I tried a whole bunch of things, and all that (part 2)

admin — Sun, 24 Dec 2006 08:18:13 +0000

This is part of the hard disk recovery documentation.

Part 2.

I tried a whole bunch of things (most that didn’t work), and all that.

What is there to do? Data recovery services that run into the thousands of dollars can probably get most of the data back — they have a track record of that. My data isn’t worth nearly that much, sad to say. But I don’t feel like abandoning perfectly good data, either. Yes, there is probably McNorton ViralGhostSpy or whatever this bloatware is called these days; I don’t know… I prefer more flexibility so I’ll take the trouble to proceed with free or freely available tools.

Since the Seagate disk is too dead to figure out what is on itself, I need to get its contents off onto another medium. I need two things: some means of getting the only computer that can read the disk as is (the laptop) into a working state, and some means of direct disk copying from the laptop. I have an enclosured USB drive: 160GB. Let’s work with that. To protect the original broken Seagate, I left it out of the laptop for the time being.

Many a self-proclaimed miracle recovery boot disks/discs conceivably take care of both tasks. A quick search turns up a boot floppy software called “EaseUs disk copy” using a self-booting “freedos” but it was useless because it would like to copy within a computer (from master IDE drive to slave). Into the trash it goes. There were a few others like this, all useless.

Next up, I’ve got some Windows-based disk editor tool. Maybe I can install Windows on this external USB hard disk so I can boot the laptop? No. Evidently it isn’t supported. Windows installed fine on the external USB drive (all files are copied), but on the first boot BSOD’d. Some say there is a way to hack the Windows CD to make this work. Well I don’t have that much time to waste, so forget that.

Next up, Knoppix version 5 (Linux Knoppix 2.6.17 #4 SMP PREEMPT, i686 GNU/Linux). I had some difficulty mounting the external USB hard drive, but finally by booting from CD, then attaching the external drive after startup, Knoppix found it and stuck it under /dev/sdaN (for N in 1,2,etc.). The drive had a 20GB FAT32 partition already (where I attempted to install Windows before), along with an empty 120GB partition, so the empty partition was at /dev/sda2.

These days, the favorite recovery tool under Knoppix seems to be the ignore-on-read-error disk copy tool called ddrescue (not the Knoppix-included dd_rescue). I believe the difference is that ddrescue is much more automatic in dealing with the log file — this is important. Both will copy a disk’s contents into a disk image file. ddrescue needs to be compiled though; fortunately compilation was clean.

The choice of filesystem for /dev/sda2, which would hold the disk image, was limited. The plan was to eventually read the data on a Windows computer, which would be easiest with FAT32 or NTFS. However, NTFS write-support on Knoppix is of unknown reliability (– why? I don’t know). I tried FAT32, using mkdosfs to format because Windows refuses to format a FAT32 volume larger than 32GB. Then I even began copying data before realizing, to my chagrin, that FAT32 has another limit: 4GB on the file size. That left ext2, and its default block-size of 4K was fine (block-size under 2K would be a problem due to file size limitation), so something like:

# mkfs.ext2 /dev/sda2
# mount -t ext2 /dev/sda2 /media/sda2

Progress.

Now, computer off. Broken Seagate goes back in. Boot. And… no boot. The boot sequence now stuck at two points where it wanted to read the Seagate drive (on /dev/hda): First, it attempted to find a (nonexistent) CD on /dev/hda, resulting in churning the hard drive for a few seconds (damaging my data further, I’m sure!) Next, at the auto-detection stage to create /etc/fstab, Knoppix repeatedly tried to read the drive, and apparently would go no further. Online sources are rife with suggestions of passing the boot options “nofstab” and “noswap” to the kernel to solve this problem. Wrong. With these options set, it still had the same problem at the auto-creation of /etc/fstab. The solution turned out to be nail-biting patience: After booting and allowing the auto-detection to proceed for 10+ minutes of now-familiar churn-churn-churn on the broken Seagate, heating it up and losing me more data, it eventually did go on and boot. Um… whoever is responsible for this boot code should be flogged or at least, made to go home and work on it some more. I can think of zero (0) reasons why this particular process warrants persisting through multiple disk read errors.

Now, /dev/hda wouldn’t mount (of course), but no matter. Here we have:

/media/sda2# ddrescue -B -n /dev/hda rescue.image rescue.log

ddrescue proceeded through the evening, surprising me by writing quite a bit of good data onto the disk image, even as it sticks briefly at various corrupted points, but then got bogged down at around 3200MB. I left it to its own devices at 3AM.

Lessons today:

Knoppix is genius. Why is there no Live-Windows-on-CD? Oh, I know why.
Knoppix is semi-retarded for disk recovery because it fights with a broken hard disk on boot.
FAT32 has a 4GB file-size limit even if you manage to format the volume to be rather large.
ddrescue is a great tool to have.

On to Part 3.

Some stuff » data recovery services

I tried a whole bunch of things, and all that (part 2)