will work, but you can try. Good luck.

      Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: