Data recovery with Photorec, Testdisk and/or ddrescue...?
Hi all,
I have a physically failing Hitachi 250GB Sata hard drive from my Dell laptop (Vista 64bit OS). I've already put it in an external enclosure and have been using a variety of Linux rescue CDs to see the partitions, etc. (since Windows can't see the drive and hangs when trying). I am a noob at Linux however...and at hard drive stuff too. I am keeping the drive on ice packs to avoid overheating and additional damage.
I've been running Photorec and managed to recover a whole variety of files, except of course the two Open Office (.odt) files I most desperately want. The Photorec log shows input/output errors as it tries to read sectors. I know there are a whole variety of bad sectors and the drive seems to physically have more difficulty at the beginning of the NTFS partition with all the data. I have done basic analysis with Testdisk as well but didn't want to try file system repair before getting everything I could off the disk.
So here are my questions (please pardon errors in terminology - I'm still learning):
1. Will other approaches besides Photorec be likely to recover more or different data? Things like Testdisk or ...? Would repairing the filesystem (if possible) make fragmented data more likely retrievable since the size/location of files might be recovered?
2. Would it be worth using ddrescue (Diaz' version) to either image or clone my drive before playing around with filesystems? And is an image or file-type copy better?
3. If ddrescue is worth trying, how do I set up my external target drive? I have a WD external HD that is the same size as my failing laptop drive. I recently wrote zeros to it to erase all data however, so it has no partition table. To do either the image or the file copy, how should I reformat/partition my WD HD (fat32? NTFS? multiple partitions or one big one?)? And if I only image the main NTFS partition of the failing drive, will I still be able to use tools like Testdisk on the image?
3. Is data that you use frequently more likely to be at the beginning of the partition? I don't quite get how data is stored on a hard drive. My drive was pretty new so I'd only used a small portion of the 250GB. Can I focus on the first part of the partition with Photorec, etc. or do I need to run it through the entire drive?
Thanks so much for your time!
Jen
Since it's a Windows
Since it's a Windows formatted drive, probably most of the data is at the beginning, but some of it may be scattered around or at the end - it's a crapshoot.
You definitely need to image the drive. Applications like Photorec don't work well on failling hardwar e- you need to use the right tool for the job. Use photorec on the image after it's done if it's incomplete and you can't mount it.
Image it from disk to disk. Make sure the target is the same size or slightly larger. If the partition table is broken on the target drive once you have imaged all you can from the source drive, try Testdisk to create a new one from the partitions it can detect.
Thanks so much for your
Thanks so much for your reply!
Should I format my external drive to image the drive as ext2, fat32, or NTFS? Or does it matter?
Thanks again!
Jen
It doesn't matter - you will
It doesn't matter - you will be copying the original drive and that means you get its partition table and filesystem(s). If they are only partially copied, then you will need to repair them or use data-carving tools (like photorec) to get them out from the image.
If your target drive were
If your target drive were bigger, for example, 1 Terabyte, you would not want to write the source drive onto the target like that. That would mean that you couldn't use the extra space (1000-250=750 Gigs of waster space).
How do you get around that? You would format the drive to a filesystem that can handle large file size (not FAT) and image the source drive as a file.
The splitting of failed
The splitting of failed blocks after the initial run of ddrescue was going at about 2KB per second on a 250GB drive so I thought it might be worth seeing if I got anything before letting it run indefinitely. I read in one of your other posts that you can stop the ddrescue imaging to try and mount the image and see what you got and then restart as appropriate. (Post was here: http://ubuntu-rescue-remix.org/node/49 )
When trying to mount using
% mount -r -o loop /mnt/External/imagefile /mnt/recovery
it asks for the filesystem type. The External hard drive was formatted with ext2 and then the image of my NTFS partition was imaged on to it. What filesystem type do I use for the mount command in this case?
I tried -t ntfs but it said
"mount: wrong fs type, bad option, bad superblock on /dev/loop1.
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so "
I wasn't sure what all this meant...should I try a little data carving to see what I might have found? Use a different file type? Or simply return to ddrescue?
Also, if I was running
% ddrescue -d -r 3 /dev/sdb3 /mnt/External/image /mnt/documents/rescue.log
when I interrupted the process, would I simply add the -C to resume or would I drop the -d?
Thanks so much for your ongoing help here!
Since it's splitting, it
Since it's splitting, it doesn't matter how you restart the command. How big is the errorsize?
And 2KB/sec is great. I always assume a drive that is putting out data is doing so for the last time and I try to never interrupt.
You imaged the whole drive as an image file? You need to mount the partition, not the whole drive. Run mmls to tell you how many blocks after the beginning of the image is the beginning of the partition you want to mount. Typically, a windows machine will format a single NTFS partition on a drive and put it at 63 blocks. So to mount that partition which is within the image you run:
sudo mount -t ntfs -o r,loop,offset=32256 /mnt/External/imagefile /mnt/recovery
https://help.ubuntu.com/community/DataRecovery#Mounting%20partitions%20on%20the%20image
The ddrescue error size is
The ddrescue error size is pretty big. 82666MB with 14395 errors. About 154 GB rescued out of the 236GB partition. It is slowly rescuing more. It has rescued an additional 70MB overnight. Only problem is that if it stays at this current rate, it will take years to go through the whole drive! I'm pretty sure the files I want are near the beginning though, so maybe if it gets through the first 10GB or so, I could check for results. Is it likely to speed up as it gets to less damaged areas?
I only imaged the critical NTFS partition where I know all the data lived, sdb3, so I assume I shouldn't need the offset?
Yes, it will speed up as it
Yes, it will speed up as it gets past the bad spots. But with an errorsize that big, I would forget trying to mount the filesystem and just go straight to file carving. Foremost does better at filecarving a partial filesystem than Photorec.