EzDevInfo.com

hard-drive-recovery interview questions

Top hard-drive-recovery frequently asked interview questions

ddrescue has slowed down massively on os x

I'm using ddrescue to image a drive, and it's slowed down to about .1 % as fast as it started, at this rate I'm not sure if it will even finish, at any rate, I'm not sure I can tie up this machine that long to do it. Hoping someone can help, or recommend some other way to image the drive?

The setup: - macbook pro running 10.8 - ddrescue installed from macports - source drive is in the freezer, with cables running out to the laptop using a SATA to usb adapter - target drive in an identical model of a 640gig maxtor in a sata to usb enclosure - command used was: - log file is being written to /root/rescue.log ( on whatever file system / is on a macbook) - terminal output from the command and my attempt to resume below, you can see it was averaging 7000kbs and is now averaging about 5000 bps!

Any tips much appreciated! Iain

Iains-MacBook-Pro:~ root# ddrescue -f -g -v -n /dev/disk1 /dev/disk2 /root/rescue.log
ddrescue: warning: Options -aCdDeEIMnOprRStTx are ignored in generate mode.


GNU ddrescue 1.16
About to generate an approximate logfile for /dev/disk1 and /dev/disk2
    Starting positions: infile = 0 B,  outfile = 0 B
    Copy block size: 128 sectors
Sector size: 512 Bytes

Press Ctrl-C to interrupt
rescued:     2543 MB,  generated:    2731 MB,  current rate:    8847 kB/s
   opos:     2731 MB,                          average rate:    9134 kB/s
Generating logfile...
ddrescue: Error opening logfile '/root/rescue.log' for writing: No such file or directory
Fix the problem and press ENTER to retry, or Q+ENTER to abort. 


rescued:   474160 MB,  generated:  499761 MB,  current rate:     5461 B/s
rescued:   474160 MB,  generated:  499761 MB,  current rate:     3449 B/s
   opos:   499761 MB,                          average rate:    7440 kB/s
Generating logfile...
Interrupted by user
Iains-MacBook-Pro:~ root# 
Iains-MacBook-Pro:~ root# ddrescue -f -g -v -n /dev/disk1 /dev/disk2 /root/rescue.log
ddrescue: warning: Options -aCdDeEIMnOprRStTx are ignored in generate mode.


GNU ddrescue 1.16
About to generate an approximate logfile for /dev/disk1 and /dev/disk2
    Starting positions: infile = 0 B,  outfile = 0 B
    Copy block size: 128 sectors
Sector size: 512 Bytes

Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued:   474160 MB,  generated:  499761 MB
Current status
rescued:   474164 MB,  generated:  499765 MB,  current rate:     5041 B/s
   opos:   499765 MB,                          average rate:     8793 B/s
Generating logfile...

Source: (StackOverflow)

Western Digital 1TB external hard drive could not be read

I have a problem with my external hard drive, I was copying a huge amount of data (approx 100 gigs) from it to another hard drive, suddenly an error popped up and told me that the operation could not be completed. I clicked cancel and tried to copy the files again. But the hard drive was ticking and it actually couldn't copy anything and would not eject. So I shut down my computer and tried to reconnect the hard drive again, but it just ticked, and the drive could not be read. I even tried it with another laptop, it said the parameter is incorrect. It showed a drive letter in my computer, but I couldn't browse the drive and had problem ejecting. So how can I save my files?


Source: (StackOverflow)

Advertisements

Read data from old hard drive Seagate ST-1239A

I received an old hard drive from which I need to read the data. I connect it using an AT-Interface to USB connector. (I tried two different ones with the same results). I guess it is about 210-211 MB and from the early nineties.

It is recognized as a hard drive. Windows 8.1 suggests that I "initialize" it, but I guess then all data would be lost. In Ubuntu it shows up as /dev/sdd but without partitions. In hardinfo I can see a storage device called "94354-230"

If I do sudo parted --list it lists the other disks in the computer and then

Error: /dev/sdd: unrecognized disk label

If I try sudo gpart sdd the result is:

**** Fatal error: cannot get sector size on dev(sdd).

How can I read the data from this disk? What software or hardware or command line do I need to do it?

More text from the hard drive case is:

Seagate
Model ST-1239A

SWIFT
Model 94354-230

920007-004

Source: (StackOverflow)

DISKPART.EXE - Clean wrong disk [duplicate]

Possible Duplicate:
How to recover data from re-partitioned hard drive

I made a terrible mistake.

  1. DISKPART.EXE
  2. select WrongHarddisk
  3. clean

What is the best way to recover my data?

I found a program from easeus, but it is only free for 1 GB. Are there also other solutions?


Source: (StackOverflow)

Can you successfully clone a Mac OS X boot volume directly to another larger volume with ddrescue?

Can you clone a Mac OS X boot volume (specifically a "Mac OS Extended, Journaled" a.k.a. JHFS+ volume) directly to another, larger volume using ddrescue or even dd, and have the target volume end up as a perfectly working, bootable volume?

In the past, I've used ddrescue to make a raw .dmg backup of a Mac OS X boot volume of a dying hard drive, and then "restored" that .dmg to another volume via Disk Utility, but in this case I don't have the spare hard drive space to store the intermediate .dmg file, so I'll need to invoke ddrescue to directly clone the dying volume to a new volume. But I'm nervous that using ddrescue to do this directly, rather than using Disk Utility for the restore portion, won't leave things set up correctly so the resulting volume won't be bootable.

I have to use ddrescue because I'm dealing with a failing hard drive again. SMART Utility says it has only a single pending bad sector out of a 500GB drive, so I feel like my odds of not having any critical data on that bad sector are pretty good. The part I'm worried about is whether a raw block-by-block clone of one volume to a slightly larger volume might not leave the target volume set up correctly somehow.

Has anyone done this before on Mac OS X and can vouch that it works?

Update: Had to post my own Answer ("No", or "Not in the way I tried"), but I'd be happy to Accept a different answer if someone else can provide instructions for successfully doing this.


Source: (StackOverflow)

Overwrote Bitlocker MBR

I'm not sure exactly how I overwrote it, but I was writing a floppy image to a floppy disk (using a USB floppy drive), and somehow I inadvertently wrote the floppy disk to my primary hard disk which I have Windows 7 Enterprise x64 installed on with Bitlocker enabled. Now when I boot, I get the error "Non-system disk or disk error." Is there any way to repair this?

I have made a low-level backup in case anything I try does further damage, and here's what I've tried so far...

  • bootrec /fixmbr - didn't work, now it says "invalid partition table" when I try to boot.
  • bootrec /fixboot - didn't work, command returns "element not found."
  • bootrec /rebuildbcd - didn't work, command returns "Total identified Windows installations: 0"

UPDATE: After running bootrec /fixmbr I used diskpart to recreate the partitions and assign drive letters to them. I was then able to use repair-bde D: R: -rp 123456-* to start recovering the files. It's still trucking along at the moment, so we'll see how it works out tomorrow.


Source: (StackOverflow)

My External Hard Drive fell and I cannot access storage anymore. How can I fix it?

My eternal hard drive fell and now I can no longer access the files through My Computer. (under devices and drivers)

The hard drive is a Seagate Expansion Portable Device:

Model SRD00f1

Seagate Expansion SCSI disk device

  1. The drive isn't broken, it connects to my computer normally (light indicate its on) and is also visible in the device manager.
  2. I uninstalled the driver hoping it was a driver malfunction. It was not and it did re-installed the driver back to my computer.
  3. The device status "This device is working properly."
  4. The driver is fully updated.
  5. The Volumes section of the device properties is empty. (no values at all)
  6. I've tried multiple computers and all of them cannot access the device.
  7. I've also updated my computer as well as my drivers.

Is there any way for me to retrieve the data?


Source: (StackOverflow)

Likelihood of a hard drive PCB replacement working?

I have a 1.5TB Seagate 7200.11 that died. The platter still spins up initially when attached to a machine, but then the drive clicks and spins down. Then the cycle repeats. I've found a few sites that sell replacement PCBs, however I don't know if the PCB is the issue, or something else. Given the symptoms above, is it at all likely that a PCB replacement would help? If not, I won't waste my money on the PCB replacement.


Note: I put the drive in an external ESATA controller and tried hooking it up to a Linux box here at work and got some error messages in the logs. I can post them if anyone thinks it will help in determining whether a PCB swap would fix the problem I'm running into.


Source: (StackOverflow)

How to connect Western Digital "My passport" using other means?

I have a Western Digital My Passport 500Gb external Harddrive where the USB connection on the drive seems to have worn out. I am trying to retrieve the data for a friend.

Here is an image of the cable ends. The connection on the left is the issue. enter image description here

I have taken the drive out of the cover and I notice there is another set of pins.

Do you know what this connection is and if it can be used as an alternate means to connect the device to a PC? See the exposed 12 pins below. enter image description here

I am considering getting another cable as it is difficult to tell if the cable or the drive connection or both are worn out.. My question is about the other pins and alternate means of accessing the drive.

I am open to connecting it a PC or as a secondary drive on my laptop which supports two harddrive bays and is sata.

Here are the drive identification numbers.

Product Number: WDBAAA5000ASL  
Serial Number: WX20A99W3466  

External link to drive support page on Western Digital

enter image description here

thank you.


Source: (StackOverflow)

HardDisk is recognized but dd copies nothing

I've got an old harddrive (Seagate, 200MB) here which just failed, and I wanted to get an image from it with dd. The hd is recognized as device (f.e. /dev/sdb) but dd does not copy anything from it. Additionally to it I can't select it in parted (just does nothing, no error). I already tried to cat it (cat /dev/sdb), but that does also return nothing. This whole thing is at the moment behaving like /dev/null...someone an idea what I could try next?

Thanks in Advance

dd output:

dd if=/dev/sdb of=/mnt/temp.dat
0+0 records in
0+0 records out
0 bytes copied, 2.05 s, 0.0 MB/s

Edit: dmesg is showing at no point errors.

Edit2: Thanks to everyone for the great suggestions, tried them, but the harddisk is gone.


Source: (StackOverflow)

Restoring Windows System Image Backup to a different hard disk

My SSD died. Fortunately, before the crash, I made a System Image backup (to a USB hard disk) using Windows 7's built-in backup tool. The SSD has been replaced (with exactly the same model and capacity), and now I'm ready to restore my system!

However, the Windows Recovery tool tells me that it won't be possible to restore from the System Image. It appears that because I'm trying to restore to a different SSD, Windows thinks that I'm breaking the rules. Again, this is the same model SSD -- everything about the computer is the same, except the SSD's serial number (and probably volume identifier).

Here's what's happening. When I boot from the Windows 7 installation disc and choose "Repair your computer," then "Restore using a system image," then I choose the most recent backup. I click next, and I get an error message that states that Windows cannot restore from this image. The only explanation I have is that the SSD isn't the same SSD as the one that died.

I'm confused. I thought the whole point of a System Image backup was to restore to a new (and necessarily different) hard drive in the event of a total meltdown. So why is this so hard?

Has anyone successfully restored to a different/new disk from a Windows System Image backup?


Source: (StackOverflow)

How do I recover data from my presumably dead hard disk

I have a Seagate ST3500620AS (Barracuda 7200.11) hard disk:

  • SATA
  • 500GB
  • 7200 spindle speed

I've used this disk for about 2 years now. But today it happened that my computer wouldn't wake up from sleep state. I hard turned off my computer and after turning it back on, I couldn't load the system and after some time of waiting a message came up, that OS can't be loaded from the network.

Checking my BIOS settings I can see that disk is not recognised by it. I unplugged it, put in another disk which got recognised just fine.

Then I tried connecting faulty disk to a different computer via USB (because I have a SATA-USB dock for a portable Seagate) but it didn't get recognised by the system either. I also run Disk management in case disk wasn't partitioned or anything so it would be recognised but not displayed in Explorer. No luck either. Disk doesn't show up anywhere...

So my conclusion is that this disk is now officially dead (RIP my working friend)... But I'd still like to recover more than valuable data from it. Bank certificate is just one of them...

How can I do anything to get to this disk's data? Is there any software that can actually bypass BIOS and access a device directly? Is that at all possible on an everyday machine? Should I start thinking of a data recovery service provider that would do it for me and recover valuable data?

Additional notes

  1. Disk physically isn't completely dead because on power-up it spins-up, heads get positioned (by the sound of it).
  2. Network related boot is most likely initiated by computer BIOS, because boot priority is
    HD > Floppy > Network...

Source: (StackOverflow)

Is there any way to speed up ddrescue?

I had a 500GB drive HDD crash about 5 days ago. I used ddrescue on the important partition a few days ago, and it's been on "Trimming failed blocks" for almost 2 days now.

Original command:

ddrescue -n /dev/rdisk1s2 /Volumes/OSXBackup/rdisk1s2.img /Volumes/OSXBackup/rdisk1s2.log

Current output:

Initial status (read from logfile)
rescued:   248992 MB,  errsize:   1007 MB,  errors:   15867
Current status
rescued:   249021 MB,  errsize:    978 MB,  current rate:    17408 B/s
   ipos:    44405 MB,   errors:   15866,    average rate:     2784 B/s
   opos:    44405 MB,     time from last successful read:       0 s
Trimming failed blocks...

The original command used the ddrescue -n parameter, and I have restarted the process a few times as needed (and it seemed to pick up right where it left off each time).

Is there any way to speed up this process?

Edit: Six hours later, this is the current status:

rescued:   249079 MB,  errsize:    920 MB,  current rate:      409 B/s
   ipos:    39908 MB,   errors:   15851,    average rate:     2698 B/s
   opos:    39908 MB,     time from last successful read:       0 s
Trimming failed blocks...

It appears that while "errors" is counting down excruciatingly slowly, ipos/opos is counting down how much data it has to churn through, and it seems to be working at a rate of 750MB/hour. At this rate, it will complete in ~53 hours. Yikes.

Edit #2: Two days later, still running. However, there is hope. It has moved passed the "Trimming failed blocks" portion, and on to the next phase "Splitting failed blocks". If anything, what should be taken away from viewing this question is that this definitely takes a long time when a good amount of data/errors are involved. My only hope is that I can successfully recover some important data when all is said and done.

rescued:   249311 MB,  errsize:    688 MB,  current rate:        0 B/s
ipos:    26727 MB,   errors:   15905,    average rate:     1331 B/s
opos:    26727 MB,     time from last successful read:      20 s
Splitting failed blocks...

Source: (StackOverflow)

Is it really possible to repair bad sectors?

I have found different and opposite opinions on the internet:

is it really possible to repair bad sectors on a hard disk ? should I replace the hard disk or just repair it?

I would be glad to read about your opinions.

I have just run HD Tune Pro, and it says:

Current Pending Sector

Description: Number of unstable sectors: 47
Status: The drive has unstable sectors.

enter image description here


Source: (StackOverflow)

Why can data be recovered after formatting?

If a quick format just marks bits as writable, and a normal format writes 0s to the entire disk, why do people bother with DBAN, and why are multiple passes ever required?


Source: (StackOverflow)