Hard Drive Recovery Help (not for the faint hearted)

Discussion in 'Mac Basics and Help' started by DoFoT9, Jun 25, 2009.

  1. DoFoT9 macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #1
    Hey all,

    I have been attempting to recover a hard drive for a friend all day long and I am starting to run out of ideas.

    The situation is this: she had her laptop stolen, had a complete Time Machine backup on her LaCie external USB hard drive.. and then she dropped it... stupid i know!

    Symptoms of drive:
    • Recognised by Disk Utility but will not mount
    • Clicks occasionally
    otherwise it spins up fine..

    What I have attempted:
    • Disc Warrior
    • Data Rescue II

    What is currently going:
    • Spin Rite (using setting #2)

    I think i have found the problem, Spin Rite will freeze at about 104-209mb into its run (about the first 400,000,000 bytes into it), but if i choose to scan after about 500mb it will run flawlessly (well so far anyway, its up to about 15% and is going fine).
    EDIT: now at 22% and going fine
    EDIT: 36%, fine
    EDIT: 55%. fine

    this leads me to believe that the drive was writing some critical data to the mounting/information section of the drive what it was dropped, but the data on the drive is still recoverable.

    My Idea:
    to find some software that can be told to copy the partition/data from a certain spot onwards (because the whole drive freezes when trying to copy the damaged part).

    anyone ever tried this? is there ANY way i could do this??

    thanks in advance

    DoFoT9

    EDIT: heres another question, it says (in SpinRite) "Drive: MBR followed by EFI", i was under the impression that MBR was only fat32/NTFS drives, clearly i dont know enough here..
     
  2. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #2
    just got back from work and the SpinRite test has finished, it didnt report any errors after the first 200 or so mb.

    anyone got any suggestions??

    i was thinking of reformatting it, then doing a salvage.. but that probably wouldnt work would it??? hmm :confused:
     
  3. mattyb240 macrumors 6502a

    Joined:
    May 11, 2008
    #3
    I didn't think spin rite worked with mac partition?

    But I love that program when it gets stuck just leave it and walk away, that happened to my friends laptop that would'nt even switch on! Then 48 hours later completely working laptop! Be patient
     
  4. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #4
    SpinRite doesnt worry about formats, its below that level.

    im afraid this situation is much much more worse then yours friends but (mainly because SpinRite was going so slow it was calculating over the time limit that it had).
     
  5. Wotan31 macrumors 6502

    Joined:
    Jun 5, 2008
    #5
    Data recovery from a physically damaged drive is a tricky thing and not something I would attempt. It normally cannot be done with software alone. This is where you call the pro's and pay for a professional data recovery service. The pro's will open the drive in a clean-room, and transplant the platters into another identical model drive. They also have much more serious software tools at their disposal.

    Unfortunately, by using this consumer-grade recovery software, it likely eliminates the possibility for a pro to recover the data now. I.e. this kind of software usually does more harm than good. :(
     
  6. Guiyon macrumors 6502a

    Joined:
    Mar 19, 2008
    Location:
    North Shore, MA
    #6
    I've had excellent luck with ddrescue on failing drives in the past. It does require a bit of CLI knowledge, however. You'll need to boot into a LiveCD from some distro (I prefer Gentoo), compile the tool and let it run. It will take some time to run; the last drive I rescued with it has an increasing number of bad blocks and it ended up taking a good 72 hours or so to complete all the passes; I did manage to read everything except for a 4MB chunk though.. One warning: anything like this tends to really stress the drive and it's entirely possible it could fail partially through the recovery.
     
  7. Tesselator macrumors 601

    Tesselator

    Joined:
    Jan 9, 2008
    Location:
    Japan
    #7
    From dropping two things usually happen. The heads get damaged, and the platter gets a physical gouge in it. If all but 200MB reads sequentially then the heads are OK (as data is written in an interleaved fashion Plater 1 - Sector 1, Platter 2 - Sector 1, Platter 3 - Sector 1, Platter 1 - Sector 2, and etc.). This would seem to imply that the platter is damaged. What can't be read won't be recoverable - even by a professional service.

    You can probably format around the bad sectors and map out the errors but it'll likely be 200MB smaller than before. And I wouldn't trust it's operation for very long.
     
  8. spacepower7 macrumors 68000

    Joined:
    May 6, 2004
    #8
    Sorry to thread jack

    Hey Guiyon,

    Can you recommend any sites with instructions to use ddrescue. I downloaded a ubuntu-rescue-remix liveCD. I was thinking of trying to install that on a usb key drive. I am trying to recover a Windows XP drive with mechanical failure.

    I tried about 6 different Mac utilities and only found one that could clone the whole 40GB PC drive. the problem is that this is a dmg on an HFS+ volume, so I don't think that the linux/ubuntu can read it. Can I reformat a drive to FAT32 (doubt it) or linux file system and transfer the dmg there? Or should I just try to re-clone the PC drive?

    All I really need to recover from the PC drive is jpegs, nothing else matters.

    Any ideas?

    This method might be helpful to the OP
     
  9. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #9
    i am the direct go to man and i feel that i am competent enough to get this data back, given the situation it seems likely that i can (if i can fulfill getting to choose which section of data i want to proceed from then the rest of the data can be retrieved successfully).

    she got quoted $2500 to get the data retrieved, that is out of her price range.

    the entire drive is not damaged, merely a single portion of it.


    not really keen on using any other OS's to recover it, but thanks for the suggestion, i will try it out if i can.

    i am certain that the bad plattor/sector/whatever is completely gone and un-retrievable by me, that doesnt matter though its only the first little bit of the drive.

    hmmm good to hear then. its only the first little bit, less then 0.5% of the beginning of the drive, which makes me think that its the "important stuff" for the drive, which may be why it isnt mounting?? (file system etc cant be read, does that seem plausible?). that is why i thought of a reformat, the important data would be re-written to readable areas.

    i am running data rescue using the "thorough scan" setting, it is taking a bajillion years (say it has 885 days to go), but i am hoping that once it gets though the first 200mb or whatever that it will fly through the rest of the data. :) thats the plan anyway....:eek:

    really?? you think that would work?? then i could use Data Rescue with the setting "Recover deleted files" or something to retrieve the readable data??

    of course, if i get the data back, i will be recommending that she purchase a new hard drive.

    thanks for all the input guys.

    its up to block 90,112.. of a 500GB hard drive.. i recall there being a good billion blocks when i checked it before, sooooo it still has a long way to go haha! i wonder how far until it has done the 200mb.
     
  10. Guiyon macrumors 6502a

    Joined:
    Mar 19, 2008
    Location:
    North Shore, MA
    #10
    The nice thing about ddrescue is that the formatting doesn't matter; it's just reading blocks from the drive and saving them to a disk image (the image can easily be mounted in Mac OS X).

    Note: I was performing a recovery from one computer to another. If your main machine is bootable you can skip all the below steps, just compile and run ddrescue (assuming you have the dev tools installed), no need for the LiveCD.

    First, I grabbed the XFCE-based i686 image as it has support for cifs and a basic gcc setup. Once that was burned I enabled SMB sharing (make sure the share folder has been chmodded 777) and booted the dying laptop off the CD. Next I began setting up the restore (I downloaded ddrescue and compiled it on the share but you can do anywhere you have write privs)

    Code:
    sudo -s
    mkdir /mnt/net
    mount -t cifs -o username=myuser,password=mypass //192.168.0.2/Sharename /mnt/net
    cd /mnt/net
    wget "http://ftp.gnu.org/gnu/ddrescue/ddrescue-1.10.tar.gz"
    tar -zxf ddrescue-1.10.tar.gz
    cd ddrescue-1.10
    ./configure
    make
    
    #Now, assuming the drive is sda and you want to recover partition 1
    /mnt/net/ddrescue-1.10/ddrescue --no-split /dev/sda1 /mnt/net/recovery.img /mnt/net/recovery.log
    
    /mnt/net/ddrescue-1.10/ddrescue --direct --max-retries=3 /dev/sda1 /mnt/net/recovery.img /mnt/net/recovery.log
    
    # Last one!
    /mnt/net/ddrescue-1.10/ddrescue --direct --retrim  --max-retries=3 /dev/sda1 /mnt/net/recovery.img /mnt/net/recovery.log
    Now you can take the image and use dd to copy it onto a new partition on another disk and run fsck (or chkdsk if it's FAT32/NTFS) to attempt to fix any directory damage or just mount it on your machine if it's not too heavily damaged.
     
  11. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #11
    update time!: it has been going for umm about 4 hrs now, done 110,592 blocks (that it has skipped over according to the logs). if the block size if 512bytes (which i think it is), that means it has read 54mb, so about 1/4 of the way there.

    its 2am so im off to bed, hopefully in the morning something would have backed up!!

    night all.
     
  12. Tesselator macrumors 601

    Tesselator

    Joined:
    Jan 9, 2008
    Location:
    Japan
    #12
    Ah, you're recovering image via bit-stream sectors or reverse bit-stream? So the OS (files and folders) is shot? Do you hear the head actuating at all during this scan-recovery process? If not it's using bit-stream techniques. So no OS Mounting information - or at least not enough for OS X to mount it... but you can see the device manufacturer number and etc.? This my imply that part of the damaged area is the servo information data / UBS / MFT / ETC.. Sometimes using "MacDrive" on a PC will allow you to mount it with the error and then you can recover the data anyway. ;) OS X is too picky in lots of cases. If the entire self-check doesn't complete it won't mount the drive. Part of the self-check is reading the drives' System Area and if one of the UBA's is the located where the platter was scratched... No mounty-mounty. Same I think for the partition tables slash MFT too. :( If that's case you won't be able to use it at all after this recovery process. I mean as a normal drive again.
     
  13. Tesselator macrumors 601

    Tesselator

    Joined:
    Jan 9, 2008
    Location:
    Japan
    #13

    At this point I think I would stop it immediately. I would look inside at the platters. And then if not wasted in the areas it's been scanning in until now, I would find a utility that will reverse scan. It's probably already too late tho. If the head moved across the scratched area then usually that damages the head. Damaged head means you need to replace the heads if you're serious about the recovery. :) Additionally the software you're using may be moving a head (damaged enough to scratch a platter further) into an undamaged area potentially damaging it - by trying to read it. This was in Wotan31's post for me when he said:

    "Unfortunately, by using this consumer-grade recovery software, it likely eliminates the possibility for a pro to recover the data now. I.e. this kind of software usually does more harm than good."​

    It's a very good thing this data isn't critical!

    :)
     
  14. Wotan31 macrumors 6502

    Joined:
    Jun 5, 2008
    #14
    x2 that's for sure!!

    I know if it was my data, I'd gladly pay the pro's to work their magic. I have 10 years worth of emails, business documents, school projects, vacation photos, home videos, financial records, etc. on my laptop. Stuff that can never be reproduced once it's lost. Plus dozens (hundreds?) of man-hours spent ripping my large CD collection into Apple Lossless format.

    My data is easily worth $2500 (to me). But that's why I keep multiple off-site backups that I rotate monthly. Yeah... I'm a little paranoid. :D
     
  15. Wotan31 macrumors 6502

    Joined:
    Jun 5, 2008
    #15
    Listen to Tesselator's advice.

    I just read the Spin Rite web site, and that is really, really, REALLY the wrong tool for the job here. You've likely buggered up the drive permanently by using Spin Rite. :eek: Seriously. :eek: :eek: :eek:

    Spin Rite doesn't care about your filesystem type, because spin rite is not a data recovery tool! Spin Rite does one thing, and one thing only: bad block relocation.

    What is Bad Block Relocation? Spin Rite attempts to read the bad blocks on your hard drive, relocate that data elsewhere on the drive, then mark those blocks as "unusable" so the drive won't attempt to use them again. That's fine and well - unless you're dealing with a physically damaged drive.

    This drive has been dropped. I.e. it is physically damaged. As Tesselator said, Using Spin Rite to forcefully try and access the damaged area will most likely bollocks this drive up even more.

    There's no way to know the extent of the damage without physically opening the drive and inspecting it - something neither you, nor I are qualified to do. Therefore, there are three possible scenarios; one or more damaged heads, one or more damaged platters, or both.

    - A damaged drive head accessing a good platter area can damage the platter.

    - A good drive head accessing a damaged platter area can damage the head.

    Either way you are only causing more damage by using Spin Rite. It is absolutely the wrong tool for the job.

    Your only chance for success here is to use a data recovery tool. NOT a bad block relocating tool. A data recovery tool is filesystem-specific I.e. it must be compatible with the filesystem type you are trying to recover. It will try to read all files from the disk EXCEPT the bad areas. It is the exact opposite of what Spin Rite does. But now it's likely too late...
     
  16. Jethryn Freyman macrumors 68020

    Jethryn Freyman

    Joined:
    Aug 9, 2007
    Location:
    Australia
    #16
    Use the dd command (Google it) to clone to drive (and use the noerror option.) Try running the recovery software on the clone.

    Also, try Testdisk/Photorec for recovery.

    EDIT:

    Command is:

    Code:
    sudo dd bs=512 if=/dev/damageddisk of=dmgfilehere conv=noerror,sync
    You may need to first unmount the damaged disk, but leave it connected, and have the disk image unmounted.
     
  17. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #17
    i have no idea, but im guessing bit-stream. whats the difference?

     
  18. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #18
    ok here another twisting update!!

    as Tess suggested, i can get it to mount using MacDrive!! i can see the files, but most of them are aliases (its only got Time Machine backups on there). if i try to copy the data across it just sorta sits there and does nothing.

    would cloning be a good idea??
     
  19. Wotan31 macrumors 6502

    Joined:
    Jun 5, 2008
    #19
    Actually, that's a pretty good idea. How does dd deal with the unreadable blocks though? Will it write 0's to the output? Or will it simply truncate the unreadable part out? Either way, the filesystem will have to be repaired afterwards to correct for the unexpected data.

    Also, I hope all these recovery attempts are not being performed while the drive is USB connected? USB does not carry over the full SATA (or PATA) command set that a dedicated recovery tool would depend on. Firewire is better about translating block device commands, but still, a direct SATA (or PATA) connection will give the highest chance for recovery.

    Personally, I would stick the drive in a linux desktop PC, boot from a live-CD, and attempt the DD using the noerror option there. I would DD it to another same-capacity drive though, instead of a file. You can then take that same-capacity drive and use some filesystem recovery tools on it.

    Either way, good luck with it all and let us know how it turns out.
     
  20. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #20
    ok i will do that method (except on osx). i am imaging my identical 500gb drive to another drive, then i will back it up and run recovery software on it.

    thanks for all the help ill let you know how it goes.

    oh ps: the dead drive was directly plugged in via sata, recovery drive was fw400.
     
  21. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #21
    ok so i tried doing dd, but as soon as i started it all i could hear was intense amounts of scratching and whatnot so i stopped it straight away.

    i am thinking of reformatting and then trying to recover deleted data (fixing the invalid partition data stuff would make it better i am hoping). hmmmm
     
  22. Jethryn Freyman macrumors 68020

    Jethryn Freyman

    Joined:
    Aug 9, 2007
    Location:
    Australia
    #22
    If it's a hardware fault, doing anything will just damage it more. If you can't get it done by a pro, you may as well just let dd run and recover as much as you can.

    Wouldn't help, data recovery programs look for files and ignore the hard drive directory.
     
  23. Tesselator macrumors 601

    Tesselator

    Joined:
    Jan 9, 2008
    Location:
    Japan
    #23
    But I totally disagree about qualifications! Inspecting a drive is as simple as having a screwdriver and a clean tabletop. That's it. Nothing special is needed. If you have dandruff and plan on looking at it for hours then you might want clean-ware and a clean-room. But just to open it and look at the platter and close it again will not cause ANY unordinary or diverse affects on it's operation. Just open it, maybe take a digital photo or two, and close it again. Simple. :)

    Replacing the heads is not simple but still very well within the abilities of anyone who has ever done any miniature modeling or used tools to work on small delicate things.
     
  24. LouDoillon macrumors newbie

    Joined:
    Jul 6, 2009
    #24
    Re:

    Hey i got good and satisfied results from Stellar Phoenix Hard Drive Recovery Software why don't you try this efficient and powerful tool.Gud luck
     
  25. DoFoT9 thread starter macrumors P6

    DoFoT9

    Joined:
    Jun 11, 2007
    Location:
    Singapore
    #25
    already did, it couldnt get it. thanks anyway haha!
     

Share This Page