13

I have a Seagate drive (ST3400832AS 3.03) that failed very badly without warning. Woke up to find the computer had come out of sleep during the middle of the night and rebooted. Checked the event log and it was flooded with NTFS errors. For various reasons I don't have a recent backup of this particular data, so I need to do it the hard way.

I initially managed to get a few files off the disk at about 1kbps (kilobits, not bytes) before the drive dropped off and showed as uninitialised.

So far I've tried the following…:

  • TestDisk - Detects old partition information, then just hangs.
  • Spinrite - Was an exercise in futility.
  • HDD Regernator - Drive becomes 'not ready' after about 2-3 minutes of pre-scanning.
  • Seatools - What a joke; all tests showed the drive as okay.

…along with a few other raw copy programs.

So far, it seems that, whenever the drive is taxed too hard for too long, it just crashes out. Does anyone know of a piece of software that can perform a restartable raw copy of a disk drive? I don't mind if I have to restart the copy a dozen times, but, with everything I've tried so far, it's been a case of restarting from scratch each time. It's not much use only getting the first few GB of data over and over. So something slow, persistent, and with a resume function would be of great help.

On a side note, this was a secondary internal drive, not an external one.

  • 1
    I've had success with freezing a hard drive, but I don't know why so I can't seriously recommend it. – Bobson Jun 30 '14 at 20:23
  • 3
    What was the problem with SpinRite? I've seen it need to run literally for days to fix a drive. – Dennis S. Jun 30 '14 at 20:38
  • 2
    @Bobson reminds me of a crash I had several years ago. Was sitting with ice and a hot fan, recovering all data successfully while either colling the disk down or warming it up when it got too cold #D // Back to topic: Start taking a look at the data-recovery tag-wiki at Android.SE, has a bunch of helpful hints applying to hard-disks as well. – Izzy Jun 30 '14 at 21:57
  • 1
    @DennisS. It never gets more than dozen or so sectors into the disk before just sitting there doing nothing. Even if left for 12+ hours – Christopher Ferguson Jul 1 '14 at 0:04
  • 2
    Let SpinRite keep going. I've heard stories of it apparently doing nothing for 3-4 days and then the drive is fully repaired. – Dennis S. Jul 1 '14 at 12:59
11

Does anyone know of a piece of software that can perform a restartable raw copy of a disk drive?

You are basically describing GNU ddrescue which can be run from a bootable Linux live CD/DVD/USB (I like SystemRescueCD quite a lot).

Cloning the drive

First, you should identify the drives you have connected to your computer with the fdisk -l command. Here is a snippet from my hard drive:

# fdisk -l /dev/sd*
Disk /dev/sda: 232,9 GiB, 250059350016 bytes, 488397168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x8185b78c

Device     Boot  Start       End   Sectors   Size Id Type
/dev/sda1  *      2048    499711    497664   243M 83 Linux
/dev/sda2       501758 488396799 487895042 232,7G  5 Extended
/dev/sda5       501760 488396799 487895040 232,7G 83 Linux

The command shall be run as root (as you can tell from the # sign in the terminal) and I filtered on /dev/sd* to avoid showing ramdisks.

Now, assuming that I want to clone /dev/sda (the failing drive) inside /dev/sdb which is mounted as /media/user/External (the drive holding the image I am going to create), I will issue the following command (as root):

ddrescue /dev/sda /media/user/External/copy.img /media/user/External/status.log

The file /media/user/External/status.log is a log file used by the program to keep track of its progress. This way, you can interrupt the tool if you want to, then continue later.

Generally ddrescue won't be bothered by the failing hard drive. It will simply copy the good parts first, going back to the failing sectors later, trying smaller and smaller chunk sizes. This speeds up the copying process and guarantees better results.

You can use ddrescueview to get a real-time graphical representation of the cloning process.

Recovering files from the NTFS partition

Disclaimer: I am the author of RecuperaBit.

You can recover the contents of NTFS partitions using RecuperaBit. In my opinion, it is better than other open source solutions such as Testdisk and Autopsy because it gives good results even in case of heavy corruption. At least you can recover the files which are still intact and most of the directory structure.

RecuperaBit is a Python program that does not require installation. Once you have downloaded it (either via git or by downloading and extracing the ZIP file) you can run it with the following command line (pypy is suggested):

mkdir /media/user/External/recovered_files
cd [full path of recuperabit]
pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save

Once the scanning process is over, it will start to determine the geometry of any NTFS partitions it found. After that, you can run the command recoverable to see the partitions and then, to restore e.g. partition #2:

restore 2 5
restore 2 -1

Where 5 means the Root directory and -1 means the Lost Files directory.

There are a few caveats you need to be aware of:

  • RecuperaBit will try to find any NTFS partition, so it could be slow as there is currently no way to set up a threshold to avoid useless results
  • NTFS compression is not supported, hence some files might not be restored
  • Any deleted file or ghost file will be restored as well, for now you cannot choose to restore only allocated files

Other programs

There are many commercial (and a few open source) programs (especially for Windows) that can deal with NTFS recovery to various extents. I have listed and compared a bunch of them in my MSc thesis and in the accompanying slides. The following table shows my test results related to the accuracy of NTFS reconstruction with respect to 4 different disk images:

Comparison of different NTFS reconstruction programs

Further explanations and notes are given in my thesis. If you'd rather use a commercial GUI program I would recommend using either Restorer Ultimate or DMDE.

  • I'd pair up a gddrescue with mounting with kpartx - it handles multipartition images painfully. The best way to restore though is from backups ;) – Journeyman Geek Apr 18 '16 at 12:27
  • @JourneymanGeek, doesn't kpartx require that the partition table is actually intact and readable? Also, I would say suggesting to use a backup does not answer to "How do I perform a bitstream copy of a failed drive?". :) – Andrea Lazzarotto Apr 18 '16 at 13:16
  • Sure, but you need to mount the drive to get data out, no? Unless you mean to re-image the drive to another drive, which is a bit of a pain. – Journeyman Geek Apr 18 '16 at 13:41
  • You can mount the drive only if both the partition table and the MFT are working, which won't be the case for damaged drives. That's the point of the question (about drive cloning) and the answer (about drive cloning and forensic NTFS reconstruction). – Andrea Lazzarotto Apr 18 '16 at 14:12
  • @AndreaLazzarotto Good backup info, +1. Is RecuperaBit only for NTFS? And you didn't include PhotoRec in your tests? Is the comparison table (slide 21?) just for the directory tree like file paths & names? Actual recovered file data is in slide 22 - or is that slide just for sparse & compressed & encrypted(?) files? – Xen2050 May 6 '16 at 12:55
3

I had good luck with Unstoppable Copy. I was able to get many files from a hard drive with many bad sectors when an ordinary Windows or DOS copy was giving me CRC errors. Most of the files were usable, even those that Windows was failing to copy; I only lost a few photos that had too much data gone.

Spinrite may actually be more effective at fixing data, but I started to recover a 80 GB drive with it, did the math after two hours and calculated that it would have to run for about a month and a half to complete the drive. I did not like this because usually with a bad hard drive, you want to get the stuff off quick, before it gets worse.

  • "calculated that it would have to run for about a month and a half" That is probably based on what it did so far. But in my experience damaged sectors are very often at the beginning of the drive, so it may zip through the other 95% of the disk. And it may not ;-) I have also heard of people letting it repair the first few percent, then stop it, and then being able to copy off most data because the fixed initial sectors resulted in the logical disk/file information being readable again. – Jan Doggen Oct 14 '14 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.