Hard Drive Recovery Help (not for the faint hearted)

[DoFoT9]

Hey all,

I have been attempting to recover a hard drive for a friend all day long and I am starting to run out of ideas.

The situation is this: she had her laptop stolen, had a complete Time Machine backup on her LaCie external USB hard drive.. and then she dropped it... stupid i know!

Symptoms of drive:
• Recognised by Disk Utility but will not mount
• Clicks occasionally
otherwise it spins up fine..

What I have attempted:
• Disc Warrior
• Data Rescue II

What is currently going:
• Spin Rite (using setting #2)

I think i have found the problem, Spin Rite will freeze at about 104-209mb into its run (about the first 400,000,000 bytes into it), but if i choose to scan after about 500mb it will run flawlessly (well so far anyway, its up to about 15% and is going fine).
EDIT: now at 22% and going fine
EDIT: 36%, fine
EDIT: 55%. fine

this leads me to believe that the drive was writing some critical data to the mounting/information section of the drive what it was dropped, but the data on the drive is still recoverable.

My Idea:
to find some software that can be told to copy the partition/data from a certain spot onwards (because the whole drive freezes when trying to copy the damaged part).

anyone ever tried this? is there ANY way i could do this??

thanks in advance

DoFoT9

EDIT: heres another question, it says (in SpinRite) "Drive: MBR followed by EFI", i was under the impression that MBR was only fat32/NTFS drives, clearly i dont know enough here..

 

[DoFoT9]

just got back from work and the SpinRite test has finished, it didnt report any errors after the first 200 or so mb.

anyone got any suggestions??

i was thinking of reformatting it, then doing a salvage.. but that probably wouldnt work would it??? hmm 😕

 

[mattyb240]

I didn't think spin rite worked with mac partition?

But I love that program when it gets stuck just leave it and walk away, that happened to my friends laptop that would'nt even switch on! Then 48 hours later completely working laptop! Be patient

 

[DoFoT9]

I didn't think spin rite worked with mac partition?

But I love that program when it gets stuck just leave it and walk away, that happened to my friends laptop that would'nt even switch on! Then 48 hours later completely working laptop! Be patient

SpinRite doesnt worry about formats, its below that level.

im afraid this situation is much much more worse then yours friends but (mainly because SpinRite was going so slow it was calculating over the time limit that it had).

 

[Wotan31]

What I have attempted:
• Disc Warrior
• Data Rescue II

Data recovery from a physically damaged drive is a tricky thing and not something I would attempt. It normally cannot be done with software alone. This is where you call the pro's and pay for a professional data recovery service. The pro's will open the drive in a clean-room, and transplant the platters into another identical model drive. They also have much more serious software tools at their disposal.

Unfortunately, by using this consumer-grade recovery software, it likely eliminates the possibility for a pro to recover the data now. I.e. this kind of software usually does more harm than good. 🙁

 

[Guiyon]

I've had excellent luck with ddrescue on failing drives in the past. It does require a bit of CLI knowledge, however. You'll need to boot into a LiveCD from some distro (I prefer Gentoo), compile the tool and let it run. It will take some time to run; the last drive I rescued with it has an increasing number of bad blocks and it ended up taking a good 72 hours or so to complete all the passes; I did manage to read everything except for a 4MB chunk though.. One warning: anything like this tends to really stress the drive and it's entirely possible it could fail partially through the recovery.

 

[Tesselator]

Data recovery from a physically damaged drive is a tricky thing and not something I would attempt. It normally cannot be done with software alone. This is where you call the pro's and pay for a professional data recovery service. The pro's will open the drive in a clean-room, and transplant the platters into another identical model drive. They also have much more serious software tools at their disposal.

Unfortunately, by using this consumer-grade recovery software, it likely eliminates the possibility for a pro to recover the data now. I.e. this kind of software usually does more harm than good. 🙁

From dropping two things usually happen. The heads get damaged, and the platter gets a physical gouge in it. If all but 200MB reads sequentially then the heads are OK (as data is written in an interleaved fashion Plater 1 - Sector 1, Platter 2 - Sector 1, Platter 3 - Sector 1, Platter 1 - Sector 2, and etc.). This would seem to imply that the platter is damaged. What can't be read won't be recoverable - even by a professional service.

You can probably format around the bad sectors and map out the errors but it'll likely be 200MB smaller than before. And I wouldn't trust it's operation for very long.

 

[spacepower7]

Sorry to thread jack

Hey Guiyon,

Can you recommend any sites with instructions to use ddrescue. I downloaded a ubuntu-rescue-remix liveCD. I was thinking of trying to install that on a usb key drive. I am trying to recover a Windows XP drive with mechanical failure.

I tried about 6 different Mac utilities and only found one that could clone the whole 40GB PC drive. the problem is that this is a dmg on an HFS+ volume, so I don't think that the linux/ubuntu can read it. Can I reformat a drive to FAT32 (doubt it) or linux file system and transfer the dmg there? Or should I just try to re-clone the PC drive?

All I really need to recover from the PC drive is jpegs, nothing else matters.

Any ideas?

This method might be helpful to the OP

 

[DoFoT9]

Data recovery from a physically damaged drive is a tricky thing and not something I would attempt. It normally cannot be done with software alone. This is where you call the pro's and pay for a professional data recovery service. The pro's will open the drive in a clean-room, and transplant the platters into another identical model drive. They also have much more serious software tools at their disposal.

i am the direct go to man and i feel that i am competent enough to get this data back, given the situation it seems likely that i can (if i can fulfill getting to choose which section of data i want to proceed from then the rest of the data can be retrieved successfully).

she got quoted $2500 to get the data retrieved, that is out of her price range.

Unfortunately, by using this consumer-grade recovery software, it likely eliminates the possibility for a pro to recover the data now. I.e. this kind of software usually does more harm than good. 🙁

the entire drive is not damaged, merely a single portion of it.

I've had excellent luck with ddrescue on failing drives in the past. It does require a bit of CLI knowledge, however. You'll need to boot into a LiveCD from some distro (I prefer Gentoo), compile the tool and let it run. It will take some time to run; the last drive I rescued with it has an increasing number of bad blocks and it ended up taking a good 72 hours or so to complete all the passes; I did manage to read everything except for a 4MB chunk though.. One warning: anything like this tends to really stress the drive and it's entirely possible it could fail partially through the recovery.

not really keen on using any other OS's to recover it, but thanks for the suggestion, i will try it out if i can.

i am certain that the bad plattor/sector/whatever is completely gone and un-retrievable by me, that doesnt matter though its only the first little bit of the drive.

From dropping two things usually happen. The heads get damaged, and the platter gets a physical gouge in it. If all but 200MB reads sequentially then the heads are OK (as data is written in an interleaved fashion Plater 1 - Sector 1, Platter 2 - Sector 1, Platter 3 - Sector 1, Platter 1 - Sector 2, and etc.). This would seem to imply that the platter is damaged. What can't be read won't be recoverable - even by a professional service.

hmmm good to hear then. its only the first little bit, less then 0.5% of the beginning of the drive, which makes me think that its the "important stuff" for the drive, which may be why it isnt mounting?? (file system etc cant be read, does that seem plausible?). that is why i thought of a reformat, the important data would be re-written to readable areas.

i am running data rescue using the "thorough scan" setting, it is taking a bajillion years (say it has 885 days to go), but i am hoping that once it gets though the first 200mb or whatever that it will fly through the rest of the data. 🙂 thats the plan anyway....😱

You can probably format around the bad sectors and map out the errors but it'll likely be 200MB smaller than before. And I wouldn't trust it's operation for very long.

really?? you think that would work?? then i could use Data Rescue with the setting "Recover deleted files" or something to retrieve the readable data??

of course, if i get the data back, i will be recommending that she purchase a new hard drive.

thanks for all the input guys.

its up to block 90,112.. of a 500GB hard drive.. i recall there being a good billion blocks when i checked it before, sooooo it still has a long way to go haha! i wonder how far until it has done the 200mb.

 

[Guiyon]

Can I reformat a drive to FAT32 (doubt it) or linux file system and transfer the dmg there? Or should I just try to re-clone the PC drive?P

The nice thing about ddrescue is that the formatting doesn't matter; it's just reading blocks from the drive and saving them to a disk image (the image can easily be mounted in Mac OS X).

Note: I was performing a recovery from one computer to another. If your main machine is bootable you can skip all the below steps, just compile and run ddrescue (assuming you have the dev tools installed), no need for the LiveCD.

First, I grabbed the XFCE-based i686 image as it has support for cifs and a basic gcc setup. Once that was burned I enabled SMB sharing (make sure the share folder has been chmodded 777) and booted the dying laptop off the CD. Next I began setting up the restore (I downloaded ddrescue and compiled it on the share but you can do anywhere you have write privs)

sudo -s
mkdir /mnt/net
mount -t cifs -o username=myuser,password=mypass //192.168.0.2/Sharename /mnt/net
cd /mnt/net
wget "http://ftp.gnu.org/gnu/ddrescue/ddrescue-1.10.tar.gz"
tar -zxf ddrescue-1.10.tar.gz
cd ddrescue-1.10
./configure
make

#Now, assuming the drive is sda and you want to recover partition 1
/mnt/net/ddrescue-1.10/ddrescue --no-split /dev/sda1 /mnt/net/recovery.img /mnt/net/recovery.log

/mnt/net/ddrescue-1.10/ddrescue --direct --max-retries=3 /dev/sda1 /mnt/net/recovery.img /mnt/net/recovery.log

# Last one!
/mnt/net/ddrescue-1.10/ddrescue --direct --retrim  --max-retries=3 /dev/sda1 /mnt/net/recovery.img /mnt/net/recovery.log

Now you can take the image and use dd to copy it onto a new partition on another disk and run fsck (or chkdsk if it's FAT32/NTFS) to attempt to fix any directory damage or just mount it on your machine if it's not too heavily damaged.

 

[DoFoT9]

update time!: it has been going for umm about 4 hrs now, done 110,592 blocks (that it has skipped over according to the logs). if the block size if 512bytes (which i think it is), that means it has read 54mb, so about 1/4 of the way there.

its 2am so im off to bed, hopefully in the morning something would have backed up!!

night all.

 

[Tesselator]

hmmm good to hear then. its only the first little bit, less then 0.5% of the beginning of the drive, which makes me think that its the "important stuff" for the drive, which may be why it isnt mounting?? (file system etc cant be read, does that seem plausible?). that is why i thought of a reformat, the important data would be re-written to readable areas.

i am running data rescue using the "thorough scan" setting, it is taking a bajillion years (say it has 885 days to go), but i am hoping that once it gets though the first 200mb or whatever that it will fly through the rest of the data. 🙂 thats the plan anyway....😱

Ah, you're recovering image via bit-stream sectors or reverse bit-stream? So the OS (files and folders) is shot? Do you hear the head actuating at all during this scan-recovery process? If not it's using bit-stream techniques. So no OS Mounting information - or at least not enough for OS X to mount it... but you can see the device manufacturer number and etc.? This my imply that part of the damaged area is the servo information data / UBS / MFT / ETC.. Sometimes using "MacDrive" on a PC will allow you to mount it with the error and then you can recover the data anyway. 😉 OS X is too picky in lots of cases. If the entire self-check doesn't complete it won't mount the drive. Part of the self-check is reading the drives' System Area and if one of the UBA's is the located where the platter was scratched... No mounty-mounty. Same I think for the partition tables slash MFT too. 🙁 If that's case you won't be able to use it at all after this recovery process. I mean as a normal drive again.

 

[Tesselator]

update time!: it has been going for umm about 4 hrs now, done 110,592 blocks (that it has skipped over according to the logs). if the block size if 512bytes (which i think it is), that means it has read 54mb, so about 1/4 of the way there.

its 2am so im off to bed, hopefully in the morning something would have backed up!!

night all.

At this point I think I would stop it immediately. I would look inside at the platters. And then if not wasted in the areas it's been scanning in until now, I would find a utility that will reverse scan. It's probably already too late tho. If the head moved across the scratched area then usually that damages the head. Damaged head means you need to replace the heads if you're serious about the recovery. 🙂 Additionally the software you're using may be moving a head (damaged enough to scratch a platter further) into an undamaged area potentially damaging it - by trying to read it. This was in Wotan31's post for me when he said:

"Unfortunately, by using this consumer-grade recovery software, it likely eliminates the possibility for a pro to recover the data now. I.e. this kind of software usually does more harm than good."​

It's a very good thing this data isn't critical!

🙂

 

[Wotan31]

It's a very good thing this data isn't critical!

x2 that's for sure!!

I know if it was my data, I'd gladly pay the pro's to work their magic. I have 10 years worth of emails, business documents, school projects, vacation photos, home videos, financial records, etc. on my laptop. Stuff that can never be reproduced once it's lost. Plus dozens (hundreds?) of man-hours spent ripping my large CD collection into Apple Lossless format.

My data is easily worth $2500 (to me). But that's why I keep multiple off-site backups that I rotate monthly. Yeah... I'm a little paranoid. 😀

 

[Wotan31]

At this point I think I would stop it immediately.

Listen to Tesselator's advice.

I just read the Spin Rite web site, and that is really, really, REALLY the wrong tool for the job here. You've likely buggered up the drive permanently by using Spin Rite. 😱 Seriously. 😱 😱 😱

Spin Rite doesn't care about your filesystem type, because spin rite is not a data recovery tool! Spin Rite does one thing, and one thing only: bad block relocation.

What is Bad Block Relocation? Spin Rite attempts to read the bad blocks on your hard drive, relocate that data elsewhere on the drive, then mark those blocks as "unusable" so the drive won't attempt to use them again. That's fine and well - unless you're dealing with a physically damaged drive.

This drive has been dropped. I.e. it is physically damaged. As Tesselator said, Using Spin Rite to forcefully try and access the damaged area will most likely bollocks this drive up even more.

There's no way to know the extent of the damage without physically opening the drive and inspecting it - something neither you, nor I are qualified to do. Therefore, there are three possible scenarios; one or more damaged heads, one or more damaged platters, or both.

- A damaged drive head accessing a good platter area can damage the platter.

- A good drive head accessing a damaged platter area can damage the head.

Either way you are only causing more damage by using Spin Rite. It is absolutely the wrong tool for the job.

Your only chance for success here is to use a data recovery tool. NOT a bad block relocating tool. A data recovery tool is filesystem-specific I.e. it must be compatible with the filesystem type you are trying to recover. It will try to read all files from the disk EXCEPT the bad areas. It is the exact opposite of what Spin Rite does. But now it's likely too late...

 

[Jethryn Freyman]

Use the dd command (Google it) to clone to drive (and use the noerror option.) Try running the recovery software on the clone.

Also, try Testdisk/Photorec for recovery.

EDIT:

Command is:

sudo dd bs=512 if=/dev/damageddisk of=dmgfilehere conv=noerror,sync

You may need to first unmount the damaged disk, but leave it connected, and have the disk image unmounted.

 

[DoFoT9]

Ah, you're recovering image via bit-stream sectors or reverse bit-stream?

i have no idea, but im guessing bit-stream. whats the difference?

So the OS (files and folders) is shot? Do you hear the head actuating at all during this scan-recovery process? If not it's using bit-stream techniques.

yup i can hear something going on 🙂

So no OS Mounting information - or at least not enough for OS X to mount it... but you can see the device manufacturer number and etc.? This my imply that part of the damaged area is the servo information data / UBS / MFT / ETC..

yup i can see the drive number and even the partition but there is no information on the size of the partition (can see the overall size of the drive). thats why i tried the recovery thing, hoping that it would eventually pass over the damaged parts.

Sometimes using "MacDrive" on a PC will allow you to mount it with the error and then you can recover the data anyway. 😉 OS X is too picky in lots of cases. If the entire self-check doesn't complete it won't mount the drive. Part of the self-check is reading the drives' System Area and if one of the UBA's is the located where the platter was scratched... No mounty-mounty. Same I think for the partition tables slash MFT too. 🙁 If that's case you won't be able to use it at all after this recovery process. I mean as a normal drive again.

excellent! i have MacDrive, i will try it the minute after this post is sent!!

LUCKILY it didnt finish going what i percieved to be the damaged area (it was at about 200mb when i stopped it). so i am hoping that this means it hasnt damaged any further areas 🙂

At this point I think I would stop it immediately. I would look inside at the platters. And then if not wasted in the areas it's been scanning in until now, I would find a utility that will reverse scan. It's probably already too late tho. If the head moved across the scratched area then usually that damages the head.

as i said above, this utility didnt go past where the damaged heads were, but SpinRite did, so that could of been my mistake.

Damaged head means you need to replace the heads if you're serious about the recovery. 🙂 Additionally the software you're using may be moving a head (damaged enough to scratch a platter further) into an undamaged area potentially damaging it - by trying to read it. This was in Wotan31's post for me when he said:

"Unfortunately, by using this consumer-grade recovery software, it likely eliminates the possibility for a pro to recover the data now. I.e. this kind of software usually does more harm than good."​

hmmm replacing the heads could be possible, i have an identical drive - but its my main windows OS/hack drive. dont know if im willing to risk it haha!

x2 that's for sure!!

I know if it was my data, I'd gladly pay the pro's to work their magic. I have 10 years worth of emails, business documents, school projects, vacation photos, home videos, financial records, etc. on my laptop. Stuff that can never be reproduced once it's lost. Plus dozens (hundreds?) of man-hours spent ripping my large CD collection into Apple Lossless format.

My data is easily worth $2500 (to me). But that's why I keep multiple off-site backups that I rotate monthly. Yeah... I'm a little paranoid. 😀

yea ok that is a tad paranoid 😛 im still trying to get my head over the fact that she dropped the HD when it was her only means of data.. idiot

Listen to Tesselator's advice.

I just read the Spin Rite web site, and that is really, really, REALLY the wrong tool for the job here. You've likely buggered up the drive permanently by using Spin Rite. 😱 Seriously. 😱 😱 😱

yup i figured that when Tess said that. ****

Spin Rite doesn't care about your filesystem type, because spin rite is not a data recovery tool! Spin Rite does one thing, and one thing only: bad block relocation.

yup thats why i knew it would work when i scanned it.

What is Bad Block Relocation? Spin Rite attempts to read the bad blocks on your hard drive, relocate that data elsewhere on the drive, then mark those blocks as "unusable" so the drive won't attempt to use them again. That's fine and well - unless you're dealing with a physically damaged drive.

This drive has been dropped. I.e. it is physically damaged. As Tesselator said, Using Spin Rite to forcefully try and access the damaged area will most likely bollocks this drive up even more.

i 100% understand the implications of this here...

however, i have one tiny thing up my sleve that i think may save me.

i started the major scan of the WHOLE drive from AFTER the damaged part on the drive!!! (started the scan from 1%, when i used SpinRite it would always slow down at around 0.419%). do you think this may save me??

There's no way to know the extent of the damage without physically opening the drive and inspecting it - something neither you, nor I are qualified to do. Therefore, there are three possible scenarios; one or more damaged heads, one or more damaged platters, or both.

- A damaged drive head accessing a good platter area can damage the platter.

- A good drive head accessing a damaged platter area can damage the head.

hmmmmm.... in no way am i qualified.. but its tempting. i wont open it but.

Either way you are only causing more damage by using Spin Rite. It is absolutely the wrong tool for the job.

like i said i only ran it once the whole way through - skipping the damaged part in that scan.

Your only chance for success here is to use a data recovery tool. NOT a bad block relocating tool. A data recovery tool is filesystem-specific I.e. it must be compatible with the filesystem type you are trying to recover. It will try to read all files from the disk EXCEPT the bad areas. It is the exact opposite of what Spin Rite does. But now it's likely too late...

see im not sure if it is too late, i stopped the "recovery backup" from Mac Data Rescue II because you all told me to stop immediately haha!! i will try mounting the drive on a PC and see where that gets me.

if that does not (which i am fairly certain it wont). what recovery software is recommended?? all i really need is software that lets me choose where to start the recovery from, because there are no problems reading after the damaged areas are passed..

thanks so much!

Use the dd command (Google it) to clone to drive (and use the noerror option.) Try running the recovery software on the clone.

Also, try Testdisk/Photorec for recovery.

EDIT:

Command is:

sudo dd bs=512 if=/dev/damageddisk of=dmgfilehere conv=noerror,sync

excellent thankyou! this could possibly damage the disk further though because it would read over the bad part and then continue to read over the good part?? (see above)

You may need to first unmount the damaged disk, but leave it connected, and have the disk image unmounted.

it doesnt mount anyway, so theres a plus 😛

ok:: MacDrive cannot mount the drive, it says there was an error during the installation process of the drivers :\

i noticed in Data Rescue is says this:

Name: Unknown,  Bus: USB,  Dev: /dev/rdisk1s2,  Size: 465.4 GB,  [B]Start: 0[/B]

i wonder if i can change the start position :\

 

[DoFoT9]

ok here another twisting update!!

as Tess suggested, i can get it to mount using MacDrive!! i can see the files, but most of them are aliases (its only got Time Machine backups on there). if i try to copy the data across it just sorta sits there and does nothing.

would cloning be a good idea??

 

[Wotan31]

Use the dd command (Google it) to clone to drive (and use the noerror option.) Try running the recovery software on the clone.

Actually, that's a pretty good idea. How does dd deal with the unreadable blocks though? Will it write 0's to the output? Or will it simply truncate the unreadable part out? Either way, the filesystem will have to be repaired afterwards to correct for the unexpected data.

Also, I hope all these recovery attempts are not being performed while the drive is USB connected? USB does not carry over the full SATA (or PATA) command set that a dedicated recovery tool would depend on. Firewire is better about translating block device commands, but still, a direct SATA (or PATA) connection will give the highest chance for recovery.

Personally, I would stick the drive in a linux desktop PC, boot from a live-CD, and attempt the DD using the noerror option there. I would DD it to another same-capacity drive though, instead of a file. You can then take that same-capacity drive and use some filesystem recovery tools on it.

Either way, good luck with it all and let us know how it turns out.

 

[DoFoT9]

Actually, that's a pretty good idea. How does dd deal with the unreadable blocks though? Will it write 0's to the output? Or will it simply truncate the unreadable part out? Either way, the filesystem will have to be repaired afterwards to correct for the unexpected data.

Also, I hope all these recovery attempts are not being performed while the drive is USB connected? USB does not carry over the full SATA (or PATA) command set that a dedicated recovery tool would depend on. Firewire is better about translating block device commands, but still, a direct SATA (or PATA) connection will give the highest chance for recovery.

Personally, I would stick the drive in a linux desktop PC, boot from a live-CD, and attempt the DD using the noerror option there. I would DD it to another same-capacity drive though, instead of a file. You can then take that same-capacity drive and use some filesystem recovery tools on it.

Either way, good luck with it all and let us know how it turns out.

ok i will do that method (except on osx). i am imaging my identical 500gb drive to another drive, then i will back it up and run recovery software on it.

thanks for all the help ill let you know how it goes.

oh ps: the dead drive was directly plugged in via sata, recovery drive was fw400.

 

[DoFoT9]

ok so i tried doing dd, but as soon as i started it all i could hear was intense amounts of scratching and whatnot so i stopped it straight away.

i am thinking of reformatting and then trying to recover deleted data (fixing the invalid partition data stuff would make it better i am hoping). hmmmm

 

[Jethryn Freyman]

ok so i tried doing dd, but as soon as i started it all i could hear was intense amounts of scratching and whatnot so i stopped it straight away.

If it's a hardware fault, doing anything will just damage it more. If you can't get it done by a pro, you may as well just let dd run and recover as much as you can.

i am thinking of reformatting and then trying to recover deleted data (fixing the invalid partition data stuff would make it better i am hoping). hmmmm

Wouldn't help, data recovery programs look for files and ignore the hard drive directory.

 

[Tesselator]

There's no way to know the extent of the damage without physically opening the drive and inspecting it - something neither you, nor I are qualified to do. Therefore, there are three possible scenarios; one or more damaged heads, one or more damaged platters, or both.

But I totally disagree about qualifications! Inspecting a drive is as simple as having a screwdriver and a clean tabletop. That's it. Nothing special is needed. If you have dandruff and plan on looking at it for hours then you might want clean-ware and a clean-room. But just to open it and look at the platter and close it again will not cause ANY unordinary or diverse affects on it's operation. Just open it, maybe take a digital photo or two, and close it again. Simple. 🙂

Replacing the heads is not simple but still very well within the abilities of anyone who has ever done any miniature modeling or used tools to work on small delicate things.

 

[LouDoillon]

Re:

Hey i got good and satisfied results from Stellar Phoenix Hard Drive Recovery Software why don't you try this efficient and powerful tool.Gud luck

 

[DoFoT9]

Hey i got good and satisfied results from Stellar Phoenix Hard Drive Recovery Software why don't you try this efficient and powerful tool.Gud luck

already did, it couldnt get it. thanks anyway haha!