Can I save this external drive?

Discussion in 'Mac Basics and Help' started by zargap, Jun 26, 2017.

  1. zargap macrumors member

    Jun 26, 2017
    I have a usb3 drive that was in need of repair, and long story short I accidentally interrupted the repair and now I can't tell if it's worth pursuing anymore. The drive has 2 partitions, one will mount apparently fine until I try to access it, when it will just beachball forever and HardwareGrowler tells me the drive has quickly disconnected then reconnected. When this happens, it doesn't unmount, and it begins to continuously disconnect/reconnect until I manually disconnect it. I tried using Dirk Arbitrator to see if mounting caused this, but no matter what process I try (normal Disk Utility, diskutil, fsck, Disk Warrior) the thing that seems to be getting in the way is the disconnection when the drive is accessed. Here are some terminal errors I've gotten recently:

    Could not validate sizes - Resource busy

    Error: -69808: Some information was unavailable during an internal lookup

    At this point do I have any options?
    Thanks :'(
  2. kohlson macrumors 68000

    Apr 23, 2010
    Probably not. You can try a different repair utility, such as Disk Drill, Tech Tool, Disk Warrior, but I suspect that would be futile. If there's valuable data, you could try something like DiskSavers - but they're expensive.
  3. BrianBaughn macrumors 603


    Feb 13, 2011
    Baltimore, Maryland
    Probably a drive or corruption issue but don't rule out hardware. You'll have to take it out of the housing and connect it via an alternative method to check.
  4. zargap thread starter macrumors member

    Jun 26, 2017
    Thanks for the recommendations, Disk Drill says it's dead :'( my only thought now is if I can possibly format and use Disk Drill to recover it but I'm not too hopeful about that, at least I got an excuse to check out Setapp!
  5. Fishrrman macrumors G5


    Feb 20, 2009
    If nothing else works, you could try the following:

    1. Use Disk Utility to re-initialize the drive to HFS+ with journaling enabled. BUT -- do not, repeat, DO NOT do a "secure erase". You want to do ONLY a "quick re-initialization" that replaces the directory but leaves the data untouched "out there on the platters".

    2. Now, if the re-initialization goes through, the drive will mount on the desktop but appear "empty". That's because the directory (and ONLY the directory) is fresh and new. But the old -data- is still there.

    3. NOW it's time to start up your data recovery software and "aim it" at the drive. BTW, I'd give "Data Rescue" a try instead of Disk Drill.

    This "destruct-and-reconstruct" process worked for me on a munged partition that absolutely would not mount. I re-initialized the entire drive, ran Data Rescue on it, and got almost all of the files back.

    BE AWARE that you will almost certainly lose all previous folder hierarchies and many if not mostly all the file names as well. This can be "par for the course" with data recovery.
    The consolation is, that you got the -data- back!
  6. zargap thread starter macrumors member

    Jun 26, 2017
    This sounds promising! I sort of attempted something like this, I'll have to try this out. Initialization seems like my real issue. I'll try this weekend, Thanks!
  7. MacForScience macrumors 6502


    Sep 7, 2010
    This has got to be the dumbest advice ever. Please don't do this. This advice should be removed from MacRumors just to make sure nobody else follows it. You clearly want the data—fine. Go to a professional and have it done right. The fact that this advice passes the sniff test says you need more help than a forum can provide. I have spent years recovering data that people tried to do themselves, following idiotic advice like this. Please save yourself the misery of losing your data.
  8. zargap thread starter macrumors member

    Jun 26, 2017
    Care to elaborate? I'm pretty sure I don't care enough about the data to shell out for real recovery and hardware-wise seems like toast anyway.
  9. MacForScience macrumors 6502


    Sep 7, 2010
    Ok so no professional data recovery. Here are your steps if you want to do this:
    1. Download SMART Utility and install the SAT driver included (reboot your machine)
    2. Disable Spotlight (this thing breaks drives)
    3. Disable TimeMachine
    4. Disable any other cruft that hits drives when they mount like those monitoring utilities you find online or the app store.
    5. If you can remove the drive from the enclosure, and the USB port is not directly mounted on the drive remove the drive and put in a drive toaster or another enclosure.
      1. If you can do this over eSATA not USB or Firewire
      2. Bad drives need the best possible chance and bus makes a difference eSATA or Thunderbolt bypasses the USB and Firewire bus error correction.
    6. Start up disk arbitrator block mounts (I assume you don't have a forensic write-blocker.)
    7. Connect the drive and open SMART Utility - hopefully you will get a reading
      1. Look at pending bad
      2. Reallocated bad
      3. Uncorrectable Errors
      4. CRC Errors
      5. Overall drive status
    8. Depending on what you find you may have better success once the enclosure is gone. Or the drive is failing and you have problems.
    9. Now if the drive is failing you will need another drive ideally double the capacity of the drive you are dealing with.
    10. Download DataRescueDD or buy CopyCatX
    11. Use DataRescueDD (BE CAREFUL don't mess up the source and target bad things happen if you do) to make a bit-copy of the drive to a .dd file.
    12. Once complete and this may take hours or days disconnect the bad drive. (Don't run it longer than absolutely necessary.)
    13. Change the extension of the .dd file to .dmg (it works and yes it is dumb)
    14. Now use something like DiskWarrior and attempt to repair the DMG (maybe works maybe doesn't)
    15. If not, use a program like UFSExplorer/DataResuce/R-Studio or all and scan the image for files. Always run the most intense deep scan you can.
    Be careful go slow, and remember filesystems aren't to be trifled with.

    Hope this helps.
  10. Fishrrman, Jun 30, 2017
    Last edited: Jun 30, 2017

    Fishrrman macrumors G5


    Feb 20, 2009
    MacforScience wrote:
    "This has got to be the dumbest advice ever. Please don't do this. This advice should be removed from MacRumors just to make sure nobody else follows it. You clearly want the data—fine. Go to a professional and have it done right. The fact that this advice passes the sniff test says you need more help than a forum can provide."

    YOUR post above, sir, is nonsense.

    I can personally attest to having recovered a seemingly "unrecoverable" drive by doing EXACTLY what I outlined above.

    In some cases, consumer-level data recovery software can't "get to" a volume if the drivers are munged, regardless of the condition of the drive's directory or the data on the platters.

    I faced this situation where I had a corrupted partition that DataRescue couldn't "see".

    So I re-initialized the ENTIRE DRIVE to a single partition (HFS+ with journaling enabled). The other partitions on the drive weren't important, but the unreadable one was.

    I could then mount the drive in the finder, and DataRescue could see it as well.
    Of course the drive appeared to be empty, because the directory was brand-new and untouched.
    But also "untouched" was the OLD DATA on the drive. It was out there on the platters, but how to see it and make sense of it?

    I then had DR do a full scan of the drive. Since the files I wanted to recover were mp3 files, I set up DR to look for mainly those file types.

    DR was able to RECOVER the data from the re-initialized drive to my "scratch drive".

    I did lose many of the file names, and of course the folder hierarchy was lost because folder hierarchies are a construct of a drive's directory -- and that was wiped out by the re-initialization. But the DATA on the drive's sectors was left INTACT, because I chose not to do a "secure erase" which would over-write each sector with random 1's and 0's.

    My solution to re-organizing the thousands of mp3 files I discovered quite serendipitously -- I created a new iTunes library, and then "dumped" the entire mass of recovered files into it.
    Even though file names (names from the finder) were lost, most of the METADATA inside the files came through intact. And iTunes was able to read the metadata, and re-organize the loose files into artists and albums!

    So again -- I RECOVERED the files by RE-INITIALIZING the drive.
    Whether you believe it or not.

    It's worth noting that the "iTunes trick" is what saved me -- otherwise I might have been left with thousands of files, identified only by numbers.
    I'm thinking that this might also work with photos, as well -- with either iPhoto or Photos being able to read the metadata and re-organize lost files (but I've never tried this).

    For files that don't have any metadata, one will probably have to deal with file recovery "numbers" rather than names. And that will entail quite a bit of work in getting things back in order.

    I only suggest this as a last resort. In my case, I had a lot of "lost data", but it wasn't comprised of stuff I would "pay to recover". So I used the tools I had on-hand. And it worked.

    So go on and "sniff" anywhere you wish, "MacForScience".

    I would not advise anyone to try the "re-initialize and recover" trick if I hadn't found it to work myself.
  11. zargap thread starter macrumors member

    Jun 26, 2017
    Thanks so much, I'm gonna try this very s l o w l y and c a r e f u l l y.
  12. organicCPU, Jun 30, 2017
    Last edited: Jun 30, 2017

    organicCPU macrumors 6502a


    Aug 8, 2016
    Hi @MacForScience, may I ask you something?

    I took a look at disk arbitrator a while ago, but until now I'm just using one of the methods that the app uses to prevent mounting directly in terminal.
    ##Block mounting:
    sudo chflags uchg /Volumes
    ##Reenable mounting:
    sudo chflags nouchg /Volumes
    That way I could make a block copy of the unmounted drive on the /dev/rdisk node with ddrescue.
    AFAIK, neither TimeMachine nor Spotlight should care about drives that are not mounted to /Volumes, so why do you advise to disable them?
    Besides, do you think that there are any benefits using the second (officially suggested) method disk arbitrator uses, maybe in conjunction with the first method outlined above, to prevent mounting?
    ##Block mounting, but preventing diskutil from functioning:
    sudo launchctl unload /System/Library/LaunchDaemons/
    ##Reenable mounting:
    sudo launchctl load /System/Library/LaunchDaemons/
  13. MacForScience macrumors 6502


    Sep 7, 2010
    @organicCPU I suggest disabling spotlight and time machine when you are using disk arbitrator because it is only preventing the mount, and not preventing writing and unnecessary reads to the disk.

    With a damaged drive you want to limit the unnecessary interactions with the disk. Spotlight is notorious for hammering drives when attempting to index. Ideally you want your computer to come as close to ignoring the drive when connected as possible–hard to do on OS X, and you could go further if you wanted.

    @Fishrrman You are certainly entitled to do whatever you want with your drives. The fact that it worked once or twice doesn't make it less stupid. Additionally this strategy isn't the thing to recommend on a forum, especially when it comes to people's data.
  14. Fishrrman, Jul 1, 2017
    Last edited: Jul 1, 2017

    Fishrrman macrumors G5


    Feb 20, 2009
    "Additionally this strategy isn't the thing to recommend on a forum"

    What works, works.
    I will continue to recommend it to those who are trying to recover data from drives that are otherwise un-readable.

    Data recovery software generally can't "get to" a drive that has corrupted drivers.
    But DR software is quite capable of "getting around" a "replaced" directory (i.e., re-initialized drive).

    So long as the user is careful to leave the data on the platters alone, it works.

    Back in the days of SCSI (you may be to much of a youngster to remember), Apple's old HDSC Setup utility had the ability to "update the disk drivers" -- that is, to write a NEW driver to the drive.
    However, I've yet to see ANY modern utility that can repair a damaged USB driver in this fashion.
    Perhaps there's something out there that I don't yet know about.
    Having a way to do that would be a great help.

    I only suggest this procedure "as a last resort", when nothing else works, and before writing off the drive.
    Also worth mentioning is that it's intended for platter-based drives ONLY.
    Not going to work on an SSD.
  15. organicCPU macrumors 6502a


    Aug 8, 2016
    I always agreed to keep interaction with a failing drive as low as possible.

    Until now, I was thinking that prevent mounting is sufficient to have no unwanted system's impact on the drive. I'll have to look more into that, maybe by trying to monitor a proper functioning drive with iotop to find out more. Thank you for pointing out that there can still be unnecessary reads or writes of services like Spotlight although the drive is not mounted.
  16. SaSaSushi, Jul 1, 2017
    Last edited: Jul 2, 2017

    SaSaSushi macrumors 68040


    Aug 8, 2007
    Takamatsu, Japan
    Didn't we just have this discussion in another thread, Fish?

    personal experience ≠ the universal truth for all in spite of your apparent belief that it is so.

    Of course you will, but will you take responsibility when your advice ends up causing data loss?
  17. zargap thread starter macrumors member

    Jun 26, 2017
    Man, I miss my heavy forum using days!

    So here's where I'm at:

    I was unable to get a reading with SMART Utility, not sure if I did a bad job installing the SAT driver or something.
    Any attempt to try to reinitialize the drive or anything like that hasn't worked, I get resource busy messages and the like.
    Last night I ran DDrescue on the whole disk to no avail, but now I'm running it on JUST the partition that's not a Time Machine backup and it seems to be at least working better than doing the whole disk. I'll see where it gets me in... whenever it's done. Today is the first day we can but booze on Sunday in MN so I'm gonna do that while this runs :)
  18. zargap, Jul 2, 2017
    Last edited: Jul 2, 2017

    zargap thread starter macrumors member

    Jun 26, 2017
    OK, update, I was able to get a SMART reading but I'm not so sure what to do from here. DatarescueDD is a bust for me, I get an immediate error trying to read the drive then nothing. DDrescue though was working OK until the drive decided to initialize or mount or something (came back to my computer with error message about "the disk you inserted is not readable" and was no longer able to see the partitions on it, DDrescue started seemingly doing nothing at this point.
    Subsequent DDrescue attempts haven't worked. The log from the attempt that was working looks like this
    # Mapfile. Created by GNU ddrescue version 1.22
    # Command line: /Applications/ -v -f -s 1249294667776 -r 2 -c 128 -b 512 /dev/rdisk4s3 /dev/disk3s2 /private/var/root/Desktop/try2.log
    # Start time: 2017-07-02 18:01:13
    # Current time: 2017-07-02 18:05:44
    # Scraping failed blocks... (forwards)
    # current_pos current_status current_pass
    0x124E5F2800 / 1
    # pos size status
    0x00000000 0xEC520000 +
    0xEC520000 0x01070000 -
    0xED590000 0x012B0000 +
    0xEE840000 0x02070000 -
    0xF08B0000 0x00010000 +
    0xF08C0000 0x1E040000 -
    0x10E900000 0x0DE70000 +
    0x11C770000 0x00050000 -
    0x11C7C0000 0x001C0000 +
    0x11C980000 0x00450000 -
    0x11CDD0000 0x00040000 +
    0x11CE10000 0x11317E2800 -
    0x124E5F2800 0x1109164A600 /
    0x122DFC3CE00 0x00000200 -
    0x122DFC3D000 0x7FFFFEDD203C2FFF ?

    Any other ones have alternating lines ending in ? and * which seems not good. But any time I run it, I get the full directory of the partition in the source, just with no information, so that seems hopefulish?

    I attached my SMART status but I'm not really sure how to read it.

    Thanks so much for the help everyone. I'm gonna run ddrescue once more and actually go away for a bit.


    Edits within edits, that SMART status is for the drive I was trying to restore TO which is Not Good presumably. gonna get another before I try this again.

    Attached Files:

  19. organicCPU macrumors 6502a


    Aug 8, 2016
    The ? is not really bad! From the ddrescue manual:
    There are further explanations of characters for the status line (first line after comments #).

    To be honest, I never tried to rescue directly to a physical drive and never needed the -s switch.
    Maybe you should continue whatever you are doing before the drive crashes completely, but I guess it will last some days to complete the task.

    I'm sure there are better and more advanced recovery strategies with ddrescue, but I would have tried to recover in several steps to a dmg like this:
    1. Fast pass
    sudo ddrescue -v -n /dev/rdisk4s3 /path/to/image/rescueImage.dmg /path/to/mapfile/rescueVolume.log
    2. Forward pass, maximum 3 attempts
    sudo ddrescue -v -r 3 /dev/rdisk4s3 /path/to/image/rescueImage.dmg /path/to/mapfile/rescueVolume.log
    3. Reverse pass, maximum 3 attempts
    sudo ddrescue -v -r 3 -R /dev/rdisk4s3 /path/to/image/rescueImage.dmg /path/to/mapfile/rescueVolume.log
    It's also worth to explore the mapfile with ddrescuelog.
    Good luck!
  20. zargap thread starter macrumors member

    Jun 26, 2017
    So, here's where I'm at: Turns out im an impatient jerk and I should have been letting ddrescue do its thing, which I HAVE been doing now, and after taking a long time to get to 0.3% rescued, it hit a stride and I'm up to 24.22% at 1 day 18 hours. Seems to be going well as long as I don.t touch it :) I disabled Time Machine and Spotlight etc also. Fingers crossed, sitting tight etc. Thanks all!
  21. zargap thread starter macrumors member

    Jun 26, 2017
    Good news! ddrescue did the trick! Thanks for all the help. A few of my takeaways: Disabling Time Machine and Spotlight for this sort of thing is good. BE VERY PATIENT and expect lots of errors. Most importantly, DON'T DISCONNECT A HARD DRIVE DURING A PARTITION REPAIR.

Share This Page