{"id":37,"date":"2006-12-24T03:18:13","date_gmt":"2006-12-24T08:18:13","guid":{"rendered":"http:\/\/scripts.mit.edu\/~zong\/wpress\/?p=37"},"modified":"2008-01-26T00:40:30","modified_gmt":"2008-01-26T05:40:30","slug":"i-tried-a-whole-bunch-of-things-and-all-that-part-2","status":"publish","type":"post","link":"https:\/\/blog.yhuang.org\/?p=37","title":{"rendered":"I tried a whole bunch of things, and all that (part 2)"},"content":{"rendered":"<p>This is part of the hard disk recovery documentation.<\/p>\n<p>Part 2.<\/p>\n<p><font color=\"#770033\"><br \/>\nI tried a whole bunch of things (most that didn&#8217;t work), and all that.<\/p>\n<p>What is there to do?  Data recovery services that run into the thousands of dollars can probably get most of the data back &#8212; they have a track record of that.  My data isn&#8217;t worth nearly that much, sad to say.  But I don&#8217;t feel like abandoning perfectly good data, either.  Yes, there is probably McNorton ViralGhostSpy or whatever this bloatware is called these days; I don&#8217;t know&#8230; I prefer more flexibility so I&#8217;ll take the trouble to proceed with free or freely available tools.<\/font><br \/>\n<!--more--><br \/>\n<font color=\"#770033\">Since the Seagate disk is too dead to figure out what is on itself, I need to get its contents off onto another medium.  I need two things: some means of getting the only computer that can read the disk as is (the laptop) into a working state, and some means of direct disk copying from the laptop.  I have an enclosured USB drive: 160GB.  Let&#8217;s work with that.  To protect the original broken Seagate, I left it out of the laptop for the time being.<\/p>\n<p>Many a self-proclaimed miracle recovery boot disks\/discs conceivably take care of both tasks.  A quick search turns up a boot floppy software called &#8220;EaseUs disk copy&#8221; using a self-booting &#8220;freedos&#8221; but it was useless because it would like to copy <b>within<\/b> a computer (from master IDE drive to slave).  Into the trash it goes.  There were a few others like this, all useless.<\/p>\n<p>Next up, I&#8217;ve got some Windows-based disk editor tool.  Maybe I can install Windows on this external USB hard disk so I can boot the laptop?  No.  Evidently <a href=\"http:\/\/www.microsoft.com\/whdc\/device\/storage\/usb-boot.mspx\">it isn&#8217;t supported<\/a>.  Windows installed fine on the external USB drive (all files are copied), but on the first boot BSOD&#8217;d.  Some say there is a way to <a href=\"http:\/\/www.ngine.de\/index.jsp?pageid=4176\">hack the Windows CD<\/a> to make this work.  Well I don&#8217;t have that much time to waste, so forget that.<\/p>\n<p>Next up, Knoppix version 5 (Linux Knoppix 2.6.17 #4 SMP PREEMPT, i686 GNU\/Linux).  I had some difficulty mounting the external USB hard drive, but finally by booting from CD, <b>then<\/b> attaching the external drive <b>after startup<\/b>, Knoppix found it and stuck it under \/dev\/sdaN (for N in 1,2,etc.).  The drive had a 20GB FAT32 partition already (where I attempted to install Windows before), along with an empty 120GB partition, so the empty partition was at \/dev\/sda2.<\/p>\n<p>These days, the favorite recovery tool under Knoppix seems to be the ignore-on-read-error disk copy tool called <a href=\"http:\/\/www.gnu.org\/software\/ddrescue\/ddrescue.html\">ddrescue<\/a> (not the Knoppix-included <a href=\"http:\/\/www.garloff.de\/kurt\/linux\/ddrescue\/\">dd_rescue<\/a>).  I believe the difference is that ddrescue is much more automatic in dealing with the log file &#8212; this is important.  Both will copy a disk&#8217;s contents into a disk image file.  ddrescue needs to be compiled though; fortunately compilation was clean.<\/p>\n<p>The choice of filesystem for \/dev\/sda2, which would hold the disk image, was limited.  The plan was to eventually read the data on a Windows computer, which would be easiest with FAT32 or NTFS.  However, NTFS write-support on Knoppix is of unknown reliability (&#8211; why? I don&#8217;t know).  I tried FAT32, using mkdosfs to format because Windows refuses to format a FAT32 volume larger than 32GB.  Then I even began copying data before realizing, to my chagrin, that FAT32 has another limit: 4GB on the file size.  That left ext2, and its default block-size of 4K was fine (block-size under 2K would be a problem due to file size limitation), so something like:<\/p>\n<p>  # mkfs.ext2 \/dev\/sda2<br \/>\n  # mount -t ext2 \/dev\/sda2 \/media\/sda2<\/p>\n<p>Progress.<\/p>\n<p>Now, computer off.  Broken Seagate goes back in.  Boot.  And&#8230; no boot.  The boot sequence now stuck at two points where it wanted to read the Seagate drive (on \/dev\/hda):  First, it attempted to find a (nonexistent) CD on \/dev\/hda, resulting in churning the hard drive for a few seconds (damaging my data further, I&#8217;m sure!)  Next, at the auto-detection stage to create \/etc\/fstab, Knoppix repeatedly tried to read the drive, and apparently would go no further.  Online sources are rife with suggestions of passing the boot options &#8220;nofstab&#8221; and &#8220;noswap&#8221; to the kernel to solve this problem.  Wrong.  With these options set, it still had the same problem at the auto-creation of \/etc\/fstab.  The solution turned out to be nail-biting patience: After booting and allowing the auto-detection to proceed for 10+ minutes of now-familiar churn-churn-churn on the broken Seagate, heating it up and losing me more data, it eventually did go on and boot.  Um&#8230; whoever is responsible for this boot code should be flogged or at least, made to go home and work on it some more.  I can think of zero (0) reasons why this particular process warrants persisting through multiple disk read errors.<\/p>\n<p>Now, \/dev\/hda wouldn&#8217;t mount (of course), but no matter. Here we have: <\/p>\n<p>  \/media\/sda2#  ddrescue -B -n \/dev\/hda rescue.image rescue.log<\/p>\n<p>ddrescue proceeded through the evening, surprising me by writing quite a bit of good data onto the disk image, even as it sticks briefly at various corrupted points, but then got bogged down at around 3200MB.  I left it to its own devices at 3AM.<\/font><\/p>\n<p>Lessons today:<\/p>\n<ul>\n<li>Knoppix is genius. Why is there no Live-Windows-on-CD? Oh, I know why.<\/li>\n<li>Knoppix is semi-retarded for disk recovery because it fights with a broken hard disk on boot.<\/li>\n<li>FAT32 has a 4GB file-size limit even if you manage to format the volume to be rather large.<\/li>\n<li>ddrescue is a great tool to have.<\/li>\n<\/ul>\n<p>On to <a href=\"http:\/\/scripts.mit.edu\/~zong\/wpress\/?p=38\">Part 3<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is part of the hard disk recovery documentation. Part 2. I tried a whole bunch of things (most that didn&#8217;t work), and all that. What is there to do? Data recovery services that run into the thousands of dollars can probably get most of the data back &#8212; they have a track record of [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1408,392,1407,1409,1410,1411,1403,1405,1404,1406],"class_list":["post-37","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-boot","tag-computer","tag-data-recovery-services","tag-ddrescue","tag-dev","tag-disk","tag-external-usb-hard-disk","tag-hard-disk-recovery","tag-miracle-recovery","tag-usb-hard-disk"],"_links":{"self":[{"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=\/wp\/v2\/posts\/37","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=37"}],"version-history":[{"count":0,"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=\/wp\/v2\/posts\/37\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=37"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=37"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.yhuang.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=37"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}