Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trouble Rescuing Files from Failing Seagate HDD


  • Please log in to reply
10 replies to this topic

#1 kpdonahue85

kpdonahue85

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 27 March 2013 - 09:38 PM

Hello All,

 

I have a Seagate 2.5" eSATA internal HDD from a laptop which crashed about two years ago, and I am trying to recover the data stored on it.  The drive will not boot, nor will a system restore work. I have tried many methods with very limited success.  I bought an adapter for usb-to-sata, but most programs freeze or hang up when I try to scan the drive for files and Windows 7 can't even seem to see the drive behind the adapter.

 

I have had some success using Paragon Rescue Kit 11.  I put the HDD back in its original laptop and ran the Rescue Kit from a bootable cd-rom.  I attempted to repair the MBR and boot from the HDD, but this did not work.  I tried the file transfer utility, and after a painfully long wait, it was able to read the drive.  I actually managed to transfer a folder over to an external harddrive, but I received many error messages saying certain files were unreadable and thus were not transferred.  It also does not seem to have found everything on the drive.

 

As far as I can tell from reading the screen when Rescue Kit 11 is trying to find the drive, it keeps attempting to read the same spot over and over again.  I am not sure if it eventually succeeds or just gives up.  This leads me to believe that this is also what is causing the other software I have tried to freeze for several minutes and then (sometimes) eventually detect the drive.  In general everything takes a huge amount of time to read it.  However, when running the file transfer utility, I saw it hang up over and over again while returning errors, then suddenly copy an entire gigabyte with no issues at all.  I don't know if this problem is physical or if the data is just corrupt, but there are no clicking sounds and the PCB is freshly cleaned with no signs of burnt components.

 

So are there any suggestions for how to recover my data?  Or thoughts as to what the problem could be?  I have not tried any sort of partition recovery for fear it will make things worse.  I also have not tried any imaging software yet, since at the slow rate the drive is reading, creating an image would take days.  It would be great if I could simply make an image and then clone it onto a physically functioning drive, if in fact mine has only physical problems.

 

Thanks.



BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:07:09 PM

Posted 27 March 2013 - 09:56 PM

Hi

 

Sounds like bad sectors.

 

You could make an image with GNU ddrescue which would grab all the good sectors first and then start working on the bad sectors. That way you can stop it, try to recover files from the image and if you need more just start ddrescue again with the log it made and it will resume trying to get any bad sectors that it is still missing.

 

It will probably take less than an hour per 100GB for the good sectors and could take weeks for the bad ones depending on the settings you use.

 

James



#3 kpdonahue85

kpdonahue85
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 27 March 2013 - 10:50 PM

Thanks for the quick response James!  I will definitely give that a shot, rescuing the system would be ideal but getting whatever good files are left asap will be great.

 

I don't know if it matters or not, but when the laptop originally crashed (probably due to overheating) I tried to do a restore from the boot menu, which failed.  Could this have messed up the partition or something?  Again, I'm not sure if it's significant, but when Rescue Kit finds folders on the drive, it seems that all the files and folders which I created directly on the C: drive are prefectly fine, whereas all of the windows-related directories (Documents and Settings, Program Files, etc.) appear but are empty.  I haven't thoroughly tested this pattern due to the cripplingly slow read time it takes just to change directories, but it seems odd.

 

Sorry to complicate things even more!



#4 LCS_Tech

LCS_Tech

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Missouri
  • Local time:07:09 PM

Posted 27 March 2013 - 10:59 PM

There is a chance that during the recovery windows moved everything into a directory on the C drive named "Windows.old". Take a look and see if that directory exists. If it does your personal files might be located there.

 

Another option (and one that I have used successfully in the past) is a utility called Recuva. It has helped me many times recover lost data. You can view their webpage by clicking here.

 

Loosing your data is a terrible thing and I really hope you can recover your missing files, There's an old saying from the IT industry.... "Backup, Backup, Backup." There are several free utilities out there to help you make regular backups of your files. One of my favorites is EaseUS Todo Backup. It is super easy to use and doesn't cost a dime.

 

Best of luck to you.



#5 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:07:09 PM

Posted 27 March 2013 - 11:29 PM

Sounds like bad sectors affecting the file system's meta files (hidden files that keep track of things like what directory a particular file is in). I could be wrong, though :)

 

If you need help with ddrescue, let us know. Here's some directions I wrote up a while ago...

http://fixit.litten.com/datarecoveryflowchart.htm#flow6

 

James



#6 kpdonahue85

kpdonahue85
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 27 March 2013 - 11:41 PM

Thanks guys!  You've been a big help, I'll try those programs and see how it goes.  No such luck with that Windows.Old directory though, it doesnt seem to exist (the OS on the crashed system was Vista btw, in case that affects where things get put).



#7 LCS_Tech

LCS_Tech

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Missouri
  • Local time:07:09 PM

Posted 27 March 2013 - 11:46 PM

That stinks, it was a shot in the dark. Looks like you're going to have to go for a full on recovery. You can try the software James Litton recommended. These guys here know what they're talking about. But if you have issues give recuva a try too.



#8 kpdonahue85

kpdonahue85
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 29 March 2013 - 04:21 PM

Ok, I have some follow-up questions:

 

I think I understand how to use ddrescue, but one thing I can't quite figure out yet is how to make absolutely sure it is writing to an image file and not overwriting any of the existing data on the external drive I will be using to copy my failing drive onto.  I haven't tried anything yet, but lets say I use SystemRescueCD or some other bootable disk and my failing internal drive is detected as dev/hda and my external drive is detected as dev/hdb.  If I were to type the following:

 

ddrescue /dev/hda /dev/hdb/recovery/image1.dd /dev/hdb/recovery/image1log.log

 

would it run, create a directory called "recovery" on my external drive, and then create an image of the internal drive called "image1.dd" and a logfile called "image1log.log" in this new directory?  If not, how can I get this to happen?

 

I would like to make images of the main partition on the drive as well as the recovery partition, in the hopes that I might be able to clone these onto a new internal drive, where I could attempt to repair them.  My next question is whether or not I should make a quick image of the good blocks of data (maybe with the "no splitting" option enabled), and then duplicate this image file and run further iterations of ddrescue having it write onto the duplicate file.  Would this improve my chances of not corrupting any more data?  It seems like it would be easiest on the failing drive to read it as little as possible at first, so either way I will at least extract what I can from the quick image before going any further.  Does it make sense to keep a copy of this file unaltered though, or am I just as well off getting what I can from it and then letting it be overwritten instead of bothering to keep the copy?

 

I plan to run many iterations of ddrescue to save as much data as possible, but I am worried that this will put stress on the drive and possibly corrupt some sectors that were fine at the time of the original imaging process.  This shouldn't matter if ddrescue never bothers to reread these sectors, but I'm not sure whether or not it will try to mark them as bad if they become damaged later and then start wasting time trying to rescue information that it has already found.  Basically, I don't see what ddrescue will do if the data on the drive changes somehow between sessions when I am continuing the recovery from a log.

 

Hopefully these are my last questions to ask!


Edited by kpdonahue85, 29 March 2013 - 04:34 PM.


#9 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:07:09 PM

Posted 03 April 2013 - 09:40 AM

Hi

 

ddrescue tries to make an exact copy of the disk.

That way, you can recover deleted files and partitions from the copy just like you can recover them from the original disk.

The ddrescue command looks at each piece of data on the bad drive and copies it to the good drive. If it comes across a bad piece of data it skips it and continues getting all of the good data. After getting all the good data it goes back to the bad pieces and tries to recover them. The log file keeps track of the process and allows you to start where it has left off if it is interupted by a crash or power outage or you want to stop it for awhile and resume later. This all alows you to attempt to recover as much as possible from the drive in the most gentle way.

 

James



#10 kpdonahue85

kpdonahue85
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 04 April 2013 - 05:43 AM

Good, I won't worry about whether or not I'm hurting my drive then (I tend to overthink these things lol).  Anyway, I will probably just work from one image, but did that look like the correct syntax to have ddrescue create an image file?  I've actually never seen a *.dd file before but I saw it in the guide that was posted earlier in this thread, so I'm assuming that's the correct extension for the disk image.

 

Thanks again!



#11 kpdonahue85

kpdonahue85
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 16 April 2013 - 02:06 PM

Status Update:

 

I have tried ddrescue and made an image called hdrescue.img.  Unfortunately, I can't seem to get it mounted.  Here is what I've tried:

 

I have an external hardrive /dev/sdb mounted to /root/mnt/sdb1 which has the image file on it. I tried the command

 

mount -o loop /root/mnt/sdb1/RECOVERY/hdrescue.img /root/mnt/sdb2

 

attempting to mount the image file, but I got the error message

 

NTFS signature is missing.

Failed to mount '/dev/loop1':  Invalid argument

The device '/dev/loop1' doesn't seem to have a valid NTFS.

Maybe the wrong device is used?  Or the whole disk instead of a

partition? (e.g. /dev/sda, not /dev/sda1)?  Or the other way around?

 

So, I used fdisk to check both the original physical drive and its image to see where the partitions started.  They agreed, and said that the first partition started at 63.   I tried this as the offset and it failed, but this was my fault for using the wrong units!  Parted helped me find the correct offset in bytes.  Using this I was able to get my disk image to mount!

 

Unfortunately, even though I was able to rescue most of my 200GB drive (only a 315MB error size), I am still unable to read some important directories on the disk image (like Program Files, My Documents, and Windows).  When I attempt to browse these directories using the ls command, I receive the error:

 

ls: reading directory .: Input/Output error

 

This is rather unfortunate, since these directories contain much of what I am trying to save!  They are the same directories that would not read when I was using Paragon Rescue Kit weeks ago.  However, since the error size is so small, I know that most of the files in these directories are pretty much intact.  I can also now access the good data without the slow read time, which is nice.  

 

The only idea I have at this point is to try to boot from a new disk with the image file that I made written onto it, then attempt a system restore from the other partition (which does not give any I/O errors when I browsed its folders).  Are there any better ways I can proceed?  Is there software I could use on my disk image to try to correct it?  Or to allow me to do a system restore using only the image file and not a physical disk?  Or just to rescue common file types without fixing it?  Please help!

 

Thanks.


Edited by kpdonahue85, 16 April 2013 - 02:56 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users