2

Good Morning,

I am currently helping a good friend to recover her broken 1TB external HDD. She dropped the drive and now, it cannot be mounted anymore. After some research I gave safecopy a try. I am working with a Kali Linux live CD and an internal 3TB HDD that is connected and mounted via USB station. The external drive has less than 100GB space occupied. SafeCopy collects ~30GB per day. My first try aborted after ~260GB with an "location not found" error, the drive has reconnected to another mount path. The current try is at ~280GB. Since the drive is brand new, all stored data should already be collected in the output ISO. However, when I try to mount the 260GB ISO I get an file error, something about corrupted file and I/O error

I used this command for safecopy:

sudo safecopy --stage1 /dev/sda1 /path/to/3tb/drive/data.iso

/dev/sda1 is the place where the external HDD is detected.

Is there a way to manually finish the build of the ISO file? This would save me a lot of time, since safecopy would need ~34 days to complete the job.

EDIT:

As mentioned in the comments, I had to abort the process for some time. I've now set it all up again and after some difficulties, this is what fdisk produced:

sudo fdisk -l /dev/sdc1
Disk /dev/sdc1: 931.5 GiB, 1000169537536 bytes, 1953456128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x69205244

Device      Boot      Start        End    Sectors   Size Id Type
/dev/sdc1p1 ?     218129509 1920119918 1701990410 811.6G 72 unknown
/dev/sdc1p2 ?     729050177 1273024900  543974724 259.4G 74 unknown
/dev/sdc1p3 ?     168653938  168653938          0     0B 65 Novell Netware 386
/dev/sdc1p4      2692939776 2692991410      51635  25.2M  0 Empty

Partition table entries are not in disk order.

I forgot to save the stage1.badblocks file, so I cannot really continue the first run. I now started a new stage1 safecopy run, hope it will be a bit faster than before since I now run a Debian Linux directly from this notebook.

Since then, is there a way to use the iso files from the first run and make it readable?

EDIT2:

Ok, after 3 hours, this is the output so far:

[0](+0){XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [844800]    
XXXXXXXXXXXXX 8-X 0%

the drive makes terrible clicking noises. If I interprete the fdisk output form earlier, the data seems to be written way more back on the drive, not from sector 0 onwards. Is it possible to read and rescue the data by starting at the end of the disk? I fear I am more or less dependant on extracting the data from the iso file I created so far. Again, i it somehow possible to extracxt portions from an unfinished iso file and build a valid one from it?

EDIT 3:

I now tried ddrescue. It now runs for ~ 23h. The output file has a size of 134MB, the size I already knew from safecopy to be ok. gmesg | tail produces the following output:

[80840.705000] usb 2-1.1: reset high-speed USB device number 8 using ehci-pci
[80880.711821] usb 2-1.1: reset high-speed USB device number 8 using ehci-pci
[80920.718561] usb 2-1.1: reset high-speed USB device number 8 using ehci-pci
[80922.888408] sd 8:0:0:0: [sdb] Unhandled error code
[80922.888413] sd 8:0:0:0: [sdb]  
[80922.888415] Result: hostbyte=DID_TIME_OUT driverbyte=DRIVER_OK
[80922.888417] sd 8:0:0:0: [sdb] CDB: 
[80922.888419] Read(10): 28 00 49 a5 38 80 00 00 08 00
[80922.888426] end_request: I/O error, dev sdb, sector 1235564672
[80922.888430] Buffer I/O error on device sdb1, logical block 154445328

So what I can see there is that there are difficulties with the usb access and something with hostbyte=DID_TIME_OUT

dd has this output so far:

rescued:   123928 kB,  errsize:       0 B,  current rate:   12976 kB/s
rescued:   134742 kB,  errsize:  39649 kB,  current rate:        0 B/s
   ipos:   635829 MB,   errors:     605,    average rate:     1688 B/s ago
   opos:   635829 MB, run time:   22.17 h,  successful read:   22.01 h ago
Copying non-tried blocks... Pass 1 (forwards)

After dd has finished I will try to extract at least a little bit with tsk_recover from the dd image. As mentioned in the comments I looked up the hardware specs of the drive. THe problem is that the USB connector (USB 3.0 Type B Micro) is placed on the main PCB so I cannot access a ATA/SATA connection. Or at least thats what I found out (I didn't open the case so far). I couldn't find a data sheet with circuit diagram. The product number is WDBHHG0010BBK-04. I found a video of a similar looking (!) drive that has pins next to the usb port. I don't know enough about hard drives and electronics to see if I could use these. As soon as dd finished I will open the case.

I am asking myself what could have damaged the drive that bad. My friend told me she just dropped it. It seems like the rw head is damaged or has smashed the disk. As far as I know, HDDs move their heads aside while idle or powered off. My attempts of rescue seem to have not dealt much more damage since the result of readable sectors are the same as from the start.

So, much text. my current question is what the syslog entries should tell me.

Some Pics of the drive:

enter image description here

enter image description here

enter image description here

  • Does fdisk -l /dev/sda1 produce reasonable output? – user1700494 Aug 18 '16 at 10:17
  • Not really. I ran it some time ago. If I remember correctly, it said it is partitioned as MBR. Palimpsest says so. Windows sees it as RAW partitioned. I first got an 132MB version ISO. There I could read out with HExEdit, a partition table is missing. But I don't know if safecopy creates it and hasn't to that point or not. – Ueda Ichitaka Aug 18 '16 at 12:10
  • Can I savely run fdsik while safecopy is executing? – Ueda Ichitaka Aug 18 '16 at 12:12
  • fdisk output: Disk /dev/sda1: 290GB, 311726964735 bytes, 608841728 sectors the rest of numbers is 512 bytes – Ueda Ichitaka Aug 18 '16 at 12:20
  • well if it is 290GB and you were at280GB 11 hours ago, it should be mountable by now. if not, post an exact command and exact error – Matija Nalis Aug 18 '16 at 20:36
0

By iso you mean raw disk image I presume. Try ddrescue (sometimes available as dd_rescue), it is VERY verbose, and you can manually skip past unreadable blocks. Not that you need to, it will ignore read errors by default. I have never experienced it stopping except on external USB disks. When I recover data I always (if possible) remove the HDD from any external exclosure and stick it into a bay in my PC. USB tends to bail out at the first sign of trouble. You can try cooling the disk, which will either help or not help, but does no harm. Since you are recovering for days on end you can let 3-4 CPU fans blow on it. You don't want to feel it getting hot at all, the cooler the better. Heat is bad for bad disks. I would suggest you stick it in a coolerbox or refrigerator, but that's just silly. Don't perform any other read operation on the disk if it's half-dead. Edit: you're going to have some trouble using the raw image mounted, even read-only. If navigating the possibly corrupt file hierarchy (FAT, whatever), try foremost, scalpel, carve and magicrescue to recover files in the image. You can usually recover most popular pictures and doc formats.

  • I am working on a notebook and the drive is a brandnew external harddrive froma a good friend. Also the temperature never got over 45°C. Does ddrescue support unmountable drives? the disk cannot be mounted. – Ueda Ichitaka Aug 21 '16 at 20:53
  • It can operate on the raw disk device (it is filesystem agnostic). I recommend the systemrescue livecd, it has all the tools and drivers for just about every filesystem ever. Example: ddrescue /dev/sdb sdb.raw - unmountable really is irrelevant, don't mess with the physical device until you have imaged it. And then use the image. – user400344 Aug 21 '16 at 20:57
  • So, does this resolve the issue? If so, please mark it as answered. – user400344 Aug 22 '16 at 23:23
  • No results yet, ddrescue is still running. It really is a pain getting the drive connected to the notebook. Often it cannot be enumerated. After trying every usb port and reboots, it gets detected. – Ueda Ichitaka Aug 23 '16 at 12:22
  • Some USB harddisks have special ATA/SATA connectors, while others have standard connectors. Western Digital for instance uses an odd connector. If you have a standard connector you must move it onto the PC's SATA bus, or you will never finish imaging. USB is bad for what you are doing. If it has a specisl connector, try to find a suitable adapter online, or post pictures. Just take the drive apart regardless, and stick a few CPU fans in there. – user400344 Aug 23 '16 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.