Core Data Recovery

Archive for May, 2009

First, let me say this, leave it to the professionals if your data is critical. I do NOT recommend this if you can not afford to lose everything. All information contained in this article is to be used at YOUR OWN RISK. I will not be held responsible for your actions under any circumstances. Proceed with caution only if you are a geek.

Let me start by saying, I wrote this piece because I had to do a complex data recovery on a system damaged by a unix administrator trying to fix a drive that would not mount. This drive was, to make matters more complex, a striped raid array running an EXT2 partition type and all the files written were in inode tables. Those tables got shot by the attempt to repair the problem with FSCK. (NOTE DO NOT RUN FSCK to repair a drive that will not mount, unless you have a backup).

So, I have many tools to use if the drive is NTFS to restitch the 1 TB drives (2 of them) into one 2TB image file to run a recovery on. I do not have such tools in unix. This is the method I researched and successfully used to image the entire drive that was bad (was flaky, not dead) to a new 1 TB Western Digital drive.

I was then able to stitch the drives together in a virtual striped pair in Debian linux. I then used scalpel to retrieve the files that I could not retrieve with my unix recovery methods. (FSCK had shot the Inode table to hell).

So below is the method, tried and true, to image bit for bit an entire drive to another drive of everything, (even if there is no partition table available whatsoever (as is the case with a striped pair)). I prefer Debian however, I suggest UBUNTU in this article as it is easier to do the job from a bootable cdrom for an average windows technician to use.

If you can’t afford to have someone recover it, or think you are a super geek, here’s how to do a sector by sector copy of a drive that is failing to one that is new.

Mark the hard disk you have, set it aside as your source drive.

Grab a scratch drive (If you have one) and install ubuntu  on it from the cd downloaded here:

http://www.ubuntu.com/getubuntu/download , burn it to a cdrom.

Boot the cdrom and install ubuntu, I say this because if you have a small hard disk, you can stop the copy process in the middle without losing data.

Once ubuntu is loaded, select the package manager, search for ddrescue and install it.

Now you will need the 2 USB to IDE adapters I mentioned just now. (Easier than any other method)

Plug the source Hard disk into the IDE – USB adapter and plug the power in. Don’t plug in the usb yet.

sudo fdisk -l will list all drives in the system and whatever partitions are available to you.
note and mark the drives.

Then plug in your usb and run it again
sudo fdisk -l
you will see and mark the appropriate /dev/sdb etc. Please physically mark the drive with a post it note.
Plug in your usb attached destination drive and run it once again.
sudo fdisk -l
and mark the drive with the info.

Another way is below

run this:

ls /dev/sda
ls /dev/sdb
ls /dev/sdc

as soon as you get a not found error, stop searching.

If you have a /dev/sda file not found, you can now plug in your usb.

Please note, I want you to tag the drive with a pen as /dev/xxx as soon as you discover what it is.

If /dev/sda was found, or no error, put a sticker with /dev/sda on the computer tower (that’s where the scratch drive is and apparently it’s either scsi, or SATA.

if /dev/sdb was not found, Plug in the usb and wait 30 seconds.

then issue the
ls /dev/sdb  if there is not an error, you may tag the source drive /dev/sdb.

Then please plug in the drive you are copying to *Your Destination drive*

Issue the following if /dev/sdb was the last drive you tagged
ls /dev/sdc if no error, you may tag your destination drive as /dev/sdc

NOW for the magic.

You have a source drive (Tagged /dev/sdb for this example)
You have a destination drive (tagged /dev/sdc for this example.)

Issue the following command:
sudo ddrescue -n /dev/sdb /dev/sdc /home/root/logfile.log
This will take a while, but skips all troubled sectors.
sudo ddrescue -r3 /dev/sdb /dev/sdc /home/root/logfile.log
This command retrys all bad sectors logged above and makes this process much faster.

Once this is done, you can shutdown -h now and shutdown the computer.

On a seperate computer, running xp and having enough room for your critical files.
Plug in the USB to IDE adapter with the destination drive attached and powered on.
Copy any files if the partition will mount. If it will not mount, Install Get Data Back from runtime.org
Purchase a license for it and run it on the drive you recovered your data to to get as much as humanly possible back.

Below is a link I found after I wrote this all out for you.
http://www.linux.com/learn/tutorials/8225-clone-your-ubuntu-installation-onto-a-new-hard-disk

It has more information in other words, that you might find helpful for accomplishing a sector by sector (or byte by byte copy)