[SATLUG] Data Recovery help!

Tweeks tweeksjunk2 at theweeks.org
Sat Jun 14 13:28:14 CDT 2008

Good research job there Robert.  Sounds like need to pop this into the SATLUG 
wiki.. :)


On Saturday 14 June 2008 12:59:36 pm Robert Pearson wrote:
> On Sat, Jun 14, 2008 at 2:13 AM, Robert Pearson <e2eiod at gmail.com> wrote:
> > On Sat, Jun 14, 2008 at 1:10 AM, FIRESTORM_v1 <firestorm.v1 at gmail.com> 
> >> I was sadly informed by the WD Smart Monitoring app that my WD MyBook
> >> 500GB HD that I've had less than a year is critically failing.  Any
> >> attempts to copy any data off results in a "I/O Device Error" in
> >> Windows.  Yeah, I'm boned.
> >>
> >> I'm desperate!! I'm looking for ANY solution to get the data off that
> >> drive, even if I have to install some bastardized version of QNX and
> >> mesh it with BSD to allow me to read this drive so I can pull the
> >> 300+GB data off of it and onto another machine on the network.
> >>
> >> The hard drive is the External USB 2.0 MyBook 500GB edition.  I went
> >> so far as to extract the drive from the case to find out that it's a
> >> regular SATA drive.  I can see  the root directory structure in
> >> Windows XP, but any attempt to copy any directories results in an IO
> >> error.  The drive doesn't appear to have any physical crash issues, no
> >> scraping or kathunk click of death sounds coming from it.
> >>
> >> I've got the drive in the icebox right now, praying I can get the data
> >> off after it cools.  My last 7 years of my computing/hacking/linux
> >> life are on that drive and it's the biggest drive on the LAN, but I
> >> can spread the data off of it onto other chunks throughout the LAN.  I
> >> haven't had a hard drive critically fail on me in the past four years,
> >> now all of a sudden my biggest HD dies.
> >>
> >> Please help!!
> >>
> >>
> >> P.S.  So, WD is crap now, what HD manufacturers do you recommend?
> >> Seagate any good?
> >> --
> >
> > Have you tried the "freezing" trick?
> > Maybe "freeze" and boot with Knoppix and see if you can either:
> > 1. copy the Information off
> > 2. "dd" the disk image off to a safe location and try and recover it
> > there 3. from Tweeks in the SATLUG archives:
> > "Beside the freezing trick.. also use the tool ddrescue.  It's like dd
> > but it can handle i/o errors without dying.  Either clone the drive to
> > a larger drive (raw) or to an image file that you can mount an pull
> > data from later. Just don't try to fsck the source drive or you could
> > lose everything.
> > Tweeks"
> >
> > TestDisk is highly recommended:
> > http://www.cgsecurity.org/wiki/TestDisk
> >
> > Many people recommend this non-free software:
> > Gibson Research Corporation
> > <<http://www.grc.com/default.htm>>
> This post is for "newbies" like myself.
> Yes, I am replying to my own email. There is a reason. While
> researching the reply above I was confused by references to both
> ddrescue and dd_rescue and dd_rhelp. I have since researched these,
> smartctl and TestDisk as well. I am ready for my next disk failure.
> ***["After it fails" Tools]
> "ddrescue" and "dd_rescue" are different solutions to the same
> problem. From Wikipedia:
> "Recovery-oriented variants of dd
> Open Source unix-based programs for rescue include dd_rescue and
> dd_rhelp, which work together, or GNU ddrescue.
> * dd_rhelp first extracts all the readable data, and saves it to a
> file, inserting zeros where bytes cannot be read. Then it tries to
> re-read the invalid data and update this file.
> * GNU ddrescue can be used to copy data directly to a new disk if
> needed, just like Linux dd.
> dd_rhelp or GNU ddrescue will yield a complete disk image, faster but
> possibly with some errors. GNU ddrescue is generally much faster, as
> it is written entirely in C++, whereas dd_rhelp is a shell script
> wrapper around dd_rescue. Both dd_rhelp and GNU ddrescue aim to copy
> data fast where there are no errors, then copy in smaller blocks and
> with retries where there are errors. GNU ddrescue is easy to use with
> default options, and can easily be downloaded and compiled on
> Linux-based Live CDs such as Knoppix, and can be used with
> SystemRescueCD.
> GNU ddrescue Example [4]
> [4] http://www.cgsecurity.org/wiki/Damaged_Hard_Disk
> Both are superior to just "dd" for disk failure Information recovery.
> Both packages are available on my Ubuntu 8.04 install as are TestDisk
> and smartctl (smartmontools package).
> Wikipedia says it better than I can:
> "TestDisk is a free software data recovery utility licensed under the
> terms of the GNU General Public License (GPL). It was primarily
> designed to help recover lost data storage partitions and/or make
> non-booting disks bootable again when these symptoms are caused by
> faulty software, certain types of viruses or human error (such as
> accidentally erasing a partition table).
> http://en.wikipedia.org/wiki/TestDisk
> TestDisk Wiki
> http://www.cgsecurity.org/wiki/TestDisk
> Very handy tool.
> ***[Prevention Tools]
> smartctl is part of the smartmontools package
> http://smartmontools.sourceforge.net/
> "The smartmontools package contains two utility programs (smartctl and
> smartd) to control and monitor storage systems using the
> Self-Monitoring, Analysis and Reporting Technology System (SMART)
> built into most modern ATA and SCSI harddisks. In many cases, these
> utilities will provide advanced warning of disk degradation and
> failure."
> The key phrase is "provide advanced warning".
> An ounce of prevention is worth a pound of cure...
> The SATLUG email show several references to using Google and the
> search string "xcssa smartctl" to view examples of using smartctl. I
> was unable to find anything with that Google search string other than
> email references. XCSSA is at:
> http://xcssa.org/
> (X-otic Computer Systems of San Antonio) Lots of good information.
> ***[Configuration and Performance Tools]
> For "IDE ONLY" disk configuration and performance information don't
> forget the "hdparm" command.
> http://en.wikipedia.org/wiki/Hdparm
> For SATA disks there are some references to using sdparm which was
> originally for SCSI disks.
> SATA is Serial ATA (IDE) and SAS is Serial Attached SCSI.
> SATA is higher capacity, is slower and inexpensive like ATA/IDE.
> SAS is expensive, much faster with smaller capacity than SATA.
> I'm working on sdparm or ?. Maybe someone on the list already knows
> and wouldn't mind sharing?

More information about the SATLUG mailing list