Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 2 of 2
  [ 30 posts ]  Go to page Previous  1, 2
  Previous topic | Next topic 
Author Message
syntaxerror
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: November 21st, 2015, 17:45 
Offline

Joined: September 17th, 2012, 13:42
Posts: 61
Location: Europe
RAW is about what is 'Deep Search' in TestDisk (Linux). It's a file-system-independent search. When setting search to 'NTFS' it will search for typical specialties like the MFT (Master File Table) and try to benefit from the structure of the NT File System to the fullest.
RAW search may sometimes help to get the real valuable data out of the cylinders; because whenever the NTFS partition detected is rather a bogus one, the structure may be OK but nothing but barely useable data junk would be found. (Guess what; I'm speaking from own experience.)
Top
 Profile  
 
fzabkar
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: November 21st, 2015, 19:44 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
@n0harm, as I suspected, the external drive is using 4KB sectoring -- "MBR (4K)". This means that the cloned image will probably not be a genuine clone. :-(

Moreover, you appear to have reinitialised your external clone and created a single 4TB FAT32 partition with 4KB sectoring. Hopefully you have not also formatted this new partition. :-(

My suggestion would be to stop what you are doing and examine the file system structures on the clone. In particular, can you show us the contents of offset 0x200 - 0x5FF in LBA 0? Can you also show us LBA1 and LBA2?

BTW, the 4KB sectoring may explain why the NTFS search is taking so long. DMDE could be struggling to make sense of a 512e file system on a 4Kn drive.

_________________
A backup a day keeps DR away.
Top
 Profile  
 
n0harm
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: November 24th, 2015, 19:20 
Offline

Joined: November 18th, 2015, 7:24
Posts: 16
Location: vienna
I have attached images of lb 0, 1 and 2 as shown in dmde.

the drive with the clone has not been formatted and before following up on your suggestions - there is a chance that the original drive, the one containing the data I am trying to recover now, that it could have been formatted in fat32. There was an issue with mac-connectivity, and this might be one of the drives in fat32. I usually have them formatted in NTFS, and I'm still not 100% sure about this one.

- As the security protocols of fat32 are not as advanced and hence the partitions not that resilient as with e.g. NTFS - I guess my chances to recover the data together with its structure will be lesser...?

- would the posted partition info of the clone be more "fitting" to an original fat 32 file format?

thanks again!


Attachments:
WP_20151124_23_50_10_Pro.jpg
WP_20151124_23_50_10_Pro.jpg [ 1.58 MiB | Viewed 6383 times ]
WP_20151124_23_50_23_Pro.jpg
WP_20151124_23_50_23_Pro.jpg [ 1.62 MiB | Viewed 6383 times ]
WP_20151124_23_49_58_Pro.jpg
WP_20151124_23_49_58_Pro.jpg [ 1.65 MiB | Viewed 6383 times ]
Top
 Profile  
 
fzabkar
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: November 24th, 2015, 19:55 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
You need to determine whether the cloning process proceeded as in case A or case B. To this end you would need to compare the original drive against the clone. If you can upload DMDE's partitions window for the 1TB drive, that would be of great help.

Select Mode -> Hexadecimal/Text and scroll through the beginning of each drive. LBA 63 or 2048 on your 1TB drive would be the typical location of your boot sector.

Code:
case A

LBA0                        LBA7   
._______________________________________
|   |   |   |   |   |   |   |   |   |
| 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9    512 bytes/sector (1TB HDD)
'---------------------------------------
  |   |   |   |   |   |   |   |   |
  |   |   |   |   |   |   |   |   |
  v   v   v   v   v   v   v   v   v
.________________________________________
|   :   :   :   :   :   :   :   |   :
|   :   :   : LBA0  :   :   :   |   LBA1    4096 bytes/sector (4TB HDD)
'----------------------------------------


Code:
case B

LBA0                        LBA7   
._______________________________________
|   |   |   |   |   |   |   |   |   |
| 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9     512 bytes/sector (1TB HDD)
'---------------------------------------
  |   |
  |   |___________________________.
  |                               |
  v                               v
.___________________________________________
|   :   :   :   :   :   :   :   |   :   :
|   :   :   : LBA0  :   :   :   |  LBA1 :    4096 bytes/sector (4TB HDD)
'-------------------------------------------

_________________
A backup a day keeps DR away.
Top
 Profile  
 
n0harm
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: December 1st, 2015, 8:25 
Offline

Joined: November 18th, 2015, 7:24
Posts: 16
Location: vienna
well, bad sectors aside, I get somehow different patterns in hexadecimal mode, of the 1 TB drive (the source device with the data loss).

sector 0 is bad.

sector 63 is bad too, with a similar output:

Code:
LBA:63                 Block: 63
0000007e00: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e10: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e20: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e30: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e40: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e50: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e60: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e70: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e80: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007e90: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007ea0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007eb0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007ec0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007ed0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007ee0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007ef0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f00: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f10: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f20: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f30: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f40: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f50: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f60: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f70: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f80: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007f90: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007fa0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007fb0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007fc0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007fd0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007fe0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD
0000007ff0: 42 41 44 20 42 41 44 20  42 41 44 20 42 41 44 20  BAD BAD BAD BAD


block 2048 shows:

Code:
LBA:2048               Block: 2 048
0000100000: AD 85 3C 73 D6 99 83 1B  EE C6 47 B5 03 B9 69 33  .&<s."....G...i3
0000100010: E4 AF 72 7F 4A CA B8 8F  63 1C 1E BD 73 49 03 19  ..rJ...c...sI..
0000100020: 6F 21 8D B6 96 C9 3D 07  A5 5F 38 8B 24 0C 91 C7  o!....=.._89$...
0000100030: 34 C4 86 95 31 02 40 C9  35 A1 6E FB 11 76 0C 1C  4. "1.@.5.n..v..
0000100040: E6 93 D8 69 D8 FD C9 FF  00 82 19 7E D6 1F F0 CF  ...i.......~....
0000100050: 5F B5 35 CF 86 F5 2B 91  6D E1 CF 14 DA 34 2F B8  _.5. .+.m....4/.
0000100060: E1 62 B8 1C A1 CF 41 93  9E BE B5 FB 93 FB 7A 7F  .b....A.~.....z
0000100070: C1 59 7C 39 FB 32 49 AA  78 5B 4E B7 B9 D7 FC 5A  .Y|9.2I.x[N....Z
0000100080: 21 2A D1 43 FB B5 B5 24  7C A5 9C F1 9E 73 81 CF  !*.C...$|.S.~s..
0000100090: B5 61 83 85 B1 32 5D 37  2A 71 E6 3F 8A 7F 1C 78  .a.&.2]7*q.?`.x
00001000a0: BB 50 F1 97 89 B5 4D 4F  51 9D AE 6F AF AE 5E 7B  .P..0.MOQ..o..^{
00001000b0: 97 3F C4 ED DC 7E 18 1F  85 71 31 A8 58 C7 27 3D  .?...~..&q1.X.'=
00001000c0: 2B BB 13 57 DA CE FD 3A  12 A3 6D 0A 45 09 93 62  +..W...:..m.E .b
00001000d0: F2 7A E7 D2 9B 1C A8 B3  00 47 03 A7 BD 62 2B 97  .z..:....G...b+.
00001000e0: 1A F3 CF 90 EC 38 DC 71  F4 AB 2B 6C 46 D2 A7 6C  .....8.q..+lF..l
00001000f0: 9E BE B4 AC 3D CD 5B 4B  61 7A 03 93 96 5E 09 F7  ~...=.[Kaz...^ .
0000100100: A5 9E C4 B8 31 A1 C9 C6  4F BD 24 F5 1D 8C D9 5D  .~..1...O.$..R.]
0000100110: 76 28 20 AB 03 8C FA D5  9B 2B 85 48 44 6E BB 83  v( ..R..:+&HDn..
0000100120: 1F CA 9E E8 5A DC 6D CA  25 C0 28 C3 6E DE 9E E2  ..~.Z.m.%.(.n.~.
0000100130: B0 76 90 08 DB B9 4F 18  F4 A4 82 44 16 A3 C8 94  .v....O....D....
0000100140: F9 8B 90 3A 0A B9 20 17  81 D5 86 1B D6 A8 4B B1  .9.:.. ... ...K.
0000100150: CF 4C 8D 6A 5B 39 C0 E9  56 E0 BB 2F 24 68 49 00  .L.j[9..V../$hI.
0000100160: F7 A6 C4 77 5A 4E B4 D6  D3 A4 6C 37 A1 E3 06 BB  ...wZN....l7....
0000100170: 91 6D 0D CF 98 F6 C4 AB  63 3B 57 9C D6 6D 58 B4  .m......c;WS.mX.
0000100180: 69 C9 A7 41 7D E1 C3 70  E1 BE D7 19 C3 28 1D BB  i..A}..p.....(..
0000100190: 1A 67 85 35 C6 D3 22 F2  26 02 44 27 B0 C6 33 42  .g&5..".&.D'..3B
00001001a0: D6 23 3D 22 DB 47 4B D2  61 2A A8 B2 0C 10 47 18  .#=".GK.a*....G.
00001001b0: AF 15 9F C3 0D A7 78 91  11 47 96 85 B3 F8 66 92  ..x...x..G.&..f.
00001001c0: 7A 0A CE E7 F4 89 FF 00  04 58 FD 96 20 F1 FF 00  z....0...X.. ...
00001001d0: C5 87 F1 66 AB 0F 99 A4  E9 43 E5 43 FC 6F B7 20  .!.f.."..C.C.o.
00001001e0: E7 D3 A0 C5 7F 60 FA 67  8E 2E 6D 2D 11 15 15 11  .. .`.g}.m-....
00001001f0: 17 0A A3 8C 0F 40 2B CD  C2 C7 DA D5 9C FC C7 29  ...R.@+.....S..)


I guess it is still imperative to determine wether this device was indeed formatted in fat 32 and if so, what the chances are to recover the data structure.... thanks, I still hope to see the light at the end of this tunnel. it's just dark right now...
Top
 Profile  
 
fzabkar
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: December 2nd, 2015, 2:04 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15538
Location: Australia
If the volume is a FAT32 volume, and if it begins at sector 63, then there should be a backup boot sector at sector 69. Otherwise, if it is an NTFS volume, then there should be a backup boot sector at the end of the volume. Does DMDE find any partitions on your patient drive? A search should take less than a minute.

I would also search for hex strings on the clone. This will tell us where the clone copy of sector 2048 was written.

Tools -> Search For String In Object (or Ctrl-F)

AD 85 3C 73 D6 99 83 1B EE C6 47 B5 03 B9 69 33

_________________
A backup a day keeps DR away.
Top
 Profile  
 
n0harm
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: December 20th, 2015, 19:37 
Offline

Joined: November 18th, 2015, 7:24
Posts: 16
Location: vienna
Hi - in the past days I had the hdd at a professional data recovery center, with following diagnose: the sectors at the beginning of the drive are physically severely damaged, the data structure is lost. the format is NTFS.

Therefore I restarted the ddrescue process at home, with a reverse run and it took only 2 days sharp to rescue all but 600MB of 1TB.

I stopped it then, as it worked hours on bad block splitting without results, but for resuming with the help of the logfile:

--> ddrescue won't continue as the destination drive is not empty (naturally...)
--> can I resume it with the --force operator or will it also ovewrite the so far rescued data?
--> how to continue otherwise?

thanks again for your help! and the --reverse operator did it really, as the whole process did not get stuck from the start, it went through the copying process much faster.
Top
 Profile  
 
n0harm
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: December 27th, 2015, 10:50 
Offline

Joined: November 18th, 2015, 7:24
Posts: 16
Location: vienna
As the data recovery procedure finally comes to its end, I would like to thank everyone for his help.

I'd also like to sum it up, hopefully some readers in compareable situations might profit from it. As the beginning section of my hdd has the most severe damages, regularly running ddrescue was really slow from the beginning, and it did not speed up significantly on the second part either. However, running it reverse, the whole process was complete in less than three days. My biggest setback was conceptual: I wasted too much time researching the state of the failed disc, trying to find out the best way to retrieve the file structure. In the end, dmde does that automatically where possible, so just run it, everything else was a waste of time.

In the end, dmde saved 1,3TB out of a 1 TB drive, not 100% sure exactly why. And there is a single folder with about 600000 jpegs, waiting to be sorted...

As the last task of the data rescue process itself, I would like to go over the 400MB failed data, with ddrescue and multiple reading attempts, I just have to figure out how to work only on the failed data, with the help of the existing logfile. Any help with that is appreciated.

Thanks once more, peaceful holidays everyone!
Top
 Profile  
 
n0harm
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: January 14th, 2016, 8:51 
Offline

Joined: November 18th, 2015, 7:24
Posts: 16
Location: vienna
Hi there,

the data recovery was successful for most of old data, except for some of the most important files, therefore I ask the community for one more advice:

around 700 pictures taken this summer have been recovered, but proved to be corrupt as I could not open anyone of them. I tried many file repair software, without any success. My research showed this to be a common problem with data recovery - that the corrupt data among the recovered derive from an unsuccessful recovery process, partly because the file data itself is distributed on the bad hdd, while just the beginning and the end parts could be accessed...

my situation is that right now, I do not have the ~1k euro to spend for a professional data recovery service, even though the missing pictures are very important to me.

--> as I understand, my two options are either to run ddrescue again, with several reading attempts on bad sectors...
or to wait until I can spend that chunk of €€€.

how risky would be running ddrescue again... I know it is hardly possible to make any prophecies about the outcome, just out of experience, is it worth the risk with ddrescue, especially since to my judgement, all oder pictures could successfully be recovered...?

THANK YOU for your help, it is much appreciated.
Top
 Profile  
 
syntaxerror
 Post subject: Re: ddrescue: 1st sector dead, need help
PostPosted: January 15th, 2016, 21:35 
Offline

Joined: September 17th, 2012, 13:42
Posts: 61
Location: Europe
I'd like to be sure that hdparm (under Linux) can't read track 0 resp. LBA 63 / 69 either.
For hdparm's routines are very low-level and can do things other tools can't do (any more, if damages are too high)

Code:
sudo hdparm --read-sector 0 /dev/sd<X>

Code:
sudo hdparm --read-sector 63 /dev/sd<X>

Code:
sudo hdparm --read-sector 69 /dev/sd<X>


(e. g. /dev/sdb)

Does it still output garbage or will it even output a 'succeeded' while trying to read the real data off it? (at least one of the three-some)
Just out of curiosity, and IF you want to sacrifice the time for it, of course.
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 2 of 2
  [ 30 posts ]  Go to page Previous  1, 2

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: Google [Bot] and 160 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group