Comments on: How can I recover data from a mangled hard drive?

Question: How can I recover data from a mangled hard drive?

waldo — Thu, 28 Jul 2005 20:19:58 -0800

The hard drive on my fiancee's Windows machine has died, with our wedding plans, five weeks prior to our wedding. I've managed to duplicate the drive (with Unix's dd), though not without errors severe enough to prevent me from booting it. Now what?

I know nothing of Windows (I'm a Mac and Linux guy). The drive began to physically fail, with the first signs being system instability, followed by an inability to boot. At that point, with the drive making some nasty clicking noises the SMART status indicating that it was "failing," I slid the dying 40GB drive and a newly-bought 40GB drive into my Mac, booted it in single-user mode and ran dd if=/disk0 of=/disk1 bs=20m conv=noerror. Eight hours later, I had a duplicate drive and hundreds of screens of reports of errors.

When I paw through the data on the duplicate drive, using strings right on hdb, I can locate any textual information that I try to track down. Based on that, I conclude that substantial portions of the data are intact. But the drive won't mount on my Mac or in Linux, reporting various errors.

Should I run dd again with different settings (such as a smaller blocksize)? Is there a Windows program created for the purpose of rebuilding mangled FATs and turning data into files again? (Or, better yet, a Linux or Mac program?) Surely others have faced this problem before.

By: Rothko

Rothko — Thu, 28 Jul 2005 20:51:27 -0800

Have you looked into TESTDISK to rebuild your MBR and FAT32 table?

By: darksquirrel

darksquirrel — Thu, 28 Jul 2005 20:53:29 -0800

Dosfstools will probably be of some help (includes dosfsck, seems like 2.11 is the most recent version). I'd be careful with automated tools. Make yet another backup before messing with them if you can. Sometimes the choices they make aren't the best for the data you want to rescue. For similar reasons you should always try to mount the partition read-only in these circumstances -- in case you do get it to mount, we wouldn't want the kernel to decide it doesn't like something in the FAT and then cause more corruption. What errors are being reported when you try to mount the partition?

By: waldo

waldo — Thu, 28 Jul 2005 21:08:17 -0800

What errors are being reported when you try to mount the partition?

It actually has multiple partitions, and different partitions give me different errors.

The biggest partition (the F drive, holding Program Files and My Documents, /dev/hda4) is listed in fdisk as of "Unknown" type, and it reports errors about "ignoring extra data" and "invalid flag 0x1517 will be corrected by w(rite)." When I attempt to mount it, I get a series of errors, with the notable ones being "can't find a valid MSDOS file system," and a complaint about it being an extended partition, not a logical partition inside. When I try, instead, to mount it as /dev/hda5 (which is also listed in under fdisk, I get errors including "attempting to access beyond end of device," and "FAT bread failed," along with the same complaint about extended partitions.

OTOH, when mounting the first partition as the MSDOS partition that it is, I get neither an error nor any files showing up in the resultant mount point.

By: darksquirrel

darksquirrel — Thu, 28 Jul 2005 21:29:11 -0800

It's hard to say but from the sounds of it I'd wager that the partition table is damaged. In that case I'll second Rothko's suggestion of TESTDISK, particularly the bundled utility PhotoRec, which might be able to hunt through the data and recover files of certain types based on signature rather than the filesystem.

By: greatgefilte

greatgefilte — Fri, 29 Jul 2005 08:51:04 -0800

I had a lot of luck with Stellar Phoenix 2.2 when a friend's hard drive crashed. I think the problem was that the MFT was damaged, rather than the files themselves, so we were able to get back just about everything, even files weren't listed when mounting the drive in Knoppix (which is a great thing to have around, btw). There were a bunch of files whose MFT entries must've been obliterated, and these were recovered as "Lost files," i.e. intact, but nameless.

YMMV, but it worked for me.

By: waldo

waldo — Fri, 29 Jul 2005 12:59:18 -0800

Wonderful advice. Thank you, folks.

By: Good Brain

Good Brain — Sun, 31 Jul 2005 23:50:39 -0800

I was happy with the results I got from R-studio a couple years back when my HDD got really corrupted. It's commercial software, but it worked, and it was a lot cheaper than using a recovery service or abandoning the data.