Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trouble with making + mounting a DD image of a failed drive


  • Please log in to reply
No replies to this topic

#1 Bukinnear

Bukinnear

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:37 PM

Posted 02 January 2014 - 02:22 AM

Good afternoon,

I have a client's HDD which has failed and I am in the process of trying to get data off of it. Problem being that the drive is so far gone that I can attach it to either windows or linux, but I cannot access the data on either. Windows will freeze and crash a minute or so after it is connected and faster still if I prompt it to access the drive any faster (eg. through the Disk manager). I cannot mount the drive under linux (using parted's gui for mounting), when I try it tells me that the filesystem is inconsistent and that it cannot read the drive.

I have tried to take a DD image of the drive using the following command on a parted magic live CD:

ddrecue -r 3 /dev/sda2 /media/"Client Backup Data"/backup/image.dd /media/"Client Backup Data"/backup/rescuelog.log

it seems to have worked up to the point where it starts splitting blocks - the output of DD is as follows:

 

GNU ddrescue 1.16

Press Ctrl-C to interrupt

Initial status (read from logfile)

rescued: 624660 MB, errsize: 513 MB, errors: 704

Current status

rescued: 624660 MB, errsize: 513 MB, current rate: 0 B/s

ipos: 101791 MB, errors: 704, average rate: 0 B/s

opos: 101791 MB, time since last successful read: 26 s

Splitting failed blocks...

 

(note that I interrupted it; it was transferring at a reasonable rate before it started splitting). It has been recovering for about 2 days solid now. I stopped it this morning when I came in, the last successful read was 2.9 hours prior. It's possible that I could leave it and let it try to recover the bad sectors, but I don't want to stress the drive any more than I have to. (silly thing to say after 2 days of running, I know.) Plus I'm impatient.

If I specify --no-split, it finishes, obviously, but I cannot mount it. fdisk -l gives me the following output:

 

Disk /media/Client Backup Data/backup/image.dd: 625.2 GB, 625173594112 bytes

255 heads, 63 sectors/track, 76006 cylinders, total 1221042176 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk identifier: 0x6e697373

This doesn't look like a partition table

Probably you selected the wrong device.

Device Boot Start End Blocks Id System

/media/Client Backup Data/backup/image.dd1 ? 1936269394 3772285809 918008208 4f QNX4.x 3rd part

/media/Client Backup Data/backup/image.dd2 ? 1917848077 2462285169 272218546+ 73 Unknown

/media/Client Backup Data/backup/image.dd3 ? 1818575915 2362751050 272087568 2b Unknown

/media/Client Backup Data/backup/image.dd4 ? 2844524554 2844579527 27487 61 SpeedStor

Partition table entries are not in disk order

 

I thought that this was a direct image of /dev/sda2, which should be the (582 gb) OS partition (I wanted to skip the system and HDDrecovery partitions since that they mount fine under linux.) So there shouldn't be any other partitions.

I tried mounting it under linux, but I'm not good enough with the system to understand what I am doing/doing wrong (needless to say that it didn't work). I also tried mounting the image on Windows using Imdisk - the disk appears but isn't accessible. I tried a chkdsk, but it tells me that it cannot find the MFT. It tries to recover it then fails.

Judging by the rescued data size, it looks like it's recovered the whole of sda, not just the partition, although that might also be the difference between bits and bytes.

Is there someone here who knows what is going on here - I'm still in the learning phase of linux + it's functions, I think this is one of the only ways I can do the recovery as I can't use my data recovery tools under windows and testdisk can't read the file system under linux (using a quick scan, it finds the partitions, but can't list the files). I don't know/have any more recovery tools for linux outside of that.


Edited by Bukinnear, 02 January 2014 - 02:22 AM.


BC AdBot (Login to Remove)

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users