Recovering files from a failing external disk drive

Kenneth Burgener kenneth at mail1.ttak.org
Mon Jan 12 11:00:49 MST 2009


My sister-in-law has a 500GB external USB enclosed SATA hard disk.  This 
has all of her family photos.  The disk is failing (bad sectors).  Is 
there any way to recover as many files as possible?

This is what I have done so far...

The partition is an NTFS partition.  I checked the actual disk usage using:
  # ntfresize -i /dev/sdb1
  ... 31GB of actual data

I thought I could save some space by using NTFSresize to shrink the 
partition down to the 31GB of actual data.  This of course failed, 
saying it couldn't resize
  # ntfsresize /dev/sdb1 -s 32GB
  ... can't resize because of bad sectors, try 'ntfsclone --rescue ...' 
first

I then tried to use NTFSclone, but at about .64 percent it appeared to 
make no progress.
  # ntfsclone --rescue --save-image -o save-me.img /dev/sdb1
  ... .64 percent completed

I then thought I would try the old dd byte per byte copy to see how much 
I could get, and ignore errors:
  # dd if=/dev/sdb1 of=~/save-me.img bs=1M conv=noerror
  ... kill -USR1 occasionally reported 2.4 MB/s
  ... finally: 31022120960 bytes (31 GB) copied, 20447.6 seconds, 1.5 MB/s
  ... and then it stopped responding

If I check dmesg at this point I can see several of these No Sense error 
messages:
  sdd: Current: sense key: No Sense
      Add. Sense: No additional sense information
  Info fld=0x0

I now have a 31 GB partial disk image.

I tried mounting this disk image:
  # mount -t ntfs -o loop ~/save-me.img /mnt/save-me

  Failed to read $MFTMirr: Input/output error.
  Failed to mount '/dev/loop0': Input/output error.
  NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
  The usage of the /f parameter is very IMPORTANT! No modification was
  made to NTFS by this software.
  Mount failed.

I tried getting the NTFS size info from this disk image:
   # ntfsresize -i ~/save-me.img

  ntfsresize v2.0.0 (libntfs 10:0:0)
  Error opening partition device: No locks available.
  Failed to startup volume: No locks available.
  ERROR(37): Opening 'save-me.img' as NTFS failed: No locks available


Anyone have any suggestions on how to proceed from here?  Any 
suggestions for some sort of data carving utility that can extract any 
files from this partial disk image?

Thanks,
Kenneth





More information about the PLUG mailing list