DATA RECOVERY - please help! [SOLVED]

[Guinpen]

Dear all,

A 250 GB Maxtor harddrive holding a few years' worth of photos was dropped to the floor from about 1 meter while working in a USB enclosure. It wasn't pretty. The drive spins up and is able to access the single ext3 filesystem on it. I bought an identical drive today.

I need tips to restore as much of the data as possible. Shoud I go into the filesystem and copy off as much as possible, or should I try to dd the whole drive? I tried the former, but when it got to the damaged areas, the Gentoo LiveCD I was running kernel-panicked. I am trying manually descending into directories now and copying stuff, having mounted the old drive read-only, and the new one in synchronous mode (no buffered writes).

If it means shelling out money for Windows recovery software, then fine, but please let me know what to do and what not to do!

Thank you.

[NeddySeagoon]

Godji,

Do not operate the dropped drive any more than you have to.
Use dd_rhelp to make an image of the drive, directly on to the new drive if you like.
If the drive can be read without errors, that will be just like dd'ing the contents from one drive to another.
Should you get errors, dd_rhelp will skip to the largest unread space and try again, when all thats left are errorred sectors, it will try harders to read them.

When you have your copy, if it has errors, mount it read only to look around. You may want to make a further copy to work with, (so you have an undo facility) because you will need to run fsck on the errorred copy and that can make things worse, not better.
You must not mount the filesystem rw until you know its in a consistant state.

[edit] you may need to babysit dd_rescue by hand for the binary searches, if dd_rhelp does not restart at a new location after your panics
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[Pallokala]

Hi!

If you really want to be sure that you get all the photos back and you have money for it, consult some professional hard disk recovery firm. Your hard disk is still working and spins up, so they should be able to recove your data cheaper then if it has completely broken.

dd is good choice, if you can copy everything without kernel panic, but if not, try photorec, which belongs to package app-admin/testdisk .

Finally running Spinrite (commercial software) might help, but it might also break your hard disk finally.

Good luck!

-Pallokala
_________________
HumppaYes

[Guinpen]

I've decided to give dd_rhelp a try. It creates some recovery file from the sectors, but it dnoes't say what I should do with that file. I have some questions.

1) Will it fit on the exactly indentical 250 GB new drive?
2) How do I use it once recovery is done?
3) What happens if I stop the recovery after it has recovered a reasonable amount of data? Is the file a complete image of the harddisk then?
4) Can I only recover certain directories? Not everything is important, just most of it.

[NeddySeagoon]

Godji,

I point you to dd-rhelp on the web.

Essentially, dd_rhelp does the same thing as dd. What you get in the output file depends on the command you start it with.
It can be a disk image, if you point it at a disk, a partition image, if you point it at a partition, I assume you would get a file image if you used it on a file.

The images are the same size as the objects that they are images of.
With a partition image, you mount it with the loop option, so the file behaves like a real partition. You need loopback support for your kernel. Practice with an *.iso image file.

[Guinpen]

First of all let me extend my sincere thanks! I wish I had a way to repay you.

Rhile I understand what you said, I'll ask one more thing just to be sure.:

I understand that dd_rhelp will make an image file of my famaged drive. That image file will be as big as the drive. The problem is, to store the file, I need more space (log file + overhead for filesystem), and so the new disk, identical to the old one, will not be sufficient. Unfortunately, I cannot afford yet another, bigger drive. How could I work around this?

Maybe I could use dd_rhelp only on the files I need? But how can I do that in a more automated way? That's a lot of files! (I know learning bash and writing a script would be a good solution, but I do not want to experiment on this hard disk, and I don't have the time.)

[NeddySeagoon]

Godji,

Well, to linux, block deveices are files. So you can image one drive to the other. The problem remains what to do with the log, its needed to automate the stepping process.

dd_rescue allows it to be anywhere but dd_rhelp expects it to be in the same palce as the output 'file' and makes that assumption when reading it, which it does every time it hits an error. Thats a design feature of dd_rhelp.

What other space do you have, besides the new drive ?

One particular dirty hack that comes to mind it to sacrifice your swap space for a while and make a linear raid out the the new drive and swap, it will then appear as a block device with the new drive and swap attached end to end. The kernel will hide the join very nicely. This linear raid volume will then house the output files. When the recovery is done, you will have to move the data elsewhere to recover your swap. If the need for swap is desperate, you can make a swap file.
The kernel can stich about 16 partitions together into a single larger block device this way.

You can use a non journal filesystem on the output drive (ext2, not ext3), that saves 32Mb of overhead.
You can format the output drive with very few inodes, so more space is available for data.
You can reduce the space reserved for root from the defualt 5% of the filesystem to zero. You will probably be running dd_rhelp as root, so thats no help.

This may not work either - I have no idea how big the log will get.

dd_rescue also allows the output file to be sparse. That is, only blocks that hold data are present in the file, this blocks that are not recovered take up zero space. Missing blocks return zeros. This means tiy can have a 250Gb sparse file on a 1.4Mb floppy and read 250Gb of data from it, as long as you don't actually try to write much. There must be some overhead associated with that too. I don't think dd_rhelp passes this option to dd_rescue either.

So there are options yet without spending more money.
running dd_rhelp on directories or files is probably not useful, since it needs to read the filesystem to discover the raw blocks holding the files.


[edit] I had a quick look at the dd_rhelp code last night. It looks like it would be fairly simple to always place the log file in the users home directory. I'll look at it in more detail later if I get time.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[Guinpen]

In the end, I tried the simplest, if perhaps not the best solution. I mounted the hard drive read only and cp'd everything, directory by directory. Surprisingly enough, there was very little damage (4 photos!). dd_rescue on those didn't work, but I managed to find those particular files elsewhere.

I guess luck was with me this time. Thanks for all your suggestions, they were very valuable.

[syg00]

In future, keep PhotoRec in mind. Same people as testdisk, another *really* useful utility.

Never had to use it, but seen good reports.
_________________
Got a good backup ??? - any advice offered presumes you have.