Extreme recovery

[Arminius]

Hi,

Recently, my computer started slowing down significantly and I mistook that for RAM problems.

Finally, one morning Windows wouldn't boot at all. I quickly identified the problem as being HDD related. My computer has two 500GB hard drives and I managed to access one (the one without windows on it) through a live USB of Kubuntu to reclaim the data. The other one is unreadable.

Here is what I tried with the two drives. The one that failed looks ok from a SMART standpoint and the one that didn't looks close to failure:




I could not clone the disk that had failed through that programm. I switched to another:

Testdisk.

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63
Partition Start End Size in sectors
> HPFS - NTFS 0 1 1 59419 254 63 954582237 [OS]
HPFS - NTFS 59419 6 44 60800 237 45 22200320

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue

I tried to list files (P) to copy them but a that point the utility froze (it works well with the other disk).

Finally I tried copying my files with DD by entering into the console:

dd if=/dev/sda of=/dev/sdd conv=noerror,sync

I used noerror because if I didn't, it stopped at the first error.

Here some examples of the results console gave me.
dd: error reading ‘/dev/sda’: Input/output error
1133095+2232 records in
1135327+0 records out
581287424 bytes (581 MB) copied, 7296.97 s, 79.7 kB/s

I actually don't understand how dd management du copy 581 MB on an external drive with just 500 MB of capacity. The external drive is actually now unreadable.

But let's get back to the core problem... how can I get the data out of the hard disk that failed? I must admit I did everything I could find. Could some experts give me a hand? Thanks!

[fzabkar]

I actually don't understand how dd management du copy 581 MB on an external drive with just 500 MB of capacity.

What sort of drive has only 500 MEGAbytes of capacity?

[Arminius]

Hi to both of you!

Thank for the responses!

Sorry for the little mix up, working so late I missed the abvious, the external HDD I was copying to had 500GB and I just had copied 500 MB. Please forget about that one.

For the model, I don't know for sure. It is in a HP DV7, and a quick lookup on internet gave me Toshiba MK1059GSM.

I am gonna be very honest, I'm new to this so everything is self taught.

About the data, most of the data is documents, but also firefox profile. Really annoying rather than tragic if I loose the data.

What do you mean by "clone the drive in reverse"? What's different from regular cloning? How can I determine if it's the heads that are failing?

On another note, after I tried cloning to the external HDD with the dd command, the external disk became unreadable. I checked with testdisk: the partition has a problem but the data can still be listed. Any idea how I could repair the still working hard disk? Should I create a new topic? Thanks! (I have become carefull.)

[Arminius]

Thank you for your answer. I also have data on the external HardDrive... so I would prefer not Wiping it with 0 data...

Here is the error I get when I try with testdisk to excess the external drive:

Partition sector doesn't have the endmark 0xAA55

Any idea what that means? Thanks!

When I do a quick analysis I get this.


Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63

The harddisk (500 GB / 465 GiB) seems too small! (< 1000 GB / 931 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partition can't be recovered:
Partition Start End Size in sectors
> HPFS - NTFS 60800 254 63 121601 253 62 976768002

[ Continue ]
NTFS, blocksize=4096, 500 GB / 465

I click continue and get:

Disk /dev/sdc - 500 GB / 465 GiB - CHS 60801 255 63
Partition Start End Size in sectors
> HPFS - NTFS 0 1 1 59419 254 63 954582237 [Iomega HDD]
HPFS - NTFS 0 1 1 60800 254 63 976768002 [Iomega HDD]

[Arminius]

You see I'm quite new to this...

I thought it would create an image "file" (iso or similar), it would then copy normally on the drive... So no risks...
Quite naïve, I know...

The data on that drive comes from the HDD that has not failed yet (the computer had 2 500GB, on having already failed).

How would you suggest I restore the partition so it is readable again (minus the data that is lost)? Can I recreate the endmark?

Thanks for your help!