[TriLUG] OT: Laptop Hard Drive

[David Burton]

I agree with Steve on all points.

If you get that far, I have Perl scripts that do various manipulations of
ddrescue log files, including one called ddr2sr.pl to generate a .bat
script of SpinRite commands to work on just the unrecoverable sectors.
 (There are quite a few others, including one called ddr2nfi.pl to generate
a .bat script of nfi commands to identify which files on an NTFS file
system are damaged, but that one won't help you, since you're using a Mac.)

Here's an old message I wrote about doing this:
http://www.linuxquestions.org/questions/linux-hardware-18/how-to-back-up-files-off-a-failing-hard-drive-485322/#post2439434
If you actually decide to use any of my scripts, then let me know, and I'll
make sure the latest versions are on my web site.  The ones there now might
be slightly back-level.

I've also successfully used the "freezer trick" to recover additional data
from dying hard drives.  Once I even managed to recover *all* the
unrecoverable sectors on a bad drive using the freezer trick.  But in my
experience it was a long shot approach that didn't usually work, and seems
to never work on recent drives.  When doing data recovery on a bad drive, I
usually have a fan blowing on it, to keep it nice and cool.  (However, I
also had one case where I noticed that the drive worked *better* after it
warmed up, so I wrapped it in a towel to make it run hot, and got some
additional data from it.)

You should *first* get all the data off the drive that you can using
ddrescue at room temperature, then freeze the drive and try to get a little
more.

The best thing about ddrescue is that it can look at its log file to see
what it has already done, and later pick up right where it left off.  (The
author, Antonio Diaz, added that feature and several other significant
improvements to ddrescue at my request, about six years ago.)

ddrescue is hosted at freecode (*nee* freshmeat):
http://freecode.com/projects/addrescue

My favorite "live" Linux distro, Parted Magic, also includes ddrescue,
though I don't think the ddrescue man or info page is included.  Using
Parted Magic for data recovery is very convenient: plug up old and new
drives (or use an ext3 volume with enough free space to hold a disk image
file for the target, or use the ), boot Parted Magic from CD or DVD, use a
thumb drive for the ddrescue .log file, and run ddrescue to recover as much
of the drive as possible.

The only downside to using Parted Magic for this is that for some reason
Parted Magic's lowest-level disk granularity is more than one sector, so I
can sometimes get a little more data back by using an old Ubuntu machine
that can recover down to single-sector granularity.

However, if your drive is doing the clunk-clunk-clunk thing when you apply
power, before the computer even tries to access it, then my guess is that
you won't be able to read anything at all from it, and it will be
"invisible" to the computer.  Sorry.  When you attach it to the computer
and boot Linux, just do "fdisk -lu" to see what is attached.  If it doesn't
report the drive, then ddrescue is useless.  You can try letting it warm up
for a while, and rebooting and trying again; or freezing it, rebooting, and
trying again, but you're facing long odds against you at that point.

If your data is very valuable, there are companies that will attempt to
recover the data by disassembling and repairing the guts of the drive in a
clean room.  But their services are very expensive:
http://www.geeksalive.com/links.html#diskrecovery

Dave



On Thu, Nov 17, 2011 at 8:46 PM, Steve Pinkham <steve.pinkham at gmail.com>wrote:

> On 11/17/2011 08:07 PM, William Sutton wrote:
> > It isn't free, but SpinRite is really good recovery software.  It goes
> > low-level to recover things, and fits on a floppy for boot.
> >
> > William Sutton
>
> In this situation, it's probably worse than useless. For a basically
> working drive with a few unreadable sectors, spinrite is great.  For any
> major problems, it's likely to do more harm than good.
>
> ddrescue first to get as much data off as you can. If the drive survives
> long enough and you want to run spinrite later to try to help recover
> the last few sectors, you can do so.
>
> Go search the web for ddrescue vs spinrite and you'll find I'm not alone
> in this opinion.
> --
>  | Steven Pinkham, Security Consultant    |
>  | http://www.mavensecurity.com           |
>  | GPG public key ID CD31CAFB             |
>