Data Recovery

[This is the first topic I expect to go back to and update.]

Last month I started trying to recover data from a dead home PC. A very dead disc !
It was the second drive (D:) (100GB) in a windows XP machine and one day started clicking. Then it stopped and windows no longer had a D: drive.

I attached it to an old machine and tried my standard recovery cd boot (systemrescuecd), but it didn't have /dev/sda to recover from due to all the errors trying to read it.
Tried a different controler card. Failed.

I almost gave up. Even if most of the drive is OK it looked like the Service Area tracks with the bios had failed. (Western Digital apparently are known for this and it's possible to rebuild the BIOS tracks if you have the right software)

Then, at the last, I stumbled upon http://geekyschmidt.com/2011/03/12/why-is-my-devsda-missing and followed the hint:

1. cat /proc/partitions
2. Notice the Major/Minor columns associated with the missing drive. In my case /dev/sda
3. mknod /dev/sda b 8 0

 Now I have a device to recover from - some of the time.
On some cold boots the drive is 8GB and on some 100GB.
Get the BIOS to find it as USER defined size of 100GB and save that setting.
When you have a device of the right size then move on to image it.

Recover disc as an image:
I mounted a large chunk of nfs space on /mnt/backup

cd /mnt/backup
ddrescue --no-split /dev/sda sda.img sda.log
ddrescue -d -r3 /dev/sda sda.img sda.log

This will take a long time.

Partition table:

Check which is the next free loop device.

losetup -f

Try to map loop devices for the recovered partitions

kpartx -av sda.img

If this added maps for the partitions then fine try to mount them, else use testdisk to recreate a valid partition table (this is why we checked to see which loop device was going to be used next):

testdisk /dev/loop0

don't forget to write the new table back out.
Now try again

kpartx -dv disc.img
kpartx -av disc.img

Now try mounting the recovered partitions. eg

mount /dev/mapper/loop0p1 /mnt/tmp

With luck data can now be coppied off.

ddrescue:
links
http://www.gnu.org/s/ddrescue/manual/ddrescue_manual.html
http://path2tech.blogspot.com/2011/03/recover-data-from-failing-drive.html


hdparm:
This does a lot more than I remember from a few years back !
In particular this blog post Forcing a hard disk to reallocate bad sectors on writing to a sector that's unreadable.
eg try this

cat fix-sector

#!/bin/bash
#
drive=$1
sect=$2
hdparm --read-sector $sect $drive
ret=$?
echo if this \($ret\) is 5 then do:
echo hdparm --write-sector $sect  --yes-i-know-what-i-am-doing $drive

 ./fix-sector /dev/sda 36326813

sdparm:

testdisk:

Wiping the drive after:

ddrescue

baddblocks

shred