Clone a drive for hard drive recovery?

Zapho

Hey lads,

Just a quick question relating to hard drive recovery. I hear that its better practice to try and clone the drive first and use recovery software on the cloned image. Is this practical? Can anyone recommend a good program for cloning? And are these programs compatable with the likes of testdisk and photorec?

Odaise Gaelach

Zapho wrote: »

Just a quick question relating to hard drive recovery. I hear that its better practice to try and clone the drive first and use recovery software on the cloned image. Is this practical? Can anyone recommend a good program for cloning? And are these programs compatable with the likes of testdisk and photorec?

Yes it is good practice to make an image of the drive that you're attempting to recover data from. Making an image of the drive ensures that, should the drive fail completely, you still have a copy of the entire drive that you can recover from stored on a (hopefully!) more reliable hard drive. It also allows you to undo any mistakes that you might make - making a mistake on the image can be undone simply by using a copy of the image itself. A mistake on the drive itself is usually irrecoverable.

Practically, it's not always feasible. You need to have enough space to store the entire disk in an image file, which isn't always possible. Especially if you're dealing with an external hard disk drive that can store over a terabyte of data.

I use R-Studio 5 for Windows, which is good enough though I've found that it can be unreliable when working with very large disks. I'm sure there's better software out there. As for compatibility with photorec and testdisk, suites like R-Studio generally do both image creation and recovery. Ultimately it would depend on how the image is saved and whether photorec and testdisk can read from those images. Maybe you can mount the image and use photorec and testdisk on it then.


...Hope that was helpful. Good luck!

Zapho

Thanks a million for the response Odaise, I found it very useful!

I usually just work off the hard drive directly and save whatever I can recover to another drive. This worked fine for me when the disk wasn't physically damaged, as in it just had file system errors. But now, I'm trying to recover a drive with loads of bad sectors so I'll definately try what you've suggested!

I've never used R-Studio myself - I've been relying on open-source software.

jpl888

If it is an NTFS partition you can use "nftsclone" with a rescue option to get an image off.

If that doesn't work or it isn't NTFS use "ddrescue" (the GNU version as the other one is just a wrapper script that isn't very good).

You will then be able to loop mount the image file and use Photorec on it.

Here is some information you might find useful - https://help.ubuntu.com/community/DataRecovery

Zapho

jpl888 wrote: »

If it is an NTFS partition you can use "nftsclone" with a rescue option to get an image off.

If that doesn't work or it isn't NTFS use "ddrescue" (the GNU version as the other one is just a wrapper script that isn't very good).

You will then be able to loop mount the image file and use Photorec on it.

Here is some information you might find useful - https://help.ubuntu.com/community/DataRecovery

It is an NTFS partition. I actually tried ntfsclone earlier today with the rescue option but it wouldn't work for me....although I can't remember the error message it gave me. I'll try again later and report back.

I've been reading up on ddrescue too, so I'll give that shot later on too.

jpl888

Using ntfsclone will be faster than ddrescue but I remember having a problem with it too. If the filesystem structure is a bit screwed ntfsclone will complain, and of course you don't want to risk running chkdsk as that will probably make things worse.

Could be an all nighter if the machine is a few years old and the disk is in bad shape.

Zapho

The drive certainly is in bad shape!

So here's the story so far - I'm trying to recover my own hard drive for no other reason than for learning purposes. There's nothing in particular I want back because I have backups!

I started running ddrescue on Monday night on a P4 3GB ubuntu machine - saving the raw disk image from the damaged drive to a my external usb drive.
The damaged disk is 160gb NTFS, my external is 320gb NTFS. DDrescue is still running today (Wednesday). I've told ddrescue to just copy the readable data, ignore the bad sectors for now, i'll come back to them later.

It took about 30mins to copy the first 14gb. After that, it obviously hit the damaged areas and seriously slowed down. Last night it had gotten to 30gb....after running it over night, it only managed to do another 2gb - so 32/160gb. So clearly, the heads are functional but I'm really curious as to what happened to the drive. Maybe a head crash that dug a nice trench into the platter? So before I open it to find out - which will probably ruin any further recovery attempt - I'm thinking about trying the freezer trick! I figure, why not? I've got nothing to lose.

So I'd be interested to hear if anyone had any advice on what worked for them or that. My plan is to either use ddrescue again to try recover the bad sectors after I freeze it or just simply try file system access. Any ideas which would be better?

jpl888

I've not come across that freezer trick before but from a quick search it seems it will only bring a hard drive back for a limited period of time i.e. not long enough to rescue all the data.

On first impression it would only seem to help with disks that have mechanically failed also. I don't think it will help you with bad sectors but perhaps somebody else knows better.

Maybe it would be possible to only recover the first 30GB odd of the filesystem, repair NTFS and mount it, certainly worth a try, but I know the Linux utility for repairing NTFS is limited. You might have to set up a virtual machine using the image file and boot from a Windows CD to use chkdsk on it and then it probably still won't fix it.

To make ddrescue faster you can reduce how many passes it makes on a bad sector, some info here http://freshmeat.net/projects/addrescue.