First time ddrescue user - need help imaging
Hello,
First time poster here. My hard drive bit the dust today. As soon as I realized it was going under (getting messages from Windows telling me one file after another had been lost) I shut the computer down knowing that failure to do so would result in more data loss and knowing that I might not be able to reboot. I was right, not able to reboot.
First thing I tried was an XP repair installation but the installer failed to find the OS so I knew I was in trouble. This is uncharted territory for me.
There are certain files (i.e. PST files) that I *MUST* recover. I suspect that if I pop the drive into a USB enclosure I'll be able to see many of my files and recover them onto another drive, but I fear I will do more damage in the process and possibly corrupt the files I need to save.
So my plan is to make an image of the failing drive onto a new drive with ddrescue. Then copy my most important files from the new image onto a third drive. Then try to boot from the newly-copied image. And if that doesn't work try chkdisk /r on the copied image to see if that helps.
Does that sound like a sound strategy?
Assuming it is a good strategy I need some help with ddrescue as I'm not well versed in Linux.
Could someone give me a quick step-by-step on getting the image made? I assume I need the command lines to mount the failed drive (still connected via IDE), mount the target drive (connected by external USB drive enclosure) and finally run the command to copy from the internal drive to the external USB drive with the log option turned on.
Also, is there any way to safely salvage some of my files that may be readable before making the image? This is my work computer and I'm eager to get back up and running ASAP. Getting the PST files would be a big first step.
I will be booting from the ubuntu-rescue-remix-8.10 live CD.
I am so thankful that this tool exists because it sounds like it's exactly what I need. I just wish I was better versed in Linux so I could make more sense out of all the online resources I've come across.
TIA
You don't need to mount the
You don't need to mount the failed drive. Just the opposite, you need the kernel to recognize it, but you don't want to mount it.
Boot the Rescue remix. Plug in your destination drive (the drive to which you want to copy the image). Run
sudo lshw -C disk -short
and find the drive. Let's say it's /dev/sdb
You can't make an image onto a fat filesystem since once your image grows beyond 4 gigs, the file will not be able to get any bigger.
I like to use ext3. To format your drive to ext3 make sure it doesn't contain any data you need to keep and run
sudo mkfs.ext3 /dev/sdb1
Then mount the drive.
mkdir mnt
sudo mount /dev/sdb1 mnt
cd mnt
mkdir recovery
cd recovery
Now plug in your source drive (the faulty one). Wait a few moments and run lshw again to find out the device name. Both drives should be listed.à
sudo lshw -C disk -short
Let's say the source drive is /dev/sdc
Now, run gddrescue to create an image (called "image") and use a log (called "log")
sudo ddrescue -r 3 /dev/sdc1 image log
If using the most recent version of ddrescue on an ext filesystem, you can make the image a sparse file using the -S option.
sudo ddrescue -r 3 -S /dev/sdc1 image log
That will make gddrescue image the drive.
never done this before but
never done this before but now i´m trying because it´s not able to mount my harddrive that i have in my laptop. when i start up my computer with a ubuntu cd and get into ubuntu (without installing it) i get these messages:
1)
Cannot mount volume.
Unable to mount the volume 'kurt'.
ntfs_attr_pread: ntfs_pread failed: input/output error
Failed to read NTFS $Bitmap: Input/output error NTFS is
either inconsistent, or you have hardware faults, or you
have a SoftRAID/FakeRAID hardware. In the first case
run chkdsk /f on Windows then reboot into Windows
TWICE. The usage of the /f parameter is very important!
If you have SoftRAID/FakeRAID then first you must
activate it and mount a different device under the /dev/
mapper/ directory, (e.g. /dev/mapper/
nvidia_eahaabcc1). Please see the 'dmraid'
documentation for the details.
2)
Unable to mount kurt
DBus error org.freedesktop.DBus.Error.NoReply: Did
not recieve a reply. Possible causes include: the
remote application did not send a reply, the message
bus security policy blocked the reply, the reply timeout
expired, or the network connection was broken.
_________________________________________
so i´m trying this right now with the rescue remix. i did it yesterday but then my external harddrive to which i mounted the crashed harddrive files onto got full just before it finished. so now i´m doing it again on a much bigger one and it will have enough space.
the question then is. afterwards, how do i find the files that i have mounted, because if i plug it into my windows computer it tells me it´s not formatted and asks me if i want to do that. so what should i do to be able to find different files that i really want recovered from the harddrive. for example i need some of my projects from school, a lot of *.3dm *.max pictures and documents. is it a way to find specific files or to just browse thru all files on the new mounted harddrive or how does it work?
thanks in advance
I think I misunderstand how
I think I misunderstand how gddrescue works.
I thought gddrescue simply creates a mirror image of the original hard drive while trying to make repairs on the target. But now I get the impression that it just creates an image file of the faulty drive.
What is the point of this image file? Can you do anything with it other than re-convert it back to its original state? Will I be able to recover original files from this image file? I must be misunderstanding something here.
Now, back to logistics...
My faulty drive is already installed via IDE. It would be a lot easier if I can make a backup without pulling the cable then plugging it back in. Can I do that?
Will gddrescue/ubuntu be able to use a USB drive enclosure as the target?
If I start out by reformatting the target drive in ext3 I'm going to end up with an ext3 drive with an image file of my original drive. Now I have to take more steps to go from the image file to a NTFS bootable (or at least readable) XP hard drive? So I'll need a third drive?
Looks like the roadmap is:
Damaged Drive (NTFS) --> gddrescue --> Image File (ext3) --> ??? --> Mirrored Drive (NTFS)
I thought the roadmap was:
Damaged Drive (NTFS) --> gddrescue --> Mirrored Drive (NTFS)
It can create an image file
It can create an image file or write to another drive to clone it. If you are dealing with two drives of identical size, you can clone them if you wish.
Don't change directory to anywhere, just run from the live cd home directory:
sudo ddrescue -r 3 /dev/sdc /dev/sdb log
That will attempt to copy the bootloader and all the partitions on the disk at once.
If you are not able to completly copy the drive, the new drive may not be bootable. But you can still data-carve the files our from the image (you won't be able to data carve from a failing drive since it will give you inconsistent results.)
The advantage to creating an image file is that if your target drive is bigger than the source, you don't waste that space. You can mount an image just as if it were a real device.
mkdir drive
mount -r -o loop image drive
and then browse the "drive/" directory.
You can also data carve the image file if you need to (if it's so badly broken that the filesystem is not intact).
So, you can do either... Which is better depends on your situation.
Yes, you can make an image without unplugging the ide drive. Yes you can use a USB enclosure. Just run
sudo lshw -C disk -short
to help identify which drive is which.
I hope this helps.
So if the clone drive is the
So if the clone drive is the same size as the original drive then there is no benefit to making an image file, correct?
Sounds like another advantage of making a direct clone is that I can take that cloned USB drive, plug it into a working XP box and copy over whatever files survived the cloning process. And I can do this from Windows (the less time I spend at the command prompt the better).
From what I understand gddrescue will not further corrupt the source drive, correct?
Once I have a clone is there any benefit to running chkdisk /r on that drive or is it redundant at this point?
In a nutshell, it sounds like all I have to do is:
1) sudo lshw -C disk -short [to identify the drives]
2) sudo ddrescue -r 3 /dev/sdc /dev/sdb log [to clone the drive]
I assume that the source drive is first and target is second?
You previously mentioned mounting the target drive after formating it to ext3. Since I'm not formating is this no longer necessary for me?
Thank you! It's a lot clearer now and not more complicated than I was expecting.
gddrescue will not try to
gddrescue will not try to repair the source drive, so it will not corrupt it - correct.
I reckon that the first time you plug in the cloned drive to a windows computer, windows will try to repair the filesystem automatically since it's probably in an inconsistent state.
As for running gddrescue, just be sure you type in the correct source and destination drive. using "/dev/sdb" and "/dev/sdc" is just an example here.
No, it's not neccessary to format the target if you are cloning the drive.
When I run gddrescue I'm
When I run gddrescue I'm still not clear on which order to put the source and target. I assume the source is first but want to be certain. In your example is sdb the source?
It would be rather catastrophic to get them backwards!
In regards to the target I understand that I don't need to format the drive but do I still have to mount the target drive? In your previous example you instructed me to mount the target drive; I wasn't sure if the target drive always has to be mounted or if it only needs to be mounted if you format it in ext3 first.
Thanks! This is great help!
ddrescue [options] infile
ddrescue [options] infile outfile [logfile]
To read the manual on any command, use the man command:
man ddrescue
No, you don't need to mount the destination. Since you will be rewriting the filesystem on the device, it would not be a good idea to mount it. It would be like pulling the rug out from under you... Now, if you were creating an image file, that file would need a filesystem on which to live, but that's not the case.
I'm in the same situation,
I'm in the same situation, and the above information was very helpful. The questions I have are:
Can I clone to a larger drive?
Can I image onto a NTFS formated hard drive?
If I make an image of my failed drive, how do I get the files I want onto my other (good) XP laptop? And is that process different than if the drive is cloned?
Thanks!
HAVING PROBLEM TOO, UBUNTU
HAVING PROBLEM TOO, UBUNTU remix live cd do not see my failed HD. I plug the dead HD, it spins and make clicks for 30 seconds but when I digit : sudo lshw -c disk -short it is not recognized as if i have not plugged it. WHAT CAN I DO??? plese rescue me ..ehmmm help me ;-)
If the drive clicks and is
If the drive clicks and is not recognized by the BIOS, there is no software that can help you.
If your drive is only
If your drive is only clicking try to put it in the freezer at -18° for 2 hours, I could rescue some drives with it also 2 where the drive was only spinning and make noises. At the moment I have an IDE drive which only could be accessd while it lays in the freezer via an USB-IDE adapter, otherwise the drive is not detected by BIOS or the USB adapter. The freezer should be one with black frost (no one where you see water/ice on the objects)
Here a picture how it looks, the HD lays the second day in the freezer.
http://img17.imageshack.us/img17/4873/dsc05042a.jpg
I'm curious to know... My
I'm curious to know...
My friend in college has a 300GB Mammoth of a Maxtor that has unfortunately died and needs recovering.
I have a 250GB Western Digital.
He tells me that he has only used up to a maximum of 80 - 100 GB of data on his HDD and I want to recover it for him onto my smaller HDD (the biggest one I own).
Is this possible?
I have used this method with my 250GB HDD but that was with a 70GB Laptop HDD and that just made my HDD think it was 70GB until I copied everything I wanted off it then ran the Western Digital Low Format Fat32 Formatter on it and fixed it back to 250GB.
Is it possible for me to recover the 300GB onto my 250GB in a bid to only save the used 100GB?
You can use the -S option in
You can use the -S option in ddrescue which will create a sparse file. But it may still create an image larger than your destination drive since any deleted data will still take up space.
Without an intact filesystem, it's not possible to tell which data is useful and which data is not.
You will need another disk (a third one) onto which to save the data if you are not able to recover a working image. That is, if you are unable to use the filesystem on the image you make and need to use file carving.
So, what does this 'Sparse'
So, what does this 'Sparse' file do then?
Just create a file with recovered data in it? Because from what I remember ddrescue just fills up any blank spaces on the destination drive anyway.
Sparse file From Wikipedia,
Sparse file
From Wikipedia, the free encyclopedia
In computer science, a sparse file is a type of computer file that attempts to use file system space more efficiently when blocks allocated to the file are mostly empty. This is achieved by writing brief information (metadata) representing the empty blocks to disk instead of the actual "empty" space which makes up the block, using less disk space. The full block size is written to disk as the actual size only when the block contains "real" (non-empty) data.
When reading sparse files, the file system transparently converts metadata representing empty blocks into "real" blocks filled with zero bytes at runtime. The application is unaware of this conversion.
Most modern file systems support sparse files, including most Unix variants and NTFS, but notably not Apple's HFS+. Sparse files are commonly used for disk images, database snapshots, log files and in scientific applications.
Sparse option doesn't make
Sparse option doesn't make the image files any smaller, though. I'm not sure it does what you think it does. Maybe the partition has to be defragged first for it to make any difference?
It can make the image
It can make the image smaller, if there are areas of unused space. The size reported by the filesystem (the apparent size) will be larger than the size it actually takes up on the disk(actual size).
Also, never, ever try to defragment a filsystem on a faulty drive.
I have started to create a
I have started to create a image of a hard drive is failing. As one of the above posts says I should be able to mount the image in a Linux distro say Ubuntu using.
"The advantage to creating an image file is that if your target drive is bigger than the source, you don't waste that space. You can mount an image just as if it were a real device.
mkdir drive
mount -r -o loop image drive
and then browse the "drive/" directory."
My questions is, once I mount the image (the hd had windows on it) will I be able to browse the drive as if I plugged in a Windows external?