Raw copy from failed hard disk

Question

I have a Seagate drive (ST3400832AS 3.03) that failed very badly without warning. Woke up to find the computer had come out of sleep during the middle of the night and rebooted. Checked the event log and it was flooded with NTFS errors. For various reasons I don't have a recent backup of this particular data, so I need to do it the hard way.

I initially managed to get a few files off the disk at about 1kbps (kilobits, not bytes) before the drive dropped off and showed as uninitialised.

So far I've tried the following…:

• TestDisk - Detects old partition information, then just hangs.
• Spinrite - Was an exercise in futility.
• HDD Regernator - Drive becomes 'not ready' after about 2-3 minutes of pre-scanning.
• Seatools - What a joke; all tests showed the drive as okay.

…along with a few other raw copy programs.

So far, it seems that, whenever the drive is taxed too hard for too long, it just crashes out. Does anyone know of a piece of software that can perform a restartable raw copy of a disk drive? I don't mind if I have to restart the copy a dozen times, but, with everything I've tried so far, it's been a case of restarting from scratch each time. It's not much use only getting the first few GB of data over and over. So something slow, persistent, and with a resume function would be of great help.

On a side note, this was a secondary internal drive, not an external one.

Answer 1

Does anyone know of a piece of software that can perform a restartable raw copy of a disk drive?

You are basically describing GNU ddrescue which can be run from a bootable Linux live CD/DVD/USB (I like SystemRescueCD quite a lot).

Cloning the drive

First, you should identify the drives you have connected to your computer with the fdisk -l command. Here is a snippet from my hard drive:

# fdisk -l /dev/sd*
Disk /dev/sda: 232,9 GiB, 250059350016 bytes, 488397168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x8185b78c

Device     Boot  Start       End   Sectors   Size Id Type
/dev/sda1  *      2048    499711    497664   243M 83 Linux
/dev/sda2       501758 488396799 487895042 232,7G  5 Extended
/dev/sda5       501760 488396799 487895040 232,7G 83 Linux

The command shall be run as root (as you can tell from the # sign in the terminal) and I filtered on /dev/sd* to avoid showing ramdisks.

Now, assuming that I want to clone /dev/sda (the failing drive) inside /dev/sdb which is mounted as /media/user/External (the drive holding the image I am going to create), I will issue the following command (as root):

ddrescue /dev/sda /media/user/External/copy.img /media/user/External/status.log

The file /media/user/External/status.log is a log file used by the program to keep track of its progress. This way, you can interrupt the tool if you want to, then continue later.

Generally ddrescue won't be bothered by the failing hard drive. It will simply copy the good parts first, going back to the failing sectors later, trying smaller and smaller chunk sizes. This speeds up the copying process and guarantees better results.

You can use ddrescueview to get a real-time graphical representation of the cloning process.

Recovering files from the NTFS partition

Disclaimer: I am the author of RecuperaBit.

You can recover the contents of NTFS partitions using RecuperaBit. In my opinion, it is better than other open source solutions such as Testdisk and Autopsy because it gives good results even in case of heavy corruption. At least you can recover the files which are still intact and most of the directory structure.

RecuperaBit is a Python program that does not require installation. Once you have downloaded it (either via git or by downloading and extracing the ZIP file) you can run it with the following command line (pypy is suggested):

mkdir /media/user/External/recovered_files
cd [full path of recuperabit]
pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save

Once the scanning process is over, it will start to determine the geometry of any NTFS partitions it found. After that, you can run the command recoverable to see the partitions and then, to restore e.g. partition #2:

restore 2 5
restore 2 -1

Where 5 means the Root directory and -1 means the Lost Files directory.

There are a few caveats you need to be aware of:

• RecuperaBit will try to find any NTFS partition, so it could be slow as there is currently no way to set up a threshold to avoid useless results
• NTFS compression is not supported, hence some files might not be restored
• Any deleted file or ghost file will be restored as well, for now you cannot choose to restore only allocated files

Other programs

There are many commercial (and a few open source) programs (especially for Windows) that can deal with NTFS recovery to various extents. I have listed and compared a bunch of them in my MSc thesis and in the accompanying slides. The following table shows my test results related to the accuracy of NTFS reconstruction with respect to 4 different disk images:

Further explanations and notes are given in my thesis. If you'd rather use a commercial GUI program I would recommend using either Restorer Ultimate or DMDE.

Answer 2

I had good luck with Unstoppable Copy. I was able to get many files from a hard drive with many bad sectors when an ordinary Windows or DOS copy was giving me CRC errors. Most of the files were usable, even those that Windows was failing to copy; I only lost a few photos that had too much data gone.

Spinrite may actually be more effective at fixing data, but I started to recover a 80 GB drive with it, did the math after two hours and calculated that it would have to run for about a month and a half to complete the drive. I did not like this because usually with a bad hard drive, you want to get the stuff off quick, before it gets worse.