July 23rd, 2018, 7:58
[ 1757.982331] usb 4-1: new SuperSpeed USB device number 2 using xhci_hcd
[ 1757.999191] usb 4-1: New USB device found, idVendor=1058, idProduct=10a8
[ 1757.999196] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1757.999198] usb 4-1: Product: Elements 10A8
[ 1757.999200] usb 4-1: Manufacturer: Western Digital
[ 1757.999201] usb 4-1: SerialNumber: 575833314135333132313438
[ 1758.539737] usb-storage 4-1:1.0: USB Mass Storage device detected
[ 1758.540224] scsi host6: usb-storage 4-1:1.0
[ 1758.540545] usbcore: registered new interface driver usb-storage
[ 1758.544855] usbcore: registered new interface driver uas
[ 1759.539432] scsi 6:0:0:0: Direct-Access WD Elements 10A8 1042 PQ: 0 ANSI: 6
[ 1759.539955] sd 6:0:0:0: Attached scsi generic sg2 type 0
[ 1759.540674] sd 6:0:0:0: [sdc] Spinning up disk...
July 23rd, 2018, 13:49
July 23rd, 2018, 15:38
July 23rd, 2018, 17:55
digisupport wrote:3. likely a problem with damaged heads or media (replacing the PCB will NOT help.)
abolibibelot wrote:Have you tried to check SMART data ?
abolibibelot wrote:How complete is the ddrescue image ? How hard have you tried with ddrescue ? Could you post a ddrescueview screenshot ?
July 23rd, 2018, 20:51
So I'm wondering, does this repeating clicking mean:
1. likely a problem with the USB insufficient power supply (physical connection problems with the flimsy USB connectors)
2. likely a problem on the PCB (replacing the PCB with a donor PCB may help).
3. likely a problem with damaged heads or media (replacing the PCB probably will NOT help.)
4. not possible to say one way or the other.
Thanks in advance for any advice!
July 24th, 2018, 1:34
If I am honest I think I made a mistake with ddrescue options, the first time I connected the disk it was recognized almost immediately, but unconsciously I used the following option "-r 3".
In doing so I think I've speeded up the degradation of the drive. :/
The data was important, in the end only personal photos, but honestly now I do not remember how much space I had occupied, so I can't even define if from the partial image has recovered everything.
My mistake is that I didn't do these checks before.
I sincerely hoped that if I did the imaging right away, I would be able to do it after these checks, without thinking I'd damaged the disc more.
Anyway of the 265.31 Gb rescued, only 50 Gb are of actual files.
Do you think I was lucky and I managed to recover all the files? (Usually Windows with ntfs partitions, does it fill from the beginning of the disk or not?)
July 24th, 2018, 13:12
Spildit wrote:You are based in Italy, correct ?
Maybe you should contact forum member @michael chiklis - memberlist.php?mode=viewprofile&u=21477
If your drive does have some bad blocks + firmware issues but if all heads are still working more or less ok then maybe it should still be possible to image the drive using hardware based tools like MRT (after applying firmware patches) and extract the data without the need of (very expensive) clean room work ...
Regards and good luck.
Rling wrote:So I'm wondering, does this repeating clicking mean:
1. likely a problem with the USB insufficient power supply (physical connection problems with the flimsy USB connectors)
2. likely a problem on the PCB (replacing the PCB with a donor PCB may help).
3. likely a problem with damaged heads or media (replacing the PCB probably will NOT help.)
4. not possible to say one way or the other.
Thanks in advance for any advice!
Just wanted to say, that I am a big fan of recycling for environmental reasons.
Including recycling other users' posts![]()
I hope you can get what you are looking for and get your data back.
Good luck
Rling
abolibibelot wrote: Have you tried turning it off then on again (after a few seconds) when it appeared that no data was read anymore ? Or have you let it run unattended until the end ?
castiman wrote:3. likely a problem with damaged heads or media (replacing the PCB probably will NOT help.)
abolibibelot wrote: You may have more luck trying to complete the image in reverse with the -R switch (from the very end to the bad spot in the middle). If the heads are still functional, my guess is that a good portion of the second half can be imaged like the first half. Don't use the -r switch as it indeed can stress the heads to no avail (sectors which can't be read at the first try are unlikely to be read at the 3rd) and it defeats the very purpose of ddrescue which is to bypass the bad areas and get the good ones ASAP.
abolibibelot wrote:How do you know that ? What have you tried to extract files out of that image ? Mounting it directly ? Scanning it with a data recovery software ? Which one(s), with what options ?
abolibibelot wrote:If the filesystem is indeed NTFS, you can use ddru_ntfsbitmap from ddr_utilities to create a domain mapfile for ddrescue, restricted to the actually allocated sectors, which are determined by analyzing the $Bitmap file ; the $Bitmap file has to be complete for it to work properly. You could first test ddru_ntfsbitmap on your partial image file instead of the source drive, to see if it does work, meaning, if the $Bitmap is complete. There's an option to extract a second domain mapfile restricted to the $MFT file only, which allows to copy that very important file first (but if it contains bad sectors it's not a good idea to insist too much on them).
You could also open the partial image with WinHex to see if it can find the complete directory tree, or if the MFT is corrupted (right-click on the $MFT and left-click on Open, then scroll down and see if there are large chunks of empty sectors).
abolibibelot wrote:But again do that at your own risk, as it may further damage the platters' surface and/or heads, and lower the recovery rate if you finally decide to bring the drive to a professional.
July 24th, 2018, 15:13
My friend give me his hard drive and ask me to try to recover the files. (I just to learn I'm always kindly and I accept to help everyone, at own risk XD)
Firstly I connected the hard drive to my notebook and I only tried to run ddrescue. After 14.18 Gb rescued, I realized that I would needed 500gb and time to finish the process, that I did not have on my pc and I have stopped the process.
https://ibb.co/nLr6zT
ddrescue -s 1048576 -x [exact size of source drive in bytes] bigimagefile bigimagefiledummycopy dummmycopy.logddrescue [-P] -G bigimagefiledummycopy bigimagefile generate.logddrescue [-P] smallimagefile bigimagefile generate.logSo I thought used another disk (with 500gb free? No..I would have been too smart).
I have run ddrescue (same options: -r3 -d and without using the previous log ) unattended until the end of space of recipient disk.
https://ibb.co/hvYE4T
After I have done this stupid steps, finally I used a virgin hard disk (with 500gb free).
So I copied the previous image and log file to the new hard disk and I have run again the ddresceu (same options).
But from this moment on I noticed that there were more errors that increased than the rescued.
https://ibb.co/dOX7Oo
On Windows, I have used OSFMount to mount the img file and "Starus NTFS" to try to recover the files. This software show me all directory and files named correctly.
So I think the $MFT file is safe (right?)
July 24th, 2018, 19:29
September 8th, 2018, 7:47
abolibibelot wrote:Indeed it was quite careless not to have planned to have enough space right away...The thing to keep in mind when working on a failing drive (especially without the means to perform advanced procedures like replacing the HSA = head stack assembly or patching the ROM or whatnot, when you can only rely on cloning/imaging with software tools and hoping for the best) is that each time you turn it on can be the last time it ever functions and is able to extract data. But from that screenshot it would seem like only 2.36MB are corrupted at the begining, and the bad area appears in yellow / light green rather than red as on the first screenshot you sent. Apparently for the next step you started all over again, with a worse result, meaning, more bad sectors. Did you keep that first (very partial) image ? If you did keep it, you could merge it with the more complete image to hopefully get a higher percentage of the MFT, and a better recovery efficiency (you won't have much more of the actual files contents, which are mostly in the green area, or unrecoverable if the drive is indeed too damaged now, but you might have more metadata to be able to access them right away and extract them properly, with their native names / timestamps / attributes, and in one piece if they were fragmented). You can do that with ddrescue itself. Be sure to backup the image files before attempting this. (I'm writing this from memory, do verify each command and run some tests before doing it for real.)
First run ddrescue with the larger image file as output with the -G switch which stands for “generate” : this will only create a mapfile/logfile marking all empty sectors as non-tried. Normally you have to set the source drive as input, but in order to not stress it any further I suggest that you instead create a dummy copy of the recovered image (you should still have a complete copy of it just in case something goes wrong), using the -s and -x switch (-s means that you only image a defined size of the input, -x means that you extend the output file size to a defined value) :
- Code:
ddrescue -s 1048576 -x [exact size of source drive in bytes] bigimagefile bigimagefiledummycopy dummmycopy.log
This will create (very quickly) a file occupying only 1MB on the working drive but with the same apparent size as the whole source drive (~500GB).
Then use the dummy copy as input, the big image file as output (this should not modify it, but if you use a wrong switch and it does modify it in an unwanted way, you have a copy) :
- Code:
ddrescue [-P] -G bigimagefiledummycopy bigimagefile generate.log
Then run ddrescue with the small image file you obtained at the first step as input, the big image file you obtained later on as output (keep a copy!), and the logfile/mapfile obtained at the above step.
- Code:
ddrescue [-P] smallimagefile bigimagefile generate.log
This should be very quick and complete only the red area at the begining. There will still be empty sectors, probably some in the MFT, but it should be a great improvement when you try to mount the image or scan it with recovery softwares.
ddrescue -s 1048576 -x 500073234432 test.img testdummycopy.img dummycopy.logddrescue -G testdummycopy.img test.img generate.logddrescue -C /media/root/DDRescue/Pass1/test.img test.img generate.logWell, on that second screenshot it also appears that only a few MB are corrupted at the begining. Are you sure that you copied the partial image and did not start all over again at the 3rd step rather than the 2nd ?
Maybe providing the logfiles themselves could be helpful in trying to understand what went on.
An advanced software like R-Studio will both attempt to reconstruct the directory structure and find all files that have intact MFT records, and also detect “raw” files according to their signarure (header), which will be listed in a separate “Extra found files” directory, sorted by type, with a random name. Depending on how badly the MFT is corrupted, there might be many extra files there. If they were not fragmented, they will be normally readable, but with a random name and none of their native attributes.
maximus wrote:Unfortunately ddrescue is unable to detect this kind of condition, and all reads from that point on are reported as bad. While there are ways of resetting the log after events like that, there is likely a better way. And that is to use HDDSuperClone to clone the drive.
Powered by phpBB © phpBB Group.