[TriLUG] Drive recovery services

Mon Oct 13 11:49:21 EDT 2014

Yes, pull the drives from the raid controller and connect them to
standalone machine(s) for the data recovery effort. But don't use
Spin-Rite. Instead, use *ddrescue <http://freecode.com/projects/addrescue/>*
to try to copy each drive to a new one.

Spin-Rite is not for recovering whole drives. It's for trying to scrape
usable data from the last few unrecoverable sectors on a drive from which
you've already rescued almost all of the other data.

Photorec is for trying to recover some of your lost files if you've given
up on recovering the whole file system. It is the tool of last resort.

Use ddrescue for each drive individually. If there are no errors, you'll
know it. If there are errors, you'll know that, too, and you'll
simultaneously recover all or almost all of the readable sectors.

Be sure to use a log file with ddrescue (probably on a FAT32 thumb drive),
so that you'll have status about what copied correctly and what didn't, and
so that if the operation is aborted before complete, ddrescue can resume
where it left off, without significant loss of work.

If you end up having to send a drive to a hardware recovery outfit, the
least expensive is probably Gillware <http://gillware.com/?affiliate=16258>,
and I'm an "affiliate," so I get a kickback for referrals, which I would
split with you. That will save you a few bucks.

I can help you with ddrescue. Its author, Antonio Diaz, did a heavy
redesign of it some years ago, in response to my feedback. He basically
rewrote it to my specs!

I've also written a number of perl scripts which operate on ddrescue log
files to perform a variety of useful functions. One of them creates a
SpinRite batch script from a ddrescue logfile, to run SpinRite on just the
remaining unrecoverable sectors. The perl scripts are on my server in this
.zip file <http://www.burtonsys.com/download/dos4linux.zip>, but if you're
going to use them please let me know, so I can update the .zip archive,
because I think that version is out-of-date.

However, I've never messed with ZFS.

Here's an excerpt of an email that I just sent to a Windows user (and Linux
newbie) whose HDD is dying, about how to use ddrescue (from the PartedMagic
distro) to copy his dying 1TB NTFS drive to a new one:

*1.* download and burn PartedMagic to CD or DVD:
> Leave it in the CD drive (or put it in, if you burned it using a different
> computer).
> *2.* plug in your new thumb drive, and make sure it works and is
> formatted FAT32.
> *3.* shut down your computer, and attach the new HDD in place of the old
> one, and attach the old one as a 2nd HDD. (Hopefully you have an available
> SATA power connector and SATA data cable.)
> *4.* boot PartedMagic.
> *5.* Open a command prompt/shell.  (It's one of the little icons at the
> top or bottom of the screen.)
> *6.* Do this command:
> fdisk -lu
> That will tell you which drive is which.
> The one with NTFS partitions on it is your old drive. It might be
> /dev/sdb, and the partitions might be /dev/sdb1, /dev/sdb2, etc.
> The empty one is your new drive.  It might be /dev/sda
> The little one with the FAT32 partition is your thumb drive. It might be
> /dev/sdc, and the partition might be /dev/sdc1
> WARNING: since your old and new drives are the same size, it is easy to
> make the disastrous mistake of mixing them up!  Be VERY careful!  Note that
> the "Disk Identifier" will be copied along with the rest of the drive, so
> that will NOT help you tell the difference. As soon as you start the copy
> operation, the two drives will look identical to fdisk, so it is very easy
> to mix them up.
> *7.* Use hdparm to determine the drive model and serial number for both
> the new and the old drives.  Write them down. Do NOT mix them up.
> hdparm -i /dev/sda
> hdparm -i /dev/sdb
> *8.* mount the thumb drive. In this example, I mount it at /media/sdc1
> but that is arbitrary; you can use any folder:
> mkdir /media/sdc1
> mount /dev/sdc1 /media/sdc1
> *9.* make the thumb drive the current folder:
> cd /media/sdc1
> *10.* "pwd" tells you the current folder; make sure it's what you think
> it is (/media/sdc1):
> pwd
> *11.* double-check the drives and their serial numbers, to be 100% sure
> that you know which is the old one, and which is the new one!
> (that's steps 6 & 7)
> *12. *copy the old drive to the new one using ddrescue.  In this example,
> I assume the old drive is /dev/sdb, but that is NOT necessarily true on
> your computer:
> ddrescue -f /dev/sdb /dev/sda drive.log
> Note #1: the parameter order is:    option(s) olddrive newdrive logfile
> Do NOT scramble the order, lest you lose EVERYTHING.
> Note #2: this is the ddrescue manual:
> https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html
> Note this warning from the manual:
> *"**Some systems may change device names on reboot (eg. udev enabled
> systems). If you reboot, check the device names before restarting
> ddrescue."*
> ("Check the device names" means "fdisk -lu" and/or "hdparm -i")
> The ddrescue command will take a long time.
> If something goes wrong, you can reboot and resume starting at step 8, but
> be sure you triple-check which drive is which.  (/dev/sda might now be
> /dev/sdb ! ! !)
> If your new drive is an "advanced format" drive (i.e., if it has 4K
> sectors instead of 512 byte sectors), then you *might* find that Windows
> is dog-slow when you're done.  If so, that might be due to partition
> misalignment.  There are tools to fix it.
> Here's a Seagate tool to check for the issue, when you're done:
> http://knowledge.seagate.com/articles/en_US/FAQ/214391en?language=en_US
> Here're some Seagate documents:
> http://knowledge.seagate.com/articles/en_US/FAQ/221411en?language=en_US
>
> http://www.seagate.com/tech-insights/advanced-format-4k-sector-hard-drives-master-ti/
> Dave
>
>
Dave
www.geeksalive.com

On Mon, Oct 13, 2014 at 11:11 AM, Matt Whitlow <
matt.church.whitlow at gmail.com> wrote:

> https://www.grc.com/sr/spinrite.htm
>
> You have to pull the drives out of the raid controller and run it in a
> separate machine, the controller doesn't give low enough access to the
> drive. Spin-rite has recoved drives for me in the past start with a level
> 2.
>

> On Oct 13, 2014 10:45 AM, "Wes Garrison" <wes at xitechusa.com> wrote:
>
> > I just had 3 simultaneous failures on my ZFS pool with raidz2. (2
> failures
> > = OK, 3=bad.)
> >
> > Can anyone recommend a good drive recovery service (that's less than
> > $1000).
> >
> > 1 of the disk developed 60,000 bad sectors in a 4 week period since the
> > last time I checked it and it had 0.
> >
> > However, the other 2 both had 0 bad sectors and then stopped being
> > accessible with no warning.
> >
> > This makes me believe the data is still there on these 2 drives.
> >
> > I think if I can get a sector-by-sector copy of one of them, I can
> resilver
> > (rebuild) my array.
> >
> > What do you folks think?
> >
> > -Wes
>