Can I save this external drive?

[zargap]

I have a usb3 drive that was in need of repair, and long story short I accidentally interrupted the repair and now I can't tell if it's worth pursuing anymore. The drive has 2 partitions, one will mount apparently fine until I try to access it, when it will just beachball forever and HardwareGrowler tells me the drive has quickly disconnected then reconnected. When this happens, it doesn't unmount, and it begins to continuously disconnect/reconnect until I manually disconnect it. I tried using Dirk Arbitrator to see if mounting caused this, but no matter what process I try (normal Disk Utility, diskutil, fsck, Disk Warrior) the thing that seems to be getting in the way is the disconnection when the drive is accessed. Here are some terminal errors I've gotten recently:

Could not validate sizes - Resource busy

Error: -69808: Some information was unavailable during an internal lookup

At this point do I have any options?
Thanks :'(

 

[kohlson]

Probably not. You can try a different repair utility, such as Disk Drill, Tech Tool, Disk Warrior, but I suspect that would be futile. If there's valuable data, you could try something like DiskSavers - but they're expensive.

 

[BrianBaughn]

Probably a drive or corruption issue but don't rule out hardware. You'll have to take it out of the housing and connect it via an alternative method to check.

 

[zargap]

Thanks for the recommendations, Disk Drill says it's dead :'( my only thought now is if I can possibly format and use Disk Drill to recover it but I'm not too hopeful about that, at least I got an excuse to check out Setapp!

 

[Fishrrman]

OP:
If nothing else works, you could try the following:

1. Use Disk Utility to re-initialize the drive to HFS+ with journaling enabled. BUT -- do not, repeat, DO NOT do a "secure erase". You want to do ONLY a "quick re-initialization" that replaces the directory but leaves the data untouched "out there on the platters".

2. Now, if the re-initialization goes through, the drive will mount on the desktop but appear "empty". That's because the directory (and ONLY the directory) is fresh and new. But the old -data- is still there.

3. NOW it's time to start up your data recovery software and "aim it" at the drive. BTW, I'd give "Data Rescue" a try instead of Disk Drill.

This "destruct-and-reconstruct" process worked for me on a munged partition that absolutely would not mount. I re-initialized the entire drive, ran Data Rescue on it, and got almost all of the files back.

BE AWARE that you will almost certainly lose all previous folder hierarchies and many if not mostly all the file names as well. This can be "par for the course" with data recovery.
The consolation is, that you got the -data- back!

 

[zargap]

OP:
If nothing else works, you could try the following:

1. Use Disk Utility to re-initialize the drive to HFS+ with journaling enabled. BUT -- do not, repeat, DO NOT do a "secure erase". You want to do ONLY a "quick re-initialization" that replaces the directory but leaves the data untouched "out there on the platters".

2. Now, if the re-initialization goes through, the drive will mount on the desktop but appear "empty". That's because the directory (and ONLY the directory) is fresh and new. But the old -data- is still there.

3. NOW it's time to start up your data recovery software and "aim it" at the drive. BTW, I'd give "Data Rescue" a try instead of Disk Drill.

This "destruct-and-reconstruct" process worked for me on a munged partition that absolutely would not mount. I re-initialized the entire drive, ran Data Rescue on it, and got almost all of the files back.

BE AWARE that you will almost certainly lose all previous folder hierarchies and many if not mostly all the file names as well. This can be "par for the course" with data recovery.
The consolation is, that you got the -data- back!

This sounds promising! I sort of attempted something like this, I'll have to try this out. Initialization seems like my real issue. I'll try this weekend, Thanks!

 

[MacForScience]

OP:
If nothing else works, you could try the following:

1. Use Disk Utility to re-initialize the drive to HFS+ with journaling enabled. BUT -- do not, repeat, DO NOT do a "secure erase". You want to do ONLY a "quick re-initialization" that replaces the directory but leaves the data untouched "out there on the platters".

2. Now, if the re-initialization goes through, the drive will mount on the desktop but appear "empty". That's because the directory (and ONLY the directory) is fresh and new. But the old -data- is still there.

3. NOW it's time to start up your data recovery software and "aim it" at the drive. BTW, I'd give "Data Rescue" a try instead of Disk Drill.

This "destruct-and-reconstruct" process worked for me on a munged partition that absolutely would not mount. I re-initialized the entire drive, ran Data Rescue on it, and got almost all of the files back.

BE AWARE that you will almost certainly lose all previous folder hierarchies and many if not mostly all the file names as well. This can be "par for the course" with data recovery.
The consolation is, that you got the -data- back!

This has got to be the dumbest advice ever. Please don't do this. This advice should be removed from MacRumors just to make sure nobody else follows it. You clearly want the data—fine. Go to a professional and have it done right. The fact that this advice passes the sniff test says you need more help than a forum can provide. I have spent years recovering data that people tried to do themselves, following idiotic advice like this. Please save yourself the misery of losing your data.

 

[zargap]

This has got to be the dumbest advice ever. Please don't do this. This advice should be removed from MacRumors just to make sure nobody else follows it. You clearly want the data—fine. Go to a professional and have it done right. The fact that this advice passes the sniff test says you need more help than a forum can provide. I have spent years recovering data that people tried to do themselves, following idiotic advice like this. Please save yourself the misery of losing your data.

Care to elaborate? I'm pretty sure I don't care enough about the data to shell out for real recovery and hardware-wise seems like toast anyway.

 

[MacForScience]

Ok so no professional data recovery. Here are your steps if you want to do this:

1. Download SMART Utility and install the SAT driver included (reboot your machine)
2. Disable Spotlight (this thing breaks drives)
3. Disable TimeMachine
4. Disable any other cruft that hits drives when they mount like those monitoring utilities you find online or the app store.
5. If you can remove the drive from the enclosure, and the USB port is not directly mounted on the drive remove the drive and put in a drive toaster or another enclosure.
   1. If you can do this over eSATA not USB or Firewire
   2. Bad drives need the best possible chance and bus makes a difference eSATA or Thunderbolt bypasses the USB and Firewire bus error correction.
6. Start up disk arbitrator block mounts (I assume you don't have a forensic write-blocker.)
7. Connect the drive and open SMART Utility - hopefully you will get a reading
   1. Look at pending bad
   2. Reallocated bad
   3. Uncorrectable Errors
   4. CRC Errors
   5. Overall drive status
8. Depending on what you find you may have better success once the enclosure is gone. Or the drive is failing and you have problems.
9. Now if the drive is failing you will need another drive ideally double the capacity of the drive you are dealing with.
10. Download DataRescueDD or buy CopyCatX
11. Use DataRescueDD (BE CAREFUL don't mess up the source and target bad things happen if you do) to make a bit-copy of the drive to a .dd file.
12. Once complete and this may take hours or days disconnect the bad drive. (Don't run it longer than absolutely necessary.)
13. Change the extension of the .dd file to .dmg (it works and yes it is dumb)
14. Now use something like DiskWarrior and attempt to repair the DMG (maybe works maybe doesn't)
15. If not, use a program like UFSExplorer/DataResuce/R-Studio or all and scan the image for files. Always run the most intense deep scan you can.

Be careful go slow, and remember filesystems aren't to be trifled with.

Hope this helps.

 

[Fishrrman]

MacforScience wrote:
"This has got to be the dumbest advice ever. Please don't do this. This advice should be removed from MacRumors just to make sure nobody else follows it. You clearly want the data—fine. Go to a professional and have it done right. The fact that this advice passes the sniff test says you need more help than a forum can provide."

YOUR post above, sir, is nonsense.

I can personally attest to having recovered a seemingly "unrecoverable" drive by doing EXACTLY what I outlined above.

In some cases, consumer-level data recovery software can't "get to" a volume if the drivers are munged, regardless of the condition of the drive's directory or the data on the platters.

I faced this situation where I had a corrupted partition that DataRescue couldn't "see".

So I re-initialized the ENTIRE DRIVE to a single partition (HFS+ with journaling enabled). The other partitions on the drive weren't important, but the unreadable one was.

I could then mount the drive in the finder, and DataRescue could see it as well.
Of course the drive appeared to be empty, because the directory was brand-new and untouched.
But also "untouched" was the OLD DATA on the drive. It was out there on the platters, but how to see it and make sense of it?

I then had DR do a full scan of the drive. Since the files I wanted to recover were mp3 files, I set up DR to look for mainly those file types.

DR was able to RECOVER the data from the re-initialized drive to my "scratch drive".

I did lose many of the file names, and of course the folder hierarchy was lost because folder hierarchies are a construct of a drive's directory -- and that was wiped out by the re-initialization. But the DATA on the drive's sectors was left INTACT, because I chose not to do a "secure erase" which would over-write each sector with random 1's and 0's.

My solution to re-organizing the thousands of mp3 files I discovered quite serendipitously -- I created a new iTunes library, and then "dumped" the entire mass of recovered files into it.
Even though file names (names from the finder) were lost, most of the METADATA inside the files came through intact. And iTunes was able to read the metadata, and re-organize the loose files into artists and albums!

So again -- I RECOVERED the files by RE-INITIALIZING the drive.
Whether you believe it or not.

It's worth noting that the "iTunes trick" is what saved me -- otherwise I might have been left with thousands of files, identified only by numbers.
I'm thinking that this might also work with photos, as well -- with either iPhoto or Photos being able to read the metadata and re-organize lost files (but I've never tried this).

For files that don't have any metadata, one will probably have to deal with file recovery "numbers" rather than names. And that will entail quite a bit of work in getting things back in order.

I only suggest this as a last resort. In my case, I had a lot of "lost data", but it wasn't comprised of stuff I would "pay to recover". So I used the tools I had on-hand. And it worked.

So go on and "sniff" anywhere you wish, "MacForScience".

I would not advise anyone to try the "re-initialize and recover" trick if I hadn't found it to work myself.

 

[zargap]

Ok so no professional data recovery. Here are your steps if you want to do this:

1. Download SMART Utility and install the SAT driver included (reboot your machine)
2. Disable Spotlight (this thing breaks drives)
3. Disable TimeMachine
4. Disable any other cruft that hits drives when they mount like those monitoring utilities you find online or the app store.
5. If you can remove the drive from the enclosure, and the USB port is not directly mounted on the drive remove the drive and put in a drive toaster or another enclosure.
   1. If you can do this over eSATA not USB or Firewire
   2. Bad drives need the best possible chance and bus makes a difference eSATA or Thunderbolt bypasses the USB and Firewire bus error correction.
6. Start up disk arbitrator block mounts (I assume you don't have a forensic write-blocker.)
7. Connect the drive and open SMART Utility - hopefully you will get a reading
   1. Look at pending bad
   2. Reallocated bad
   3. Uncorrectable Errors
   4. CRC Errors
   5. Overall drive status
8. Depending on what you find you may have better success once the enclosure is gone. Or the drive is failing and you have problems.
9. Now if the drive is failing you will need another drive ideally double the capacity of the drive you are dealing with.
10. Download DataRescueDD or buy CopyCatX
11. Use DataRescueDD (BE CAREFUL don't mess up the source and target bad things happen if you do) to make a bit-copy of the drive to a .dd file.
12. Once complete and this may take hours or days disconnect the bad drive. (Don't run it longer than absolutely necessary.)
13. Change the extension of the .dd file to .dmg (it works and yes it is dumb)
14. Now use something like DiskWarrior and attempt to repair the DMG (maybe works maybe doesn't)
15. If not, use a program like UFSExplorer/DataResuce/R-Studio or all and scan the image for files. Always run the most intense deep scan you can.

Be careful go slow, and remember filesystems aren't to be trifled with.

Hope this helps.

Thanks so much, I'm gonna try this very s l o w l y and c a r e f u l l y.

 

[organicCPU]

Hi @MacForScience, may I ask you something?

I took a look at disk arbitrator a while ago, but until now I'm just using one of the methods that the app uses to prevent mounting directly in terminal.

##Block mounting:
sudo chflags uchg /Volumes
##Reenable mounting:
sudo chflags nouchg /Volumes

That way I could make a block copy of the unmounted drive on the /dev/rdisk node with ddrescue.
AFAIK, neither TimeMachine nor Spotlight should care about drives that are not mounted to /Volumes, so why do you advise to disable them?
Besides, do you think that there are any benefits using the second (officially suggested) method disk arbitrator uses, maybe in conjunction with the first method outlined above, to prevent mounting?

##Block mounting, but preventing diskutil from functioning:
sudo launchctl unload /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist
##Reenable mounting:
sudo launchctl load /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist

 

[MacForScience]

@organicCPU I suggest disabling spotlight and time machine when you are using disk arbitrator because it is only preventing the mount, and not preventing writing and unnecessary reads to the disk.

With a damaged drive you want to limit the unnecessary interactions with the disk. Spotlight is notorious for hammering drives when attempting to index. Ideally you want your computer to come as close to ignoring the drive when connected as possible–hard to do on OS X, and you could go further if you wanted.

@Fishrrman You are certainly entitled to do whatever you want with your drives. The fact that it worked once or twice doesn't make it less stupid. Additionally this strategy isn't the thing to recommend on a forum, especially when it comes to people's data.

 

[Fishrrman]

"Additionally this strategy isn't the thing to recommend on a forum"

What works, works.
I will continue to recommend it to those who are trying to recover data from drives that are otherwise un-readable.

Data recovery software generally can't "get to" a drive that has corrupted drivers.
But DR software is quite capable of "getting around" a "replaced" directory (i.e., re-initialized drive).

So long as the user is careful to leave the data on the platters alone, it works.

Aside:
Back in the days of SCSI (you may be to much of a youngster to remember), Apple's old HDSC Setup utility had the ability to "update the disk drivers" -- that is, to write a NEW driver to the drive.
However, I've yet to see ANY modern utility that can repair a damaged USB driver in this fashion.
Perhaps there's something out there that I don't yet know about.
Having a way to do that would be a great help.

I only suggest this procedure "as a last resort", when nothing else works, and before writing off the drive.
Also worth mentioning is that it's intended for platter-based drives ONLY.
Not going to work on an SSD.

 

[organicCPU]

@organicCPU I suggest disabling spotlight and time machine when you are using disk arbitrator because it is only preventing the mount, and not preventing writing and unnecessary reads to the disk.

I always agreed to keep interaction with a failing drive as low as possible.

Until now, I was thinking that prevent mounting is sufficient to have no unwanted system's impact on the drive. I'll have to look more into that, maybe by trying to monitor a proper functioning drive with iotop to find out more. Thank you for pointing out that there can still be unnecessary reads or writes of services like Spotlight although the drive is not mounted.

 

[SaSaSushi]

"Additionally this strategy isn't the thing to recommend on a forum"

What works, works.

Didn't we just have this discussion in another thread, Fish?

Your personal experience ≠ the universal truth for all in spite of your apparent belief that it is so.

I will continue to recommend it to those who are trying to recover data from drives that are otherwise un-readable.

Of course you will, but will you take responsibility when your advice ends up causing data loss?

 

[zargap]

Man, I miss my heavy forum using days!

So here's where I'm at:

I was unable to get a reading with SMART Utility, not sure if I did a bad job installing the SAT driver or something.
Any attempt to try to reinitialize the drive or anything like that hasn't worked, I get resource busy messages and the like.
Last night I ran DDrescue on the whole disk to no avail, but now I'm running it on JUST the partition that's not a Time Machine backup and it seems to be at least working better than doing the whole disk. I'll see where it gets me in... whenever it's done. Today is the first day we can but booze on Sunday in MN so I'm gonna do that while this runs

 

[zargap]

OK, update, I was able to get a SMART reading but I'm not so sure what to do from here. DatarescueDD is a bust for me, I get an immediate error trying to read the drive then nothing. DDrescue though was working OK until the drive decided to initialize or mount or something (came back to my computer with error message about "the disk you inserted is not readable" and was no longer able to see the partitions on it, DDrescue started seemingly doing nothing at this point.
Subsequent DDrescue attempts haven't worked. The log from the attempt that was working looks like this
# Mapfile. Created by GNU ddrescue version 1.22
# Command line: /Applications/DDRescue-GUI.app/Contents/Resources/ddrescue -v -f -s 1249294667776 -r 2 -c 128 -b 512 /dev/rdisk4s3 /dev/disk3s2 /private/var/root/Desktop/try2.log
# Start time: 2017-07-02 18:01:13
# Current time: 2017-07-02 18:05:44
# Scraping failed blocks... (forwards)
# current_pos current_status current_pass
0x124E5F2800 / 1
# pos size status
0x00000000 0xEC520000 +
0xEC520000 0x01070000 -
0xED590000 0x012B0000 +
0xEE840000 0x02070000 -
0xF08B0000 0x00010000 +
0xF08C0000 0x1E040000 -
0x10E900000 0x0DE70000 +
0x11C770000 0x00050000 -
0x11C7C0000 0x001C0000 +
0x11C980000 0x00450000 -
0x11CDD0000 0x00040000 +
0x11CE10000 0x11317E2800 -
0x124E5F2800 0x1109164A600 /
0x122DFC3CE00 0x00000200 -
0x122DFC3D000 0x7FFFFEDD203C2FFF ?

Any other ones have alternating lines ending in ? and * which seems not good. But any time I run it, I get the full directory of the partition in the source, just with no information, so that seems hopefulish?

I attached my SMART status but I'm not really sure how to read it.

Thanks so much for the help everyone. I'm gonna run ddrescue once more and actually go away for a bit.

---

Edits within edits, that SMART status is for the drive I was trying to restore TO which is Not Good presumably. gonna get another before I try this again.

 

[organicCPU]

The ? is not really bad! From the ddrescue manual:

Character Meaning
'?' non-tried block
'*' failed block non-trimmed
'/' failed block non-scraped
'-' failed block bad-sector(s)
'+' finished block

There are further explanations of characters for the status line (first line after comments #).

To be honest, I never tried to rescue directly to a physical drive and never needed the -s switch.
Maybe you should continue whatever you are doing before the drive crashes completely, but I guess it will last some days to complete the task.

I'm sure there are better and more advanced recovery strategies with ddrescue, but I would have tried to recover in several steps to a dmg like this:
1. Fast pass

sudo ddrescue -v -n /dev/rdisk4s3 /path/to/image/rescueImage.dmg /path/to/mapfile/rescueVolume.log

2. Forward pass, maximum 3 attempts

sudo ddrescue -v -r 3 /dev/rdisk4s3 /path/to/image/rescueImage.dmg /path/to/mapfile/rescueVolume.log

3. Reverse pass, maximum 3 attempts

sudo ddrescue -v -r 3 -R /dev/rdisk4s3 /path/to/image/rescueImage.dmg /path/to/mapfile/rescueVolume.log

It's also worth to explore the mapfile with ddrescuelog.
Good luck!

 

[zargap]

So, here's where I'm at: Turns out im an impatient jerk and I should have been letting ddrescue do its thing, which I HAVE been doing now, and after taking a long time to get to 0.3% rescued, it hit a stride and I'm up to 24.22% at 1 day 18 hours. Seems to be going well as long as I don.t touch it I disabled Time Machine and Spotlight etc also. Fingers crossed, sitting tight etc. Thanks all!

 

[zargap]

Good news! ddrescue did the trick! Thanks for all the help. A few of my takeaways: Disabling Time Machine and Spotlight for this sort of thing is good. BE VERY PATIENT and expect lots of errors. Most importantly, DON'T DISCONNECT A HARD DRIVE DURING A PARTITION REPAIR.