[SATLUG] Data Recovery help!

Robert Pearson e2eiod at gmail.com
Sat Jun 14 12:59:36 CDT 2008

On Sat, Jun 14, 2008 at 2:13 AM, Robert Pearson <e2eiod at gmail.com> wrote:
> On Sat, Jun 14, 2008 at 1:10 AM, FIRESTORM_v1 <firestorm.v1 at gmail.com> wrote:
>> I was sadly informed by the WD Smart Monitoring app that my WD MyBook
>> 500GB HD that I've had less than a year is critically failing.  Any
>> attempts to copy any data off results in a "I/O Device Error" in
>> Windows.  Yeah, I'm boned.
>> I'm desperate!! I'm looking for ANY solution to get the data off that
>> drive, even if I have to install some bastardized version of QNX and
>> mesh it with BSD to allow me to read this drive so I can pull the
>> 300+GB data off of it and onto another machine on the network.
>> The hard drive is the External USB 2.0 MyBook 500GB edition.  I went
>> so far as to extract the drive from the case to find out that it's a
>> regular SATA drive.  I can see  the root directory structure in
>> Windows XP, but any attempt to copy any directories results in an IO
>> error.  The drive doesn't appear to have any physical crash issues, no
>> scraping or kathunk click of death sounds coming from it.
>> I've got the drive in the icebox right now, praying I can get the data
>> off after it cools.  My last 7 years of my computing/hacking/linux
>> life are on that drive and it's the biggest drive on the LAN, but I
>> can spread the data off of it onto other chunks throughout the LAN.  I
>> haven't had a hard drive critically fail on me in the past four years,
>> now all of a sudden my biggest HD dies.
>> Please help!!
>> P.S.  So, WD is crap now, what HD manufacturers do you recommend?
>> Seagate any good?
>> --
> Have you tried the "freezing" trick?
> Maybe "freeze" and boot with Knoppix and see if you can either:
> 1. copy the Information off
> 2. "dd" the disk image off to a safe location and try and recover it there
> 3. from Tweeks in the SATLUG archives:
> "Beside the freezing trick.. also use the tool ddrescue.  It's like dd
> but it can handle i/o errors without dying.  Either clone the drive to
> a larger drive (raw) or to an image file that you can mount an pull
> data from later. Just don't try to fsck the source drive or you could
> lose everything.
> Tweeks"
> TestDisk is highly recommended:
> http://www.cgsecurity.org/wiki/TestDisk
> Many people recommend this non-free software:
> Gibson Research Corporation
> <<http://www.grc.com/default.htm>>

This post is for "newbies" like myself.
Yes, I am replying to my own email. There is a reason. While
researching the reply above I was confused by references to both
ddrescue and dd_rescue and dd_rhelp. I have since researched these,
smartctl and TestDisk as well. I am ready for my next disk failure.

***["After it fails" Tools]
"ddrescue" and "dd_rescue" are different solutions to the same
problem. From Wikipedia:
"Recovery-oriented variants of dd
Open Source unix-based programs for rescue include dd_rescue and
dd_rhelp, which work together, or GNU ddrescue.
* dd_rhelp first extracts all the readable data, and saves it to a
file, inserting zeros where bytes cannot be read. Then it tries to
re-read the invalid data and update this file.
* GNU ddrescue can be used to copy data directly to a new disk if
needed, just like Linux dd.

dd_rhelp or GNU ddrescue will yield a complete disk image, faster but
possibly with some errors. GNU ddrescue is generally much faster, as
it is written entirely in C++, whereas dd_rhelp is a shell script
wrapper around dd_rescue. Both dd_rhelp and GNU ddrescue aim to copy
data fast where there are no errors, then copy in smaller blocks and
with retries where there are errors. GNU ddrescue is easy to use with
default options, and can easily be downloaded and compiled on
Linux-based Live CDs such as Knoppix, and can be used with
GNU ddrescue Example [4]
[4] http://www.cgsecurity.org/wiki/Damaged_Hard_Disk

Both are superior to just "dd" for disk failure Information recovery.
Both packages are available on my Ubuntu 8.04 install as are TestDisk
and smartctl (smartmontools package).

Wikipedia says it better than I can:
"TestDisk is a free software data recovery utility licensed under the
terms of the GNU General Public License (GPL). It was primarily
designed to help recover lost data storage partitions and/or make
non-booting disks bootable again when these symptoms are caused by
faulty software, certain types of viruses or human error (such as
accidentally erasing a partition table).
TestDisk Wiki
Very handy tool.

***[Prevention Tools]
smartctl is part of the smartmontools package
"The smartmontools package contains two utility programs (smartctl and
smartd) to control and monitor storage systems using the
Self-Monitoring, Analysis and Reporting Technology System (SMART)
built into most modern ATA and SCSI harddisks. In many cases, these
utilities will provide advanced warning of disk degradation and
The key phrase is "provide advanced warning".
An ounce of prevention is worth a pound of cure...

The SATLUG email show several references to using Google and the
search string "xcssa smartctl" to view examples of using smartctl. I
was unable to find anything with that Google search string other than
email references. XCSSA is at:
(X-otic Computer Systems of San Antonio) Lots of good information.

***[Configuration and Performance Tools]
For "IDE ONLY" disk configuration and performance information don't
forget the "hdparm" command.
For SATA disks there are some references to using sdparm which was
originally for SCSI disks.
SATA is Serial ATA (IDE) and SAS is Serial Attached SCSI.
SATA is higher capacity, is slower and inexpensive like ATA/IDE.
SAS is expensive, much faster with smaller capacity than SATA.
I'm working on sdparm or ?. Maybe someone on the list already knows
and wouldn't mind sharing?

More information about the SATLUG mailing list