recover data from bad sata hd

recover data from bad sata hd

Post by jdh2.. » Sat, 23 Apr 2005 03:34:03



I have a Maxtor 250GB Maxline Plus II which statred giving some "sense
key medium" and "unrecovered read error : auto reallocate failed".  I
ran the disc diagnosiitic that comes with the box and the code
indicated a dying hard drive.

I rebooted with Knoppix 3.8 and can mount the partitions of the drive,
but when I try and CD into some of the mounted directories in my
partition of interest), I get an Input/Output error.

I tried to run fsck but got an error saying a read was too short.

Some of the data is backed up and some not.  Any advice on how I can
proceed to recover what data is available.  dd or lower level tools?

JDH

 
 
 

recover data from bad sata hd

Post by Scott Hemphil » Sat, 23 Apr 2005 04:32:29



> I have a Maxtor 250GB Maxline Plus II which statred giving some "sense
> key medium" and "unrecovered read error : auto reallocate failed".  I
> ran the disc diagnosiitic that comes with the box and the code
> indicated a dying hard drive.

> I rebooted with Knoppix 3.8 and can mount the partitions of the drive,
> but when I try and CD into some of the mounted directories in my
> partition of interest), I get an Input/Output error.

> I tried to run fsck but got an error saying a read was too short.

> Some of the data is backed up and some not.  Any advice on how I can
> proceed to recover what data is available.  dd or lower level tools?

The first rule of data recovery is "Don't do any additional damage."
It is therefore a mistake to mount the partitions as writable, since
futher corruption is very likely to occur.

What I would do first is get another disk of the same size and do a
sector by sector copy of the old raw disk device to the new one.  The
last time I tried it, dd didn't do the right thing for this job, even
with the "noerror" conversion set.  I would write my own program for
this, since it's not very hard.

Ideally, once you have a copy of all the bits you can get onto a good
drive, you would back this up, since you may never be able to get these
again from the original drive.

The copy of raw data will have damaged filesystems.  You can use debugfs
to look around without the danger of making irrevocable changes, but
you really have to know what you're doing.  If it's not worth your
trouble to get into all the details, fsck does a pretty good job of
fixing an almost correct filesystem.  Be sure to look in the /lost+found
directory afterwords to find the contents of all the inodes it couldn't
associate with filenames.

Scott
--

"This isn't flying.  This is falling, with style."  -- Buzz Lightyear

 
 
 

recover data from bad sata hd

Post by jdh2.. » Sat, 23 Apr 2005 04:47:39


So to make sure I understand this, take the new hd and create a
partition that has the same number of blocks as the partition I want to
recover on the defective drive.  Then write a program that iterates
over all the blocks on the defective drive and reads in a block at a
time and writes these to the new partition on the good drive.  And
assuming I don't want to take the extra effort with debugfs, then fsck
the new partition?

Might I get IO errors when doing raw reads from the partition on the
bad drive, /dev/sda5 in my case.  Eg, do I need to try/except the
reads?

Thanks,
JDH

 
 
 

recover data from bad sata hd

Post by Scott Hemphil » Sat, 23 Apr 2005 05:20:52



> So to make sure I understand this, take the new hd and create a
> partition that has the same number of blocks as the partition I want to
> recover on the defective drive.  Then write a program that iterates
> over all the blocks on the defective drive and reads in a block at a
> time and writes these to the new partition on the good drive.  And
> assuming I don't want to take the extra effort with debugfs, then fsck
> the new partition?

It is not necessary to create any partitions on the new hard drive.  When
the copy is made, the partition table will be copied.

Quote:> Might I get IO errors when doing raw reads from the partition on the
> bad drive, /dev/sda5 in my case.  Eg, do I need to try/except the
> reads?

Yes, you will get IO errors.  Those sectors will have to be skipped.  The
important thing is to make sure that each sector that does read correctly
gets copied to the same sector number on the new hard drive.

Scott
--

"This isn't flying.  This is falling, with style."  -- Buzz Lightyear

 
 
 

recover data from bad sata hd

Post by Scott Hemphil » Sat, 23 Apr 2005 05:28:51



> So to make sure I understand this, take the new hd and create a
> partition that has the same number of blocks as the partition I want to
> recover on the defective drive.  Then write a program that iterates
> over all the blocks on the defective drive and reads in a block at a
> time and writes these to the new partition on the good drive.  And
> assuming I don't want to take the extra effort with debugfs, then fsck
> the new partition?

My first response was considering the recovery of the whole disk.  If
you have just one partition that you are interested in, then yes, you
can make a partition on another disk that is exactly the same size, and
copy just the data from the old partition to the new one.

To save the whole disk, you can copy /dev/sda.  If you are interested in
only one partition, then you can copy /dev/sda5.

Quote:> Might I get IO errors when doing raw reads from the partition on the
> bad drive, /dev/sda5 in my case.  Eg, do I need to try/except the
> reads?

And my answer to this is almost the same.  Yes, you will get IO errors.
The important point is that all correct sectors get written to the same
sector relative to the start of the partition.

Scott
--

"This isn't flying.  This is falling, with style."  -- Buzz Lightyear

 
 
 

recover data from bad sata hd

Post by Scott Hemphil » Sat, 23 Apr 2005 05:37:45




> > So to make sure I understand this, take the new hd and create a
> > partition that has the same number of blocks as the partition I want to
> > recover on the defective drive.  Then write a program that iterates
> > over all the blocks on the defective drive and reads in a block at a
> > time and writes these to the new partition on the good drive.  And
> > assuming I don't want to take the extra effort with debugfs, then fsck
> > the new partition?

> My first response was considering the recovery of the whole disk.  If
> you have just one partition that you are interested in, then yes, you
> can make a partition on another disk that is exactly the same size, and
> copy just the data from the old partition to the new one.

> To save the whole disk, you can copy /dev/sda.  If you are interested in
> only one partition, then you can copy /dev/sda5.

I might also add that other techniques are available if you are interested
in restoring only a few files instead.  For example, if you want to recover
files consisting of text data records with a fixed format, you could use
grep on the whole partition, and fix up the output with a text editor.

Scott
--

"This isn't flying.  This is falling, with style."  -- Buzz Lightyear

 
 
 

recover data from bad sata hd

Post by jdh2.. » Sat, 23 Apr 2005 06:26:37


OK, my new drive isn't arriving until tomorrow.  In the meantime, I've
written this little python program to do the transfer.  Let me know if
you see any obvious problems

import sys, os

BS = 512
N = 471146176

# log keeps a record of whether a given block was successfully written
log = file('written.dat', 'w')
fi = file('/dev/sda5', 'r')
fo = file('/dev/sdb5', 'w')

for i in xrange(N):
    num = i%8
    if num==0: thisbyte=0

    try:
        fi.seek(BS*i)
        fo.seek(BS*i)
        s = fi.read(BS)
        fo.write(s)
    except IOError:
        pass
    else:
        thisbyte += 1<<num

    if num==7:
        log.write(chr(thisbyte))
    if (i%100)==0: # print to the screen every once in a while
       print 'wrote block', i
log.write(chr(thisbyte))

 
 
 

recover data from bad sata hd

Post by Scott Hemphil » Sat, 23 Apr 2005 06:55:25



> OK, my new drive isn't arriving until tomorrow.  In the meantime, I've
> written this little python program to do the transfer.  Let me know if
> you see any obvious problems

> import sys, os

> BS = 512
> N = 471146176

> # log keeps a record of whether a given block was successfully written
> log = file('written.dat', 'w')
> fi = file('/dev/sda5', 'r')
> fo = file('/dev/sdb5', 'w')

> for i in xrange(N):
>     num = i%8
>     if num==0: thisbyte=0

>     try:
>         fi.seek(BS*i)
>         fo.seek(BS*i)
>         s = fi.read(BS)
>         fo.write(s)
>     except IOError:
>         pass
>     else:
>         thisbyte += 1<<num

>     if num==7:
>         log.write(chr(thisbyte))
>     if (i%100)==0: # print to the screen every once in a while
>        print 'wrote block', i
> log.write(chr(thisbyte))

The one real problem with this is that it is likely to be extremely slow.
When I said that you should copy sectors, that is what you want to do
conceptually.  The actual implementation could read a megabyte at a time.
When an error occurs, the count of bytes in the returned string will be
short.  Then you can skip a sector and try to resume from that location.

If you want, you can duplicate the old partition table by doing:

  dd if=/dev/sda of=/dev/sdb count=1

Scott
--

"This isn't flying.  This is falling, with style."  -- Buzz Lightyear

 
 
 

recover data from bad sata hd

Post by jdh2.. » Sun, 24 Apr 2005 07:19:20


Hi Scott,

I've increased my blocksize to 1024*1024 and have copied about 2/3rd of
the needed blocks to my backup drive.  The problem I am encountering is
that some block reads succeed, some raise an IO error, and some hang.
It is the last group that bothers me.  The problem is that there is
noway to specify a timeout at the python level and when the process
hangs I can't kill the job, even with kill -9 PID.  When this happens I
reboot and can continue, but it is time consuming and requires constant
attention.

I'm thinking that to do raw device IO on /dev/sda5 and friends,
supporting timeouts and so on, may require kernel level code.  Is this
what you did?  Do you happen to have your old code laying around?  I'd
like to look over it for inspiration.  Links, code or other advice will
be appreciated!

JDh

 
 
 

recover data from bad sata hd

Post by kermi » Sun, 24 Apr 2005 08:46:08



> Hi Scott,

> I've increased my blocksize to 1024*1024 and have copied about 2/3rd of
> the needed blocks to my backup drive.  The problem I am encountering is
> that some block reads succeed, some raise an IO error, and some hang.
> It is the last group that bothers me.  The problem is that there is
> noway to specify a timeout at the python level and when the process
> hangs I can't kill the job, even with kill -9 PID.  When this happens I
> reboot and can continue, but it is time consuming and requires constant
> attention.

At least for ole good parallel IDE the whole error recovery could take as
much as half an hour until all timeouts on all levels are triggered. So it
must likely does not hang but just sits in error recovery somewhere. Of
course, if you have many such spots it will take extremely long time :(

Quote:> I'm thinking that to do raw device IO on /dev/sda5 and friends,
> supporting timeouts and so on, may require kernel level code.

Any raw IO you will do will end up in device driver and that is where these
timeouts happen. Personally I would not dare to change anything in IDE
drivers :)

=arvi=

Quote:> Is this
> what you did?  Do you happen to have your old code laying around?  I'd
> like to look over it for inspiration.  Links, code or other advice will
> be appreciated!

> JDh

 
 
 

recover data from bad sata hd

Post by Scott Hemphil » Sun, 24 Apr 2005 13:01:02



> I've increased my blocksize to 1024*1024 and have copied about 2/3rd of
> the needed blocks to my backup drive.  The problem I am encountering is
> that some block reads succeed, some raise an IO error, and some hang.
> It is the last group that bothers me.  The problem is that there is
> noway to specify a timeout at the python level and when the process
> hangs I can't kill the job, even with kill -9 PID.  When this happens I
> reboot and can continue, but it is time consuming and requires constant
> attention.

> I'm thinking that to do raw device IO on /dev/sda5 and friends,
> supporting timeouts and so on, may require kernel level code.  Is this
> what you did?  Do you happen to have your old code laying around?  I'd
> like to look over it for inspiration.  Links, code or other advice will
> be appreciated!

Actually, I've never had to recover a Linux partition from a bad drive
in precisely this way.  I would have written such a program in C, and
not at the kernel level.  If "kill -9" doesn't work, then a lower level
program would be necessary.

My one hard drive failure under Linux occurred at the 99% point of a
full-system backup.  The remaining 1% could all be recovered from the
installation CD.  (I also had copies on earlier backup tapes.)

My main experience has been recovering data lost through software/operator
failures under TOPS-20, DOS, and Linux.

Scott
--

"This isn't flying.  This is falling, with style."  -- Buzz Lightyear

 
 
 

recover data from bad sata hd

Post by Kasper Dupon » Thu, 28 Apr 2005 20:44:05



> At least for ole good parallel IDE the whole error recovery could take as
> much as half an hour until all timeouts on all levels are triggered. So it
> must likely does not hang but just sits in error recovery somewhere. Of
> course, if you have many such spots it will take extremely long time :(

For such situations I usually open the damaged device with O_DIRECT.
That way I bypass all of the retrying the kernel would otherwise
perform, and around bad sectors this is a lot faster.

Notice that when using O_DIRECT your read buffer must be aligned. I
don't know how to do that in python, but I could post a C program
doing this.

With O_DIRECT buffer size have a large influence on the performance.
Unfortunately some kernels have a bad way of handling the combination
of I/O errors on large reads with O_DIRECT. So I usually just read
one single 512 byte sector at a time.

For recovery I usually recommend a new drive four times the size of
the partition you want to recover. When I have copied all good sectors,
I make an image where missing sectors are replaced with all zero bits,
and I use fsck on this. Next I make another image replacing with all
one bits instead and use fsck on this. This way I can compare and will
know which files were damaged because of sectors that could not be
read.

--
Kasper Dupont

 
 
 

1. Looking for place that will recover data from bad HD

I have seen ads on some computer magazines for places that
specialize in recovering data from (crashed) hard disks.

Well, I need to know the phone number of one those outlets
with some urgency.  The machine is an IBM RS/6000. The
sick disk's capacity is 1 GB.  OS is AIX 3.2.

Thanks a lot for your help.

-Ramon Herrera

2. Apache: password for directories

3. Recovering data from a HD larger than BIOS permits

4. 2 q. about initialization

5. recovering data from an electricuted HD

6. Bitsurfr ISDN modem & Linux PPP - success ? (fwd)

7. recovering data from a bad exabyte tape

8. anonymous ftp under Solaris 2.4

9. Recover data on bad 1/4" tapes

10. !!! Help me recovering my data from HD !!!

11. Installing RH8 directly to SATA HD

12. SATA HD & DMA ?

13. SATA HD Help