Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

recovering data from a .dd image of a failing hard drive


  • Please log in to reply
5 replies to this topic

#1 NightOnTheWeb

NightOnTheWeb

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:07:02 PM

Posted 12 February 2016 - 12:22 PM

Hi all!

As pointed out in the thread title, i am dealing with a recovering data procedure. It is the firs time i find myself in such a situation and so i have no experience about this. The problem originated when my laptop died suddenly. Now if i try to turn it on i can't even reach the bios screen, that it already shuts down. It was an old device, so i don't mind too much. It was time for it to pass away. However, just 1-2 years ago i bought and put into it a brand new 500GB western digital 72000 rpm 2,5'' hard drive. After the notebook died, i removed the internal hard drive and connected via ata/sata/usb adapter to another computer. I tought i could read the drive and access my files but i was wrong. I got the same messages from windows that another user got here (http://www.bleepingcomputer.com/forums/t/446260/problem-reading-hard-drive-with-usb-adapter/). Windows sees that drive but suggest me to format it.

I read a lot (on this forum and on the internet) about parted magic, ddrescue and testdisk .... but before trying these tools on the 500GB hard disk (or on its .dd image) i care about, i was trying to learn how to properly use them trying to recover another hard disk (a 2,5'' hitachi 250GB hard disk wich is fine and gets recognised when connected via usb adapter; so it's not really a recovery procedure but just a "simulation"). I have some doubts and some questions though. So i decided to open this thread and post to ask for help. The screenshots i will be posting now come from this hitachi hard disk.

The laptop that died was running windows 7 pro.
And the laptop i am now using to try the recover procedure is running windows 7 pro too.
The hitachi 250GB HDD had 3 partitions: one hidden partition of about 8GB and then other 2 partition of the same size (about 111 GB).

I downloaded parted magic, installed it on a USB drive through YUMI installer and get acquainted with this distro. I run ddrescue from ROXTerm and created a .dd image of the drive and saved it on an external 1TB 3,5'' drive. Now, from what i have red on the forum, i think i have to analyse this image with "testdisk" in order to fix the image and then mount it with OSFmount or, alternatively, to access the files inside the partitions of the hard drive.

Question 1: i see that this application "testdisk" is both available on parted magic (linux) and windows. So, do you suggest using one or the other version? If they are both reliable in the same way, i would prefer staying in the windows environment.

Provided that the answer to the previous question is "yes, they are the same, use what you like" i tried to start using testdisk for windows. Since i was not able to use the command line to make to program open the .dd image, i just dragged the image.dd file over the testdisk_win.exe file. And at this point comes my second question.

Question 2: if i use testdisk in windows 7, is it the same if i open the .dd image file with command line or by dragging the file over the .exe ?

Provided that the answer is yes, i proceeded by dragging the file over the .exe and here is what i get:
cb5611464771233.jpg

Question 3: Does everithing in this screenshot seem ok to you?

I clicked [proceed] and got this screen:
74fe54464771441.jpg

I cliked [intel] and got this screen:
eb8274464771670.jpg

The name/mumber and size of the partitions looks ok. The hitachi hard drive had one hidden partion (for recovering the

windows system) and two other partitions of the same size (the first was the C drive with windowns installed on it and the

other was just a partition used for data). So i clicked [quick search] and the process started:
d4b48a464772465.jpg

After the quicksearch finished i got to this screen:
c549be464772833.jpg

Question 4: How is it that, after the quick search, i only get 2 partions, when in the previous step i saw all the 3 expected partitions? Does this means something? I was expeting to find 3 partition at this point too ...

At this point i think i have to proceede for a deeper search by pressing the "enter button". But what line/partiotion should i highlight before pressing enter to make the deeper search start?

Question 5: I mean, if i press enter when i am here ...
c549be464772833.jpg
... or when i am here ...
7b5512464773774.jpg
... is it the same?

Provided that it is really the same, i pressed enter without caring about which of those two line was highlited and this is

the result:
76d70a464774340.jpg

I clicked Deeper Search and during the process this was the appereance of th window:
48cf0a464774913.jpg

At the end of the Deeper Search this was the result:
c38f8f464775295.jpg

What is the meaning of all this? Six partitions? Can someone explain me what i see in this window?

Thanks in advance.



BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,945 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:02 PM

Posted 12 February 2016 - 01:49 PM

Hi

I received your email.
The problem with your situation is that you mentioned the data is VERY important to you and the nature of the drive's failure is of a manner that has a high probability of electromechanical damage.
I can not recommend that you proceed on your own and suggest that you take it to a professional data recovery lab.
Since the laptop completely died while the drive was in it (Can't even see BIOS or POST) and the drive itself is inoperable it has the symptoms of an electrical surge of some sort or perhaps a drop.
You have not provided any S.M.A.R.T. data from the drive so I can only assume that you were unable to access it. This is another red flag that a DIY repair would be very risky to whatever data may still be on the drive.

I am not sure which of my guides you are following (I have not updated any ddrescue guides in years) but I believe they all have the additional step of checking the contents of each partition to identify and recover the data. You seem to stop before doing that. If you can see the data then you would proceed with a recovery via TestDisk rather than repairing the image file.

I wish I had a better answer for you,
James



#3 NightOnTheWeb

NightOnTheWeb
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:07:02 PM

Posted 12 February 2016 - 02:10 PM

Hi James!

 

Thank you really much for taking some tim to get into this thread. I really appreciate it.

 

I might have used world improperly. The data i would like to recover are not a matter of "life or death". Fortunately i use dropbox and other cloud computing services so, the REALLY MOST IMPORTANT DATA were already backed up. However there is still something i would like to try to retrieve. I don't think that these data are valuable enough to send the HDD to a recovery center. But these data are worthy enough to learn a give a try something.

 

As you pointed out, i completely forgot to see the SMART data of the HDD... my bad. I downloaded and installe crystaldisk info and this is the tab of the 500GB western digital HDD:

2a343c464803915.jpg

 

I am pretty relieved to see that it seems not in bad conditions. What do you think? If you suggest me to use another software o get SMART data, tell me and i will do it.

 


 

You seem to stop before doing that. If you can see the data then you would proceed with a recovery via TestDisk rather than repairing the image file.

 

Yeah, i stopped at some point because i didn't know if the road so far was ok. It is everything new to me and i wanted to hear an opinion about the step i have accomplished. By the way, i am just working on a HITACHI HDD to understand the software.

 

I will try to create a .dd image of the 500GB western digital hard disk tomorrow morning.



#4 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,945 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:02 PM

Posted 12 February 2016 - 02:45 PM

Hi

 

In that case, run TestDisk with the drive connected rather than imaging it and after the QUICK SEARCH see if your files/folders are visible. If they are then recover the ones you need to another drive from within the TestDisk interface.

If you don't see them then do the DEEPER SEARCH and see if they appear in any of the partitions found.

If not, then you will need to use something other than TestDisk.

 

If you do see your files/folders then you can recover them to another drive using this technique...

 

Get to the step where you see your files and folders in TestDisk.
There are directions at the bottom of the screen in TestDisk. I like to do a test first and try to copy just one file or folder to see if it works.

Select a file or folder that you’d like to try copying by highlighting it. (To go inside folders, highlight them and press the right arrow key on your keyboard. To go up a level highlight the line with two dots .. and press enter.)
Press the colon key to select it
:
and then press upper case C to copy all selected files
SHIFT-C

Now it wants to know where to copy the file to.
Highlight the second line which is .. (two dots) and press the right arrow key and it will take you up a level.
Keep doing this with the line with two dots until eventually you will be at the top of the hierarchy and will see a list of the drives connected to the computer. Then you can drill down to where you want the recovered files copied to by highlighting and using the right arrow key.
When you get to where you want them copied, highlight the row with one dot . and
Press
SHIFT-C
and it should copy the files/folders there.

Leave everything open and look in the Windows Explorer to verify that the file was copied. If it is there, go back to the TestDisk window and select more files and folders that you want to copy and when you choose to copy them it will put them in the location that you already chose.

 

Then once you recover the files you need you can select to repair it and if that does not work you can try chkdsk without worrying about losing data because you will have already recovered copies of the files that were important.

 

Hope this helps

James



#5 NightOnTheWeb

NightOnTheWeb
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:07:02 PM

Posted 13 February 2016 - 05:57 PM

Hi James,

 

thank you again for taking the time to check in here :-)

 

 

Get to the step where you see your files and folders in TestDisk.
There are directions at the bottom of the screen in TestDisk. I like to do a test first and try to copy just one file or folder to see if it works.

Select a file or folder that you’d like to try copying by highlighting it. (To go inside folders, highlight them and press the right arrow key on your keyboard. To go up a level highlight the line with two dots .. and press enter.)
Press the colon key to select it
:
and then press upper case C to copy all selected files
SHIFT-C

Now it wants to know where to copy the file to.
Highlight the second line which is .. (two dots) and press the right arrow key and it will take you up a level.
Keep doing this with the line with two dots until eventually you will be at the top of the hierarchy and will see a list of the drives connected to the computer. Then you can drill down to where you want the recovered files copied to by highlighting and using the right arrow key.
When you get to where you want them copied, highlight the row with one dot . and
Press
SHIFT-C
and it should copy the files/folders there.

Leave everything open and look in the Windows Explorer to verify that the file was copied. If it is there, go back to the TestDisk window and select more files and folders that you want to copy and when you choose to copy them it will put them in the location that you already chose.

 

Thank you for these indications. Tomorrow i will try to run testdisk and see what happens. Today i didn't have the time to run the quick search / deeper search, but i will do that tomorrow. However today i tried to run (in the terminal of parted magic) the fdisk -lu command and found an interesting result for the "bad" hard disk:

78a47c465060752.jpg

 

The thing i didn't expect to find is that the total number of sectors of the drive is 122'096'646 is lower than the number of sectors of each partition (this "bad" drive had 2 primary partition of the same size). One partition has 614'400'000 sectors and the other partition has 362'371'072 sectors. Moreover, the size of the drive is indicated as 465,8 GiB (which is totally correct) but the size of the two partitions is 2,3 T and 1,4 T.

So i got curious and launched GParted from the parted magic live distro and this is the result:

78d8ce465061545.jpg

 

Do you think that these little more information allows us to say something about the condition of this hard disk and about what happened?



#6 NightOnTheWeb

NightOnTheWeb
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:07:02 PM

Posted 16 February 2016 - 07:08 PM

After a couple of days working on this problem i might have finally solved it.

 

Since i asked here for some help, it seems more than reasonable to post how did it end up. I hope my experience could be of help and hope to some others in the future.

 

I decided to first create a .dd image with Parted Magic. I used an external HDD connected via USB2 to store such .dd image. It took about 6-7 hours (the image is about 500GB).

 

Then i used testdisk on the image. The quicksearch was able to find all i was searching. No need for deeper search. Moreover the quicksearch was really fast, it took only a bunch of seconds.

 

Finally i choosed the folders i wanted to recover and copied them to the external HDD. A truecrypt file of 100GB took about 4-5 hours to copy but another folder of about 60GB took 24-30 hours. No clue about why this time difference. Maybe because the 60GB folder was full of video files downloaded from the internet (so they had the relative :Zone.Identifier file)?

 

Now i think i might have finished the recover procedure. I don't think i need to try to restore the partition table directly on the hard disk, because the notebook from which it came from is dead and i just need the data. I will just format the drive and put it into a brand new laptop.

 

The only think that is really bothering me is that i found a lot of :Zone.Identifier files. I searched the weba little bit to get some information about these. I would like to simply delete them, but i would like not to compromise the file they refer to. What do you think about this?

 

Moreover i noted that if i try to copy the recovered folders (now on the external HDD) on the internal HDD of another PC, the :Zone.Identifier files are not copied. Windows says something about the origin of the :Zone.Identifier file cannot be found ... rather than simply deleting the :Zone.Identifier files i am thinking of copying all the data i have recovered to another PC to make these file disappear. Do you think this is a proper way of doing this?

 

Thanks in advance,






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users