How can I recover data from a mangled hard drive?

July 28, 2005 8:19 PM

The hard drive on my fiancee's Windows machine has died, with our wedding plans, five weeks prior to our wedding. I've managed to duplicate the drive (with Unix's dd), though not without errors severe enough to prevent me from booting it. Now what?

I know nothing of Windows (I'm a Mac and Linux guy). The drive began to physically fail, with the first signs being system instability, followed by an inability to boot. At that point, with the drive making some nasty clicking noises the SMART status indicating that it was "failing," I slid the dying 40GB drive and a newly-bought 40GB drive into my Mac, booted it in single-user mode and ran dd if=/disk0 of=/disk1 bs=20m conv=noerror. Eight hours later, I had a duplicate drive and hundreds of screens of reports of errors.

When I paw through the data on the duplicate drive, using strings right on hdb, I can locate any textual information that I try to track down. Based on that, I conclude that substantial portions of the data are intact. But the drive won't mount on my Mac or in Linux, reporting various errors.

Should I run dd again with different settings (such as a smaller blocksize)? Is there a Windows program created for the purpose of rebuilding mangled FATs and turning data into files again? (Or, better yet, a Linux or Mac program?) Surely others have faced this problem before.

posted by waldo to Computers & Internet (7 answers total)

Have you looked into TESTDISK to rebuild your MBR and FAT32 table?
posted by Rothko at 8:51 PM on July 28, 2005

Dosfstools will probably be of some help (includes dosfsck, seems like 2.11 is the most recent version). I'd be careful with automated tools. Make yet another backup before messing with them if you can. Sometimes the choices they make aren't the best for the data you want to rescue. For similar reasons you should always try to mount the partition read-only in these circumstances -- in case you do get it to mount, we wouldn't want the kernel to decide it doesn't like something in the FAT and then cause more corruption. What errors are being reported when you try to mount the partition?
posted by darksquirrel at 8:53 PM on July 28, 2005

Response by poster: What errors are being reported when you try to mount the partition?

It actually has multiple partitions, and different partitions give me different errors.

The biggest partition (the F drive, holding Program Files and My Documents, /dev/hda4) is listed in fdisk as of "Unknown" type, and it reports errors about "ignoring extra data" and "invalid flag 0x1517 will be corrected by w(rite)." When I attempt to mount it, I get a series of errors, with the notable ones being "can't find a valid MSDOS file system," and a complaint about it being an extended partition, not a logical partition inside. When I try, instead, to mount it as /dev/hda5 (which is also listed in under fdisk, I get errors including "attempting to access beyond end of device," and "FAT bread failed," along with the same complaint about extended partitions.

OTOH, when mounting the first partition as the MSDOS partition that it is, I get neither an error nor any files showing up in the resultant mount point.
posted by waldo at 9:08 PM on July 28, 2005

It's hard to say but from the sounds of it I'd wager that the partition table is damaged. In that case I'll second Rothko's suggestion of TESTDISK, particularly the bundled utility PhotoRec, which might be able to hunt through the data and recover files of certain types based on signature rather than the filesystem.
posted by darksquirrel at 9:29 PM on July 28, 2005

I had a lot of luck with Stellar Phoenix 2.2 when a friend's hard drive crashed. I think the problem was that the MFT was damaged, rather than the files themselves, so we were able to get back just about everything, even files weren't listed when mounting the drive in Knoppix (which is a great thing to have around, btw). There were a bunch of files whose MFT entries must've been obliterated, and these were recovered as "Lost files," i.e. intact, but nameless.

YMMV, but it worked for me.
posted by greatgefilte at 8:51 AM on July 29, 2005

Response by poster: Wonderful advice. Thank you, folks.
posted by waldo at 12:59 PM on July 29, 2005

I was happy with the results I got from R-studio a couple years back when my HDD got really corrupted. It's commercial software, but it worked, and it was a lot cheaper than using a recovery service or abandoning the data.
posted by Good Brain at 11:50 PM on July 31, 2005