ddrescue to the RESCUE...Seagate 1TB HELP NEEDED..!!

[darkosski]

Ok so i have a 1TB seagate drive with my movies pics etc and SMART is telling me to backup and replace drive. I tried to clone the drive using ddrescue but after 3.2GB it did not read another byte of data and the completion time went to 100+ hours.
so what i did then was try to make an image of the drive. soooo i imaged the first 3.2GB like

ddrescue -i100M -s3200M /dev/sdb1 /mnt/sda1/hdd.img logfile

after that was done i did it for the remainder of the drive

ddrescue -i10G -s987G /dev/sdb1 /mnt/sda1/hdd.img logfile

if i try to image the space between 3.2GB and 10GB i get an error..... now what im trying to find out is whats the best way to get this data in a usable form.
i ran PhotoRec on the image and i began to recover some data but the file names are rubbish...what im tryin to find out is.
1. Is this the best im going to get from this drive
2. Whats the best way to write this image to a new hard drive
3. Recover data from the hdd.img file with the old file names intact
4. Is there a better way to do this process since i know the data between 3-10gb is probably not recoverable with my knowledge.

any help is appreciated thanks guys.

[Vulcan]

The default ddrescue approach, as your commands show, is only a starting point. With experience and practice, and using all of the options which ddrescue has, you'll see how you can change the default behaviour to be more appropriate for different situations - although obviously there are limits about what can be done with any software-only cloning software.

Also, as with any DIY, the attempted reading being done by ddrescue could make any subsequent recovery attempts by a DR company more difficult/expensive.

From your comments, it seems that you're giving-up reading anything between 3.2GB and 10GB without trying to read all of it, because you get "an error" at the start. If you're not considering using a DR company (so you have accepted the DIY risk), then remember ddrescue can be configured to initially "try less hard" on the difficult area, to allow you to gather any data which can be quickly read - although if there is media damage within that area (for example) then repeatedly trying to read from it could cause additional (perhaps catastropic) internal damage. If the drive has not deteriorated further, you could use any successful reads within that area (review the logfile) to focus further attempts.

I didn't see you mention why your chosen commands don't try to read the first 100MB of the drive - why did you decide to do that?

Is this faulty drive in an external USB enclosure or direct SATA-attached?

[darkosski]

Hi Vulcan

Thanks for your reply,... the reason i did not do the initial 100mb of the drive was i wanted to test ddrescue to see if i used the log file if it would go back and copy all the info which i did not copy in the first pass....

that being said, if the data between 3GB and 10GB is some kinda hardware fault, do you think i could get the remaining data back with file names intact. Im assuming the FAT etc is somewhere in the first couple mb of the drive. I got files from the image approx 67GB using photorec, but the names are rubbish like i said before. Do you know of any ddrescue command which i should/could try on my little experiment?

Oh yeah when ever i try to read between 3GB-10GB i get a 990GB error file and then splitting and then the system hangs.

And lastly the drive came out of a LaCie enclosure if that means anything...and now its connected to my system via the SATA cables.

[Vulcan]

Thanks for your reply

and thanks for the extra info.

now its connected to my system via the SATA cables.

Good - a direct-attached faulty drive is typically less likely to "disappear" from the host, than a USB-attached faulty drive, which was why I asked. Unfortunately, from your description, it seems that the failure mode of your drive includes exactly that "disappearing" behaviour even when SATA-attached (which I've seen most recently with Seagate 7200.11 drives). Some drives need to be power-cycled to recover normal operation, depending on why they stopped responding normally.

the reason i did not do the initial 100mb of the drive was i wanted to test ddrescue to see if i used the log file if it would go back and copy all the info which i did not copy in the first pass....

I see that you're trying to explain, but I don't understand exactly how that relates to deliberately missing the first 100MB of the drive during the clone - but from what you have said, the simple solution is just to go and (try to) clone that part of the original drive into your existing output file using ddrescue now. That may help because...

Im assuming the FAT etc is somewhere in the first couple mb of the drive.

... correct. By including that part of the original drive in your clone output file (if it is readable on the original drive), you have a better chance of some recovery software (not Photorec - see below) using the original names for the recovered files.

I got files from the image approx 67GB using photorec, but the names are rubbish like i said before.

That is expected behaviour with Photorec. Have a read of the Photorec FAQ, which explains about the recovered filenames normally not being the original ones - along with some further info.

Do you know of any ddrescue command which i should/could try on my little experiment?

I don't know which "little experiment" you mean (this whole recovery?, just reading the first 100MB?, something else?), but in my experience, getting the best ddrescue results on a faulty drive, is often an interactive process. It depends on seeing which areas of the disk are problematic and manually adjusting ddrescue behaviour as needed for that specific problem, depending on exactly what ddrescue is doing at that point. It's not efficient for me to try to guess the details of what exactly is happening over there - you have the drive in front of you, but I don't .

You said:

when ever i try to read between 3GB-10GB i get a 990GB error file and then splitting and then the system hangs.

That size of error suggests that you were not limiting the area for ddrescue to attempt to read, and didn't include a logfile after successfully recovering the area after 10GB - then when the disk stopped behaving normally (and may need a power-cycle to recover), the whole of the rest of the drive was reported as "errors".

I expect ddrescue will need more interactive help from you - some suggestions include:
- using reverse direction recovery;
- limiting the area to be recovered on each attempt (to help make it more obvious where a problem area starts, and see if you can avoid triggering the drive to "disappear" during the recovery of some smaller areas);
- using the Linux dmesg/messages (to try to differentiate between the location of initial (genuine) errors, and the (apparent) "errors" caused when the drive stops responding normally);
- disabling splitting on the initial attempts;
- using raw access;
- be prepared to have to power-cycle the drive, if it stops responding normally, which will usually be easier (and, in some cases, less risky) if you're powering the drive from a different source than the PC (although repeated power-cycling also causes stress on the drive, of course).

Without the drive in front of me, that's probably as much advice as I can offer. Good luck!

[darkosski]

Hi Vulcan

Thanks for taking the time to reply, with such clarity, the amount of information given by you is priceless.

I did try limiting the read area of ddrescue using

ddrescue -i3400M -s1G but i get a 1GB error file

once im reading any data between 3.2GB and 10GB. I am very curious as to what could cause this kind of error on my hard drive
because that seems to be a HUGE "bad sector".

... correct. By including that part of the original drive in your clone output file (if it is readable on the original drive), you have a better chance of some recovery software (not Photorec - see below) using the original names for the recovered files.

were you going to list recovery software to try? because ive tried recovery using GetDataBack ntfs on the cloned drive and it recovered NUTTIN

Ok this maybe a silly question but let assume i cant touch anything between 3GB-10GB
if i create an image file from 0-3.2GB and then append 10GB-990GB
whats my next step because that's what i've been doing but when ever i write the image to hard drive it cant be
read normally... by normally i mean using a file explorer in either Linux or M$. Maybe with my newbie-ness ive missed
a vital step.

Im going to try some of the techniques you mentioned on the drive and see how that goes, reverse clone, raw read etc luckily the drives is still going strong at the moment but im sure its gonna die sometime soon... but in the mean time i will get as much experience as i can.

Thanks again for your time i really appreciate it.

[pcrecovery]

As Vulcan said, you are quite limited in what you can do with software alone. Many drives quite responding and need to be power-cycled, etc---an advantage of hardware is that it can control such things as power, etc. You could probably modify the source code and add such capabilities (that would be an interesting project) but there are so many solutions that already provide this capability. Your drive might have media damage in the described region, in which case a device like DDI or DE would be able to more efficiently extract the most data quickly (also using heads map, etc).

[Vulcan]

Thanks for taking the time to reply, with such clarity, the amount of information given by you is priceless.

You're welcome - unfortunately trying to help on problems remotely like this isn't easy, and I have limited time available to assist. A few more suggestions below, but as I said before and pcrecovery also mentioned, a software-only approach (like ddrescue) has limitations. This is why I previously mentioned that you needed to decide whether to use a pro recovery (e.g. someone with h/w assisted recovery equipment, like those mentioned by pcrecovery), or accept the consequence of DIY.

I did try limiting the read area of ddrescue using

ddrescue -i3400M -s1G but i get a 1GB error file

once im reading any data between 3.2GB and 10GB.

I expect that you needed to power-cycle the drive, before it would respond again - is that correct?

It's not clear to me - after power-cycling the drive (if necessary), did you try similar commands, with different initial starting points e.g. starting at 4GB, 5GB, 6GB etc.?

I am very curious as to what could cause this kind of error on my hard drive because that seems to be a HUGE "bad sector".

I don't work in DR, but in another part of the data storage industry, and from that experience, I've seen this behaviour several times on Seagate SATA drives. There tends to be a common "signature" in the raw SMART values from such a drive.

I would not be surprised if there is a method available to DR pros, to prevent the drive from entering the state which requires a power-cycle - but according to normal SATA protocol requirements (i.e. without using any "tricks") the examples of this behaviour which I have seen, are expected for a drive which is failing in a particular way.

were you going to list recovery software to try?

No - in my previous reply, I just gave you pointers about why PhotoRec wasn't giving you the original filenames. If I did try to give you a list of other recovery s/w, someone else would say "but you missed these others" and then give some more suggestions whilst perhaps claiming that whatever I said was useless (in their opinion ), so I'd be wasting my time trying to provide a list, as someone would just shoot it down. With so much s/w to choose from, each person has their own favourite(s). Some vendors of recovery software sometimes come onto the forums to mention their products, so you can try those promotions too, if you're stuck for ideas.

because ive tried recovery using GetDataBack ntfs on the cloned drive and it recovered NUTTIN

Was that with the first 100MB of the original drive now included in the clone, as I mentioned in my previous comment? There are other details missing about exactly what you've tried, so I can't offer sensible suggestions based only on your comment above.

Ok this maybe a silly question but let assume i cant touch anything between 3GB-10GB
if i create an image file from 0-3.2GB and then append 10GB-990GB

And I'd fill the ~7GB "gap" with hex 00, if your target filesystem doesn't treat the clone as a sparse file and do that anyway.

whats my next step because that's what i've been doing but when ever i write the image to hard drive it cant be read normally... by normally i mean using a file explorer in either Linux or M$. Maybe with my newbie-ness ive missed a vital step.

Lots of info missing about the details of what you've done exactly, unfortunately . One area you might be making a mistake, is in how you're treating the clone. Think about what you've been cloning (partition vs. drive) - does that fit with how you've been writing the image to a hard drive? Think about what error(s) you got when you tried to mount the cloned filesystem on Linux - did you investigate those?

On Linux (I don't know about Windows) you don't need to copy your clone image file onto a disk before using it - you can mount the clone file itself using the Linux loopback device. I would be doing that, and checking that the boot block of the filesystem looked sensible, before doing anything else.

Im going to try some of the techniques you mentioned on the drive and see how that goes, reverse clone, raw read etc luckily the drives is still going strong at the moment but im sure its gonna die sometime soon... but in the mean time i will get as much experience as i can.

OK, good luck

[Corsari]

For the convenience of all the readers

Ubuntu Documentation > Community Documentation > DataRecovery
https://help.ubuntu.com/community/DataRecovery
in this documentation, @ chapter 4 note the difference between ddrescue, gddrescue and dd_rescue

and

ddrescue on Forensics Wiki's website
http://www.forensicswiki.org/wiki/Ddrescue

----------------------------------------

From /usr/share/doc/gnuddrescue/README

GNU ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.

Ddrescue does not truncate the output file if not asked to. So, every time you run it on the same output file, using a logfile, it tries to fill in the gaps.

The basic operation of ddrescue is fully automatic. That is, you don't have to wait for an error, stop the program, read the log, run it in reverse mode, etc.

If you use the logfile feature of ddrescue, the data is rescued very efficiently (only the needed blocks are read). Also you can interrupt the rescue at any time and resume it later at the same point.

Automatic merging of backups: If you have two or more damaged copies of a file, cdrom, etc, and run ddrescue on all of them, one at a time, with the same output file, you will probably obtain a complete and error-free file. This is so because the probability of having damaged areas at the same places on different input files is very low. Using the logfile, only the needed blocks are read from the second and successive copies.

[Vulcan]

The basic operation of ddrescue is fully automatic. That is, you don't have to wait for an error, stop the program, read the log, run it in reverse mode, etc.

While that's true, of course, my experience is that for optimum results (within the limits of what ddrescue can actually do), it is often necessary to use different ddrescue parameters after the "automatic" ddrescue run has completed - or sometimes, as in the case of the OP here, it can be necessary to manually control ddrescue to get even an initial, partial, clone.

That web page you linked also suggests running ddrescue with the "-C" option, after the first run. This is a bad idea, unless you first check that the logfile correctly shows the full size of the device (which they don't mention). A premature catastrophic failure (for example), which causes the first recovery to abort early, would then mean that all subsequent attempts using the "-C" flag would not try to read any further on the original disk, than the original first (aborted) recovery attempt. The only (rare) exceptions to my comment, are mentioned in the ddrescue docs.

In short, that web page gives some hints, but IMHO it is not optimal if the user has limited experience with the tool.

[darkosski]

Ok guys looks like i will be ordering some equipment... ive spent the last week or so reading about Atola Insight, Deepspar Imager and pc3k
and i think im going to buy one of them. I figure it would be for learning processes but you never know maybe i will get super good and maybe make my money back. First project being the hard drive i have been working on at home.

Vulcan
do you think the problem im having could be solved with a better imager app or hardware. Also what your take on Deepspar & Pc3k vs Atola insite. I've read all the hype and so on but what ive learnt so far is... deepspar is more expensive initially and better than Atola. im sooooooo confused as to which product to go with. but im leaning toward deepspar since there is no 499 a year for updates especially since this i just a fun project that could or could not be turned into a business.

Any hints tips would be appreciated.

[Vulcan]

@darkosski:

I didn't see answers to any of my questions, or updates from your recovery process in your reply, so I'll just briefly reply to your questions...

Vulcan
do you think the problem im having could be solved with a better imager app or hardware. Also what your take on Deepspar & Pc3k vs Atola insite.

As I explained before, I work in a different part of the data storage industry, not in DR (though I've had to do some), so I can't give a comparison of those tools. There have been previous discussions on the board between those who use them, so you could look for those threads or wait for other replies (if any) from users of those tools.

It might be worthwhile asking either users or suppliers of those tools, how their specific tool would handle the Seagate drives which (like yours) need a power-cycle once they attempt to read a specific LBA (this is quite common with Seagate 7200.11 drives, as I have seen several like that).

[darkosski]

@Vulcan

I haven't done anything else with the drive, what i have done is ordered DDI and next on the agenda is PC-3k once i have the tools in hand i will come back and give you a full update. Or maybe you will see more questions on how to use the new tools lol....

[dick]

Hi Darkosski, I can't work out if you are able to read sectors after the 3gb to 10gb you are having difficulty with and seeing you have a lack of resources, like many of us, can I suggest a different approach?

In a situations just like yours I have had some successes with the application 'copyr.dma' and with it you can try to get get the first 128gb's. So where it might help you is if you 'baybysit' the drive then when it stops reading you can perform a manual power reset and then hopefully carry on reading sectors. What I do is connect an old AT type power supply to the hard drive only. It means you can power the drive on/off independently of the dos environment and motherboard. If copyr.dma starts timing out you do a power on/off reset and hopefully the reading will continue. I can assure you in many cases it really can work! Unfortunately there is no read error log but you can keep a wriiten record of the lba's which are missing and maybe go back and attempt to get them later on if required. If you manage to get past the bad/non reading sectors then you might be able to continue with dd or even dmde to finish off.

You do of course need a second drive to clone to!

Good luck!

[darkosski]

Hi Dick

Thanks for the input... i can read everything before the 3GB and everything after the 10GB using ddrescue one major headache is i keep getting a superblock error when i try to mount the ddrescue.img file in linux.... what i have done tho is ive ordered DDI so we will see what the status is after i DDI it next week hopefully.

[darkosski]

OK guys as promised im giving you an update.

Got the DDI
read the manual built a semi compatible workstation.... and i say semi because its not the specified board but it seems to work well anyways....
that product is amazing..... it got all the data back..... ALLLLLLLL...!! wow.... best 7k ever spent lol

now its on to building a clean box and trying some head stack transplants.... rah ha ha ha....

[BlackST]

No wonder... after spending 7'000 dollars. The contrary would have been 'a little bit' disappointing
Congrats for the choice !

[Vulcan]

@darkosski - That's great news about DDI allowing all the data to be read from that drive

This is a good example of the potential limitations of a generic software-only cloning approach (i.e. ddrescue), where a better result can sometimes be obtained by using professional equipment (in your case DDI) - as long as the end customer doesn't mind paying someone who has that equipment, to do the recovery.

Thanks for the update

[odedshankar]

Hi Guys,

I am currently learning ddrescue a bit deeper but can't find an option i would really like to have.
Can i do a reverse image limited for a certain area of the disk, if so will love to get the syntax for that.

Cheers