Looking for help recovering data from a drive

[gte]

Hi Vulcan,

I ran dd and then ddrescue (one command on one machine, and the other command on another machine because it appears dd didn't do much).

I'm sorry you felt like you've wasted your time (thank you for being polite about that), I still appreciate the time and help you have given me.

Thanks again.

[Vulcan]

I ran dd and then ddrescue (one command on one machine, and the other command on another machine because it appears dd didn't do much).

Wow - I really have had problems understanding this situation; I had no idea at all that you'd done this. So it's clear I'm not the right person to help you, due to those communication problems, which could lead to me giving you incorrect advice. Hopefully someone else who understands your situation better than me, will be willing to assist.

IMHO if you can give a full history of your actions / commands chosen & the results obtained from each one, to anyone else who tries to assist, that would improve the chances of you getting the right advice. Best of luck

[gte]

First I ran dd, but it appears I did it while the drive was mounted so it looped into an image larger than the actual drive size, of worthless data. I ran this after finding instructions on a website recommending this.

After that, I ran ddrescue on another machine and it will recover about 15gb and say that 145 are unreadable

ddrescue -n /dev/sda4 /media/sdb3/dd/rescue2.img /media/sdb3/dd/rescue2.log

I rebooted as the drive partitons could not be seen anymore by fdisk -l and ran the command

ddrescue -C /dev/sda4 /media/sdb3/dd/rescue2.img /media/sdb3/dd/rescue2.log

to try and continue and it will not. At this point, I also tried

ddrescue -r 1 /dev/sda4 /media/sdb3/dd/rescue2.img /media/sdb3/dd/rescue2.log

and nothing came out of that either. I'm going to give up at this point, because I do not think there is any other way, and see how much it will cost to send out to a pro.

To anyone who reads this ... From a newbs perspective, there is a lot of smoke and mirrors convoluting this whole process and someone putting together a simple end all tutorial would probably be very helpful for other people in the future. Something along the lines of:

"Do you want access to all of your data, or at least as much as is salvagable without changing physical components inside of the drive?"

If so, verify this/this/this, make sure you've done this/this/this, make sure you haven't done this/this/this, boot into the UBCD version X.X and then run this command.

[labtech]

From a newbs perspective, there is a lot of smoke and mirrors convoluting this whole process

What do you mean by this sentence?

[Eleg]

...someone putting together a simple end all tutorial would probably be very helpful for other people in the future.

Already done in the ddrescue manual. Section 6 is what you are looking for. First sentence is important:
"Ddrescue is like any other power tool. You need to understand what it does, and you need to understand some things about the machines it does those things to, in order to use it safely".

[Vulcan]

@gte:

someone putting together a simple end all tutorial would probably be very helpful for other people in the future.

I understand your comment, but I do not expect this to happen. Some background as to why, is given in this 'sticky' thread: diy-what-the-big-deal-t12671.html

The huge variety of: disk drive makes & models (different suggestions can apply for different models), OS versions (some utilities won't work on some OS), disk interfaces (some utilities won't work with some interfaces), PC BIOS features (some utilities require certain BIOS features), fault symptoms, problem descriptions, technical abilities of the person reporting the problem, actions already done by the person before they reported the problem etc. etc. etc. mean that in my experience here, it is rare (with a few exceptions) to have a previously-used plan, which really fits multiple different reported issues. Those are just a few of the reasons why such an "end all" tutorial is unlikely to be totally realistic, IMHO.

@Eleg,
Agreed

[gte]

I can't quote everyone in a single post, so I will just reply to all in this one. I'm also not here to argue and I realize I'm looking forward (with limited perspective) and not backwards (with whole perspective).

I understand it's very powerful, especially after Vulcan pointed me to the document that you referenced Eleg, that document was helpful. Before that I did not even know DD and ddrescue were different programs.

IMHO, the problem or disconnect is that first time users do not have a baseline to go against. There is no "known goods" . If I had been told that I needed to use "this recovery drive" I would have ordered it. A known good list, or compatibility list to baseline off of does not seem impossible to me, it seems like a good idea. Using a predesigned environment such as UBCD or a Bart pe disc would also help eliminate some of variables mentioned.

I have very little linux experience, but a lot of windows experience and a lot of electronics experience (just designed my own PCB with a chip that I wrote the firmware for, standard size components, not surface mount of course ... which was stored on that drive of course ) and all of my previous data recovery experience was within windows, I could write a simple tutorial (from within Windows) that would cover most situations if the OS failed but the hardware functioned and the drive data was not corrupted. I'm not an idiot, but I'm lacking outside of the Windows environment. I would think a ddrescue PE with a tutorial would be a nice step towards an end all solution. I understand there are certain hardware platforms that a PE would not be compatible, but it would be largely disproportional to the amount of hardware platforms it would be compatible with.

If you all aren't against the idea of a PE and known good list, I'd be happy to build a Bart disc when I have a better understanding of ddrescue.

[gte]

To elaborate on this, I ran dd and ddrescue from the UBCD as my preinstalled environment on a dell gx280 and dell gx380. The failing drive is a Fujitsu 160GB 7200 RPM Sata Laptop HDD MHW2160BJ, and the recipient drives I do not have the information on, but they were browsable and mountable. All drives were formatted in NTFS, the failing had XP32 bit, the gx280 had xp 32bit and the gx380 had win7 32bit.
http://www.ultimatebootcd.com/download.html

I believe my problem now is that the rescue programs consider 145gb of the drive as unreadable.

First I ran dd, but it appears I did it while the drive was mounted so it looped into an image larger than the actual drive size, of worthless data. I ran this after finding instructions on a website recommending this.

After that, I ran ddrescue on another machine and it will recover about 15gb and say that 145 are unreadable

ddrescue -n /dev/sda4 /media/sdb3/dd/rescue2.img /media/sdb3/dd/rescue2.log

I rebooted as the drive partitons could not be seen anymore by fdisk -l and ran the command

ddrescue -C /dev/sda4 /media/sdb3/dd/rescue2.img /media/sdb3/dd/rescue2.log

to try and continue and it will not. At this point, I also tried

ddrescue -r 1 /dev/sda4 /media/sdb3/dd/rescue2.img /media/sdb3/dd/rescue2.log

and nothing came out of that either. I'm going to give up at this point, because I do not think there is any other way, and see how much it will cost to send out to a pro.

To anyone who reads this ... From a newbs perspective, there is a lot of smoke and mirrors convoluting this whole process and someone putting together a simple end all tutorial would probably be very helpful for other people in the future. Something along the lines of:

"Do you want access to all of your data, or at least as much as is salvagable without changing physical components inside of the drive?"

If so, verify this/this/this, make sure you've done this/this/this, make sure you haven't done this/this/this, boot into the UBCD version X.X and then run this command.

[drc]

for reference, dd is not ever helpful as it can't handle unreadable sectors

[gte]

Thank you, I had a sinking feeling that was the case.

Is there anything short of head replacement that might be hopeful for me? I believe the company I end up choosing to send this drive to will have to take an identical drive and try to put the platters of my drive into it.

for reference, dd is not ever helpful as it can't handle unreadable sectors

[Vulcan]

Thank you, I had a sinking feeling that was the case.

As drc said, dd is not going to help for something with unreadable sectors - which is why ddrescue (and similar utilities like DMDE) are a slight improvement, but there are real limits to what they can do. Some people have great success using them; others not.

Proper disk imaging hardware, as used by professional DR companies, with all the "IP" (i.e. "know how", like proprietary commands) which they include, often give much better results. This is the main reason why DIY cannot cope with a significant proportion of these type of problems, as they are missing that IP. Having said that, a drive which has been dropped may need cleanroom work anyway.

I believe the company I end up choosing to send this drive to will have to take an identical drive and try to put the platters of my drive into it.

Not necessarily - since the problem is that you dropped the drive, the 3 main areas of possible damage are heads (HSA), media & motor/bearings. Damage to the latter may need a platter swap; damage to the first two typically don't.

Having now spent a few minutes reading your choice of ddrescue parameters, the choices might have resulted in sub-optimal results - all depending on what was in the logfile (and on the screen), when each "run" finished (or was stopped by you). For example, you don't want to use the "-C" parameter, until you are sure that the logfile contains the correct last block value, and it's unclear from what you said, whether the previous run finished (and hence wrote that value) or not.

The best choices of ddrescue operations are dependent on the drive behaviour, which means that they are dependent on the results from the previous run. This is one reason why giving suggestions to remote users of ddrescue (e.g. through a forum) doesn't always work very well (depending on urgency, communication issues, etc.). That feedback loop is important, in my experience with ddrescue, and forum readers can't see your PC(s), making the process very difficult.

I hope you can now see why I believe your suggestion of producing an "end all" tutorial (which therefore cannot be interactive and cannot get dynamic feedback to change the suggestions, as any DIY recovery progresses) is an unrealistic target. Your view may still be different, but (as you said), I'm not looking for an argument and we may just have to agree to disagree.

One of many advantages which a DR company has when working on a drive, is that they have the drive in front of them, and are not being asked to do remote assistance. Good luck with whatever you do.

[gte]

Hi Vulcan,

I ran the -C switch because I had came home from work and found the failing drive had dismounted. I ran an fdisk -l and it was not listed there either. I'm not sure why this happened, but after I bounced the desktop I was able to see the failing drive again in the UBCD linux OS. I am not sure if it contained the "correct last block value" because I do not know what I am looking for in the log file, all I remember is that it had many lines of data in it. DD seemed like a decent idea so that if I could just capture a duplicate image of what my drive contains, I could then run the remaining tools on it and leave the failing drive powered off only using the duplicate image, maybe that was a bad idea?

I do see your point in the complexity of this process, and understand how the ddrescue command can hinge on the results of the previous command ran. That being said, what do you think is a good initial command to run, to generate results for the following commands to be based on?

I guess if I could do this over again, it would have been smart to have a webcam hooked up? And maybe taken some screen captures?
Thanks for the discussion.

Thank you, I had a sinking feeling that was the case.

As drc said, dd is not going to help for something with unreadable sectors - which is why ddrescue (and similar utilities like DMDE) are a slight improvement, but there are real limits to what they can do. Some people have great success using them; others not.

Proper disk imaging hardware, as used by professional DR companies, with all the "IP" (i.e. "know how", like proprietary commands) which they include, often give much better results. This is the main reason why DIY cannot cope with a significant proportion of these type of problems, as they are missing that IP. Having said that, a drive which has been dropped may need cleanroom work anyway.

I believe the company I end up choosing to send this drive to will have to take an identical drive and try to put the platters of my drive into it.

Not necessarily - since the problem is that you dropped the drive, the 3 main areas of possible damage are heads (HSA), media & motor/bearings. Damage to the latter may need a platter swap; damage to the first two typically don't.

Having now spent a few minutes reading your choice of ddrescue parameters, the choices might have resulted in sub-optimal results - all depending on what was in the logfile (and on the screen), when each "run" finished (or was stopped by you). For example, you don't want to use the "-C" parameter, until you are sure that the logfile contains the correct last block value, and it's unclear from what you said, whether the previous run finished (and hence wrote that value) or not.

The best choices of ddrescue operations are dependent on the drive behaviour, which means that they are dependent on the results from the previous run. This is one reason why giving suggestions to remote users of ddrescue (e.g. through a forum) doesn't always work very well (depending on urgency, communication issues, etc.). That feedback loop is important, in my experience with ddrescue, and forum readers can't see your PC(s), making the process very difficult.

I hope you can now see why I believe your suggestion of producing an "end all" tutorial (which therefore cannot be interactive and cannot get dynamic feedback to change the suggestions, as any DIY recovery progresses) is an unrealistic target. Your view may still be different, but (as you said), I'm not looking for an argument and we may just have to agree to disagree.

One of many advantages which a DR company has when working on a drive, is that they have the drive in front of them, and are not being asked to do remote assistance. Good luck with whatever you do.