Recover harddrive data

Posted by gameshints on Super User See other posts from Super User or by gameshints
Published on 2009-12-24T03:17:54Z Indexed on 2010/05/16 19:20 UTC
Read the original article Hit count: 317

Filed under:
|
|

I have a dell laptop that recently "died" (It would get the blue screen of death upon starting) and the hard drive would make a weird cyclic clicking noises.

I wanted to see if I could use some tools on my linux machine to recover the data, so I plugged it into there.

If I run "fdisk" I get:

Disk /dev/sdb: 20.0 GB, 20003880960 bytes
64 heads, 32 sectors/track, 19077 cylinders
Units = cylinders of 2048 * 512 = 1048576 bytes
Disk identifier: 0x64651a0a

Disk /dev/sdb doesn't contain a valid partition table

Fine, the partition table is messed up. However if I run "testdisk" in attempt to fix the table, it freezes at this point, making the same cyclical clicking noises:

Disk /dev/sdb - 20 GB / 18 GiB - CHS 19078 64 32
Analyse cylinder   158/19077: 00%

I don't really care about the hard drive working again, and just the data, so I ran "gpart" to figure out where the partitions used to be. I got this:

dev(/dev/sdb) mss(512) chs(19077/64/32)(LBA) #s(39069696) size(19077mb)

* Warning: strange partition table magic 0x2A55.
Primary partition(1)
   type: 222(0xDE)(UNKNOWN)
   size: 15mb #s(31429) s(63-31491)
   chs:  (0/1/1)-(3/126/63)d (0/1/32)-(15/24/4)r
   hex:  00 01 01 00 DE 7E 3F 03 3F 00 00 00 C5 7A 00 00

Primary partition(2)
   type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX) (BOOT)
   size: 19021mb #s(38956987) s(31492-38988478)
   chs:  (4/0/1)-(895/126/63)d (15/24/5)-(19037/21/31)r
   hex:  80 00 01 04 07 7E FF 7F 04 7B 00 00 BB 6F 52 02

So I tried to mount just to the old NTFS partition, but got an error:

sudo mount -o loop,ro,offset=16123904 -t ntfs /dev/sdb /mnt/usb
NTFS signature is missing.

Ugh. Okay. But then I tried to get a raw data dump by running

dd if=/dev/sdb of=/home/erik/brokenhd skip=31492 count=38956987

But the file got up to 59885568 bytes, and made the same cyclical clicking noises.

Obviously there is a bad sector, but I don't know what to do about it!

The data is still there... if I view that 57MB file in textpad... I can see raw data from files.

How can I get my data back?

Thanks for any suggestions,

Solution:

I was able to recover about 90% of my data:

  1. Froze harddrive in freezer
  2. Used Ddrescue to make a copy of the drive
  3. Since Ddrescue wasn't able to get enough of my drive to use testdisk to recover my partitions/file system, I ended up using photorec to recover most of my files

© Super User or respective owner

Related posts about hard-drive

Related posts about data