Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Failing hard drive recovery


  • Please log in to reply
3 replies to this topic

#1 Caitiri

Caitiri

  • Members
  • 2 posts
  • OFFLINE
  •  

Posted 05 May 2014 - 03:04 PM

Hello,

I believe my internal hard drive on my laptop (Asus K55A running Windows 8) has begun failing and I need some help determining the best process to try to recover the data. I have already attempted to begin the process using SystemRescueCD and ddrescue, but I don't feel comfortable moving forward without getting some advice first.

First, some background:
The first problem presented itself when my computer started running extremely slowly and hanging for minutes at a time. Checking the usage and performance statistics in the task manager, I found that the disk was constantly running at 100%. The process responsible for this appeared to be the windows search indexer - the index database file was growing in size and stopping the search utility seemed to resolve the problem temporarily. Eventually, however, the search indexer would start again and the problem would return.

In an effort to eliminate the problem, I stopped the search utility, deleted the database file, and attempted a chkdsk on the hard drive (per advice found online). The first chkdsk did not complete, however, and after the second attempt completed and the computer restarted the problem was worse than ever. The disk was still running at 100%, and stopping the search service no longer seemed to fix the problem, even temporarily, and it was still present even when booting into safe mode.

At this point, a Windows message appeared stating that the hard drive was failing and I should back up my data. I initially attempted to do this using Windows utilities, but was largely unsuccessful. At some point I attempted to restart my computer and could no longer boot into Windows, even after several attempts. I did manage to boot into Windows again the next day and transfer some files, but at this point I had started to look into alternate recovery options and realised the methods I was using could be doing additional damage to my hard drive.

I then started looking for a Linux system I could run off of a bootable USB and ended up settling on SystemRescueCD. Since then I have been running SystemRescueCD and using the ddrescue tool to attempt to recover the data from my hard drive.

What I've already done:
The hard drive I am trying to recover has two primary partitions, one containing the OS and data, the other containing photos and other files. The photos/files on the second partition are much more important to me than the data on the other partition, so I chose to try to recover the partitions separately (and the more important one first), rather than recovering the entire hard drive all at once. This made sense to me at the time, but I don't know if it was really the best choice or not.

Attempting to recover the first partition (sda2) to a suitable partition on an external drive (sdb2) I ran:

ddrescue -f -n /dev/sda2/dev/sdb2 logfile2

ddrescue -d -f -r2 /dev/sda2 /dev/sdb2 logfile2

After this, the error size was down to 51134kb. I have not performed any other test or check operations on this partition. Briefly reviewing the data on the new drive, there appears to be about 20GB that I can't access (summary shows 153GB used, but only about 130GB appears in the file list; at least one folder that should be present no longer appears in the file list of either the new or old drives).

As for the second (OS) partition, reviewing this partition in GParted shows an error stating "Unable to read the contents of this file system!" And after running

ddrescue -f -n /dev/sda1/dev/sdb1 logfile1

there was an error size of 128GB (total size 279.11GB). I haven't done anything further with this due to the large error size.

Any recommendations regarding the best way to proceed with recovering the data from this drive would be appreciated. I am happy to provide any additional information that is necessary.

Thanks,
Ross

BC AdBot (Login to Remove)

 


m

#2 Kilroy

Kilroy

  • BC Advisor
  • 3,284 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Launderdale, MN
  • Local time:09:17 AM

Posted 05 May 2014 - 03:21 PM

Copy off data you can read before you start trying to get data that you are having issues reading.  Once you start getting the drive failure warnings you may have one more boot or the drive may last for years.

 

Are you moving the data off of the disk?



#3 Caitiri

Caitiri
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  

Posted 06 May 2014 - 07:24 AM

@RKilroy: Yes, I am copying the data off of the disk. ddrescue is specifically designed to copy the easily read data before focusing on the problem areas.

@henrypolards: Thanks for the suggestion. I will look into that option.

#4 zingo156

zingo156

  • BC Advisor
  • 3,333 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:17 AM

Posted 13 June 2014 - 09:27 AM

Let me say that you have done everything correctly, also DDrescue is one of the best utilities to recover data. That being said, any error rate can cause corruption. You can set ddrescue to run several passes both forward and in reverse I suggest doing this.

 

Some things I do to increase data recovery, put a heat sync on the hard drive (on the metal top, leave it outside of the computer) with a fan to keep it cool, I had a drive that copied 345GB this way non stop but would otherwise fail at around 10GB, it was getting too hot, the heat sync fixed that issue.

 

As a last resort after getting as much as you can, you can freeze the drive, put it inside of a ziplock bag, put it in the freezer for a good 5 hours. Take it out hook it up and run recovery again on the important files first, I suggest after freezing to try and recover data from linux first direct copy, not ddrescue. One particular hard drive recovery I did in the past I could get about 10 minutes of direct copy after freezing the drive then it would disappear from the computer. I had to re-freeze the drive again to use it. It took me 3 days to recover all of the important files but I did get them. Freezing rarely helps much but it is always worth a shot. Just be warned that condensation could cause the drive to fail completely so this is an absolute last resort.

 

If data is needed and can not be risked you are better off sending it in to Drive Savers or Ontrack Data Recovery before freezing the drive. It isn't cheap ~$1000 but they can take the drive apart in a clean room to recover data.

 

I have never had any better luck with other recovery tools... DDrescue is the best I have found yet so I can not advise you on anything better. Maybe others have had different experiences.


Edited by zingo156, 13 June 2014 - 09:32 AM.

If I am helping you with a problem and I have not responded within 48 hours please send me a PM.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users