I have a client's HDD which has failed and I am in the process of trying to get data off of it. Problem being that the drive is so far gone that I can attach it to either windows or linux, but I cannot access the data on either. Windows will freeze and crash a minute or so after it is connected and faster still if I prompt it to access the drive any faster (eg. through the Disk manager). I cannot mount the drive under linux (using parted's gui for mounting), when I try it tells me that the filesystem is inconsistent and that it cannot read the drive.
I have tried to take a DD image of the drive using the following command on a parted magic live CD:
ddrecue -r 3 /dev/sda2 /media/"Client Backup Data"/backup/image.dd /media/"Client Backup Data"/backup/rescuelog.log
it seems to have worked up to the point where it starts splitting blocks - the output of DD is as follows:
GNU ddrescue 1.16
Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued: 624660 MB, errsize: 513 MB, errors: 704
rescued: 624660 MB, errsize: 513 MB, current rate: 0 B/s
ipos: 101791 MB, errors: 704, average rate: 0 B/s
opos: 101791 MB, time since last successful read: 26 s
Splitting failed blocks...
(note that I interrupted it; it was transferring at a reasonable rate before it started splitting). It has been recovering for about 2 days solid now. I stopped it this morning when I came in, the last successful read was 2.9 hours prior. It's possible that I could leave it and let it try to recover the bad sectors, but I don't want to stress the drive any more than I have to. (silly thing to say after 2 days of running, I know.) Plus I'm impatient.
If I specify --no-split, it finishes, obviously, but I cannot mount it. fdisk -l gives me the following output:
Disk /media/Client Backup Data/backup/image.dd: 625.2 GB, 625173594112 bytes
255 heads, 63 sectors/track, 76006 cylinders, total 1221042176 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6e697373
This doesn't look like a partition table
Probably you selected the wrong device.
Device Boot Start End Blocks Id System
/media/Client Backup Data/backup/image.dd1 ? 1936269394 3772285809 918008208 4f QNX4.x 3rd part
/media/Client Backup Data/backup/image.dd2 ? 1917848077 2462285169 272218546+ 73 Unknown
/media/Client Backup Data/backup/image.dd3 ? 1818575915 2362751050 272087568 2b Unknown
/media/Client Backup Data/backup/image.dd4 ? 2844524554 2844579527 27487 61 SpeedStor
Partition table entries are not in disk order
I thought that this was a direct image of /dev/sda2, which should be the (582 gb) OS partition (I wanted to skip the system and HDDrecovery partitions since that they mount fine under linux.) So there shouldn't be any other partitions.
I tried mounting it under linux, but I'm not good enough with the system to understand what I am doing/doing wrong (needless to say that it didn't work). I also tried mounting the image on Windows using Imdisk - the disk appears but isn't accessible. I tried a chkdsk, but it tells me that it cannot find the MFT. It tries to recover it then fails.
Judging by the rescued data size, it looks like it's recovered the whole of sda, not just the partition, although that might also be the difference between bits and bytes.
Is there someone here who knows what is going on here - I'm still in the learning phase of linux + it's functions, I think this is one of the only ways I can do the recovery as I can't use my data recovery tools under windows and testdisk can't read the file system under linux (using a quick scan, it finds the partitions, but can't list the files). I don't know/have any more recovery tools for linux outside of that.
Edited by Bukinnear, 02 January 2014 - 02:22 AM.