It is currently July 23rd, 2014, 20:15

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: February 26th, 2012, 20:10 
Offline

Joined: February 26th, 2012, 19:16
Posts: 3
Location: europe
Recently my Toshiba MK1059GSM hard disk went corrupt and although I managed to backup most important data, I just realized I am missing some files that are not vital, but I'd like to get back.

I don't know if all of the following information are relevant, but I am first going to describe what happened:

After a system resume Windows (7, 64bit) didnt react to any user interactions, so I shut the system down manually. On the next startup no hard disk was found, however, after a few more restarts I "only" received a SMART hard disk error and Windows managed to start again. Chkdsk showed no errors and I backed up my data. Since then I always get the SMART hd error on startup, but Windows continued to work until yesterday. Since then Windows system repair reports "autofailover" and "baddisk".

When I add the hard disk to another computer via USB, it is not recognized and Windows suggests to format the disk.

As I haven't dealt with corrupt hard drives yet, I'd like to know what I can do to recover the files.


Top
 Profile  
 
 Post subject: Re: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: February 27th, 2012, 4:19 
Offline

Joined: November 6th, 2006, 6:58
Posts: 1673
Hi,

Most probably some sectors (like MBR or boot sectors) are damaged. If that is the case, might be possible to get you all the files without even opening the drive.
Another option is tha heads are failing. I've had a couple of those from same model with failed heads, so I wouldn't be surprised also.
But best this is to make a diagnosis with a pro, so he can evaluate what's happening.


Top
 Profile  
 
 Post subject: Re: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: March 26th, 2012, 19:35 
Offline

Joined: February 26th, 2012, 19:16
Posts: 3
Location: europe
I was looking for a professional service, but they are rather expensive for my needs, so I'd like to try to recover the files myself.

Using the software 'PhotoRec' (http://www.cgsecurity.org/wiki/PhotoRec) I managed to successfully recover some image files, but the software also restores a lot of text files with seemingly random data and file names like 'F123465.txt'.

Anyway, reading from disk basically works and you're probably right about the damaged MBR/boot sector. So how should I continue?

To be safe I'd assume it would be best to create an image of the disk and then try to restore the MBR. Which tools can you recommend for this purpose?


Top
 Profile  
 
 Post subject: Re: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: March 26th, 2012, 22:02 
Offline
User avatar

Joined: February 27th, 2009, 3:26
Posts: 1684
Location: French Polynesia Tahiti
OK do this one. Get the free cloning software and clone this HDD. Then try with GDB for NTSF this is get data back for NTSF. See if it reads your files. If it does purchase it and recovery your data. On what you see it is like they said more than likely a bad boot sector or MFT. The recovery program can show you what it finds. Take a time to run it but can redo this for you. Check it out and good luck on this one.

_________________
Iorana Haraharaini


Top
 Profile  
 
 Post subject: Re: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: March 26th, 2012, 23:08 
Offline

Joined: May 6th, 2008, 22:53
Posts: 2139
Location: England
@fwors,

fwors wrote:
I was looking for a professional service, but they are rather expensive for my needs, so I'd like to try to recover the files myself.

That means you have to accept the potential consequences (as well as the potential benefits) of your DIY attempts. It is possible that due to lack of skill / experience / taking short-cuts / just bad luck / etc., you might make things worse, or even unrecoverable.

fwors wrote:
To be safe I'd assume it would be best to create an image of the disk

Agreed. Cloning the original disk does 2 things - first, the location & quantity of read errors give you information about the problem; second, you're then able to recover from the clone, onto another drive. Make sure that the direction of the clone (source vs. target) is correct. Suitable cloning software does not include utilities like Ghost, Acronis True Image, CloneXXL, etc. which are aimed at cloning readable disks. See below.

fwors wrote:
and then try to restore the MBR.

IMHO it's unlikely for an unreadable MBR to cause the specific error messages that you've reported. Unreadable filesystem sectors are much more likely.

fwors wrote:
Which tools can you recommend for this purpose?

That choice depends on your skills, experience, budget, expectations of what the tool(s) would so, available time, etc., none of which we know about you.

For cloning, one well-known tool is GNU ddrescue running under Linux/Unix (which is what I use in my non-DR job for cloning marginal disks), but whether that is suitable for you depends on your Linux/Unix OS skills, and (in some cases) your experience with using it, in order to get the best possible result. Search the forum for discussions on cloning software for mentions of other software. Personally, I would only use non-Windows software for cloning flaky disks, but if you are uncomfortable with other OS, then that limits your choices.


Top
 Profile  
 
 Post subject: Re: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: March 27th, 2012, 1:08 
Offline

Joined: July 18th, 2006, 3:05
Posts: 7446
Location: ITALY
It is a Toshiba, so if the drive is unstable the risk is that the patient will die during the 'DIY surgery' . GOOD LUCK...


Top
 Profile  
 
 Post subject: Re: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: March 30th, 2012, 20:00 
Offline

Joined: February 26th, 2012, 19:16
Posts: 3
Location: europe
Vulcan wrote:
@fwors,
That means you have to accept the potential consequences (as well as the potential benefits) of your DIY attempts. It is possible that due to lack of skill / experience / taking short-cuts / just bad luck / etc., you might make things worse, or even unrecoverable.


I am aware of that, but I've made backups of the files I really need, so everything that's missing isn't worth spending a lot of money.

Vulcan wrote:
That choice depends on your skills, experience, budget, expectations of what the tool(s) would so, available time, etc., none of which we know about you.


budget: I don't spending a little money if it significantly increases the chances of recovery. However, in general I prefer open source solutions.
time: There's no hurry and I don't mind spending some time with this.
experience: I have recovered deleted files from USB devices, but haven't dealt with any serious data losses involving hardware or "low level errors" like corrupt file tables.

Vulcan wrote:
For cloning, one well-known tool is GNU ddrescue running under Linux/Unix (which is what I use in my non-DR job for cloning marginal disks), but whether that is suitable for you depends on your Linux/Unix OS skills, and (in some cases) your experience with using it, in order to get the best possible result. Search the forum for discussions on cloning software for mentions of other software. Personally, I would only use non-Windows software for cloning flaky disks, but if you are uncomfortable with other OS, then that limits your choices.


I haven't use Linux in a while, but if ddrescue is the best (free) software available I am going to use it. However, I haven't installed linux anywhere, but I guess there's no problem using a live distribution. Are there any distributions with pre-installed recovery tools available?

Besides, is it possible to limit the image to the second partition? I don't need any files from partition C and reading 150 GB unnecessarily from a damaged disk doesn't too promising.


Top
 Profile  
 
 Post subject: Re: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: March 31st, 2012, 16:02 
Offline

Joined: May 6th, 2008, 22:53
Posts: 2139
Location: England
fwors wrote:
budget: I don't spending a little money if it significantly increases the chances of recovery. However, in general I prefer open source solutions.

You could consider using that budget to ask a suitably-equipped DR company to perform a cloning-only recovery attempt, where you also provide the target disk for them to use.

If you are happy using open source solutions, and recognise that they are more limited than the best dedicated imaging tools (e.g. no power control etc.), then ddrescue is one tool which I have used.

fwors wrote:
time: There's no hurry and I don't mind spending some time with this.
experience: I have recovered deleted files from USB devices, but haven't dealt with any serious data losses involving hardware or "low level errors" like corrupt file tables.
[...]
I haven't use Linux in a while

Since you have the time to do this, and given the lack of recent experience with Linux, I suggest that you get familiar with ddrescue by practicing cloning another disk onto your planned target disk. For example, if you make a mistake and swap the source & target of the ddrescue command, then you will irreversibly lose data, so you want to be sure you know enough not to do that. You must use the ddrescue logfile. I don't give step-by-step instructions for ddescue, as so much depends on what happens when it runs, but I've given a couple of comments below.

fwors wrote:
if ddrescue is the best (free) software available I am going to use it.

I'm not going to tell you that it is "the best", as that is a subjective conclusion, depending on what parameters you're measuring, what weighting you give to each parameter etc. For ease of use, it probably scores lower than some free Windows-based cloning software, but with that complexity, comes flexibility and control.

I would probably start with a larger-than-default read block size, and no splitting configured, for the first pass - in an attempt to get a partial clone quickly (even though it is incomplete with no attempt to re-read any unreadable blocks), using a logfile as I mentioned above. Then re-run ddrescue with an appropriate direct or raw mode configured (depending on your Linux kernel's capabilities), as well as a few retries and splitting allowed, in an attempt to fill-in the unreadable "gaps" of that initial quick (but incomplete) clone. However, depending on what happens (e.g. one part of the disk seems very slow), then the plan would need to be changed to move on and get as much as possible from the parts where retries are successful, before the drive fails catastrophically (as BlackST mentioned could happen).

fwors wrote:
Are there any distributions with pre-installed recovery tools available?

Yes, there are some. For various reasons I don't use one, but an example is:

http://ubuntu-rescue-remix.org/

fwors wrote:
Besides, is it possible to limit the image to the second partition? I don't need any files from partition C and reading 150 GB unnecessarily from a damaged disk doesn't too promising.

Yes - I suggest you review the Linux device node naming scheme. For example, on a disk /dev/sda using MBR partitioning, its first partition (often, but not always windows drive C:) is /dev/sda1 while the second partition (often, but not always Windows drive D:) is /dev/sda2 etc. You can find the correct partition number for the partition(s) you want to read using fdisk -l to see the partition sizes, assuming that the MBR is still readable.


Top
 Profile  
 
 Post subject: Re: Data recovery from Toshiba MK1059GSM (1 TB)
PostPosted: March 31st, 2012, 16:43 
Offline

Joined: May 6th, 2008, 22:53
Posts: 2139
Location: England
P.S. Just noticed you mentioned Windows 7 at the beginning, so it might be GPT partitioning on that disk. Again, a GPT-compatible version of Linux fdisk will show which partition numbers you need to use with ddrescue, if you decide not to clone the whole disk. I would probably clone the partition containing the data you want and also the first & last 1MB of the disk, to capture the GPT info (this will also capture the smaller MBR, if that is the partitioning scheme which has been used).


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 16 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group