9 replies to this topic

[Technotika]

Hi Guys
Firstly apologies if this is in the wrong section. I couldn't find anything more appropriate other than the data is on a Vista Machine.

Ok so I get a call this afternoon and some douche slammed his laptop lid shut in a tantrum and now the thing doesn't boot. He's desperate for the data. I said I'd take a look.
Usually I can do enough to recover the data in these cases, but this is a real challenge and thought I'd share my experience so far and offer up for more expert advice.
It's a good case to really see how far I try and recover it before telling the person they give up hope or spend serious cash at a professional HDD recovery outfit.
So...
1.) Vista recovery CD - boots - loads - hangs on green progress bars. Has to be powered off. Tried ISO from USB also. Also tried Original Vista Disc. Same.
2.) Parted Magic - boots ok - sees HDD - computers hangs trying to access anything off the HDD. Has to be powered off.
3.) Toshiba Diagnostic tool - reports FAIL.
4.) Live XP - same as "2". Any attempt to open explorer or browse the HDD - hangs the PC to the point reboot required.
5.) **In Progress** DDRESCUE /dev/sda /dev/sdc from Trinity Rescue Kit Console 3.4
sda being trouble HDD sdb being external USB size greater than sda to avoid issues.
Now...it's been running all night, and when I check it, I can hear the fateful clicking sound of a "goosed" HDD. However checking later, it's logged errors but actually moved on a bit. So although stalling terribley, bit by bit it's copying the data.
Sometimes so slow though I feel it could run for days. Although if I'm lucky it should have a good run and finish during the night.

I haven't slaved the disk into another PC because a) it's a flipping SONY VIAO and the HDD is hidden away out of sight!!!! And also last time I saw this behaviour, slaving it up killed any machine that it was connected to.
If this fails what else can I try. PS My Freezer is FULL of PRWANS LOL

Many thanks look forward to the masters advice as always

[Wonko the Sane]

The "it's a Sony", the "it's difficult to get to it" and the "last time another completely different hard disk most probably with a completely different problem but having the same clicky sound" are NOT valid excuses.

• Disassemble the thingy.
• Get the HD in a USB case or connected as "slave" to "a working machine".
• Image it partially if you cannot do it as a whole.

This tool has the ability of imaging "backwards" that in some cases help:
http://reboot.pro/7783/

If the problem is not solved (at least for the part of data REALLY *needed*) by the above, that pretty much ends your available options.


Wonko

[joakim]

I think many advises exist, and jaclaz gave some. But beware that continued attempts on a disk with the famous "click of death" (from damaged head/arm) present, may damage the disk surface. However, it may not be the case and you may be lucky and get all the data off. I guess it's a decision you would want to take based on how valuable the data on the disk is. If it's truly invaluable then go get someone with a clean environment to disassemble it and replace the outer parts of the disk and take it from there (but at a significant higher cost).

How bad is the clicking by the way?

[MedEvil]

Firstly i would evaluate the value of the data, cause every rescue attmpt puts the data at risk of not being recoverable at all, by anyone!

Then a diagnostic of the drive and evaluation of possile defects, which can cause this specific problem.

Preparing a recovery plan. (What to try, in which order, to maximize chaces of success, while minimizing chances to further damage the data.)

Since you stated the removal fom the laptop as already being a problem, i would stick in your case with only simple software recovery.

However, i would only ever touch a broken drive, if the owner of the disk would give it to me, in the writing, that he likes to have the data back, but can also live without it.


@joakim
'Click of Death' is when the drive can not initialize anymore, because the firmware can't be read, for some reason.

If any of the heads is riped off, one can hear a grinding sound, as the arm 'removes the data' from the platter.




PS: Whatever you do, Technotika, do not turn off the laptop in between. There's a good chance, you won't get access to the HDD again.

[Wonko the Sane]

PS: Whatever you do, Technotika, do not turn off the laptop in between. There's a good chance, you won't get access to the HDD again.

Since the thingy was already rebooted n times by now, I doubt that this is any more probable that it is on *any* machine *any* time.

Running a disk intensive application on a failing drive in a notebook (please read in an almost sealed case with very little possibilities to cool down) is on the contrary (and as always IMHO) a far greater risk .


Wonko

[MedEvil]

Since the thingy was already rebooted n times by now, I doubt that this is any more probable that it is on *any* machine *any* time.

There is a difference between rebooting and turning the computer fully off, in my experience. However Technotika does not specify.

Agree with you on the second part. That its 'less than ideal' to do the recovery in the laptop. Not only is the cooling questionable, more importantly, one can't hear the noises the drives makes clearly.

[Wonko the Sane]

Not only is the cooling questionable, more importantly, one can't hear the noises the drives makes clearly.

Well, not that you can do much about them once you hear them clearly but surely having it inside the notebook prevents poorman's tricks like "percussive maintenance" :
http://en.wikipedia....ive_maintenance
and rotating/orientating the device in space (that even if seemingly stoopid does solve sometimes a few problems)


Wonko

[Technotika]

Thanks for the tips guys

I managed to get 130 gbs passed across to a bigger disk in an external caddy. And I think I got most of the stuff the guy wants although some (well alot) of the photo's are corrupted; the thumbnails dont populate
and even ones that do when you open them are just black.

So I have something.....for now.

I have also since seen that getting the disk out isn't too difficult so may try further things but as it goes I think its as good as I'm going to get.
Can try percussive once out and also recovering from the other end of the disk - cheers wonks

What I'm finding is that lets say the disk is 200GB's the DDRESCUE borks at about 130 (stays on that for hours).
Then what I am doing is stick the caddy containing the working disk that has been rescued to into my windows BOX where it says "disk nor formatted bla blah" you need to format.

I ignore that and run something called "get data back for NTFS" on the drive and it seems to do the job.

I was wondering if this can be improved on. Because It failed 1/2 way through, the partion structure isnt complete on the cloned disk.
Should I be doing something else before sticking the USB external clone of the failed HDD into a nother PC and getting the data off.
Like running TESTDISK for example to re write the partion table and maybe improve recovery etc?

Thanks

[Wonko the Sane]

Sure it can be improved.

Image the disk in "sections".

A suitable size to start with is, if the overall size is (say) 500 Gb, 50 Gb (or 1/10th of the disk size).
So you image:
0÷50
50÷100
100÷150
...
When you get stuck (in your example at 130 Gb), you jump over the "section" (leave it for later) and image:
150÷200
Let's, for the sake of this example, say that also 150÷200 is inaccessible/slow/whatever, stop the imaging and go for the rest:
200÷250
250÷300
...
Still for the sake of the example, let's assume that all the rest goes well.
Now you have 8 "sections" out of 10.
Divide the 100÷150 in two sub-sections:
100÷125
125÷150
of these the first one will be imaged successfully and the second won't.
Before you had 8/10 of the disk=16/20, now you have 17/20.

Now divide the 150÷200 in two sub-sections:
150÷175
175÷200
of this (let's say) the first one will fail, but the second will be imaged successfully.
Before you had 17/20, now you have 18/20.

Try imaging the second problematic section BACKWARDS:
175÷150, if you are lucky, you may get some 20 Gb (or 4/5 of the subsection)
Before you had 18/20=90/100 now you have 94/100.

Try imaging the first problematic section forward:
125÷150, if you are lucky, you may get some 5 Gb (or 1/5 of the subsection)
Before you had 94/100 now you have 95/100.

So if you mentally reassemble the "bits and pieces" you should have in the range 100÷200 something looking like this, with a "-" meaning a good 5 Gb "chunk" and a "*" meaning a missing 5 Gb one:
------*****----
Now, simply create an empty file the EXACT size of the "******" and reassemble the sections together in the right order.

Now you have an image that is 95/100 like the original one, and is the right size.
On this image you then run Recovery oriented apps.


Wonko

[Technotika]

Thanks for a detailed response! Well there was a bit of luck in this case..

I left DDRESCUE chuntering away all weekend and came back today to see it had finished the main job
data recovered 200GN
iops 137
io 137
splitting error's zones

big error counts etc

any way nothing was happening on the external disk so I closed it down and attached the external disk to my machine at work and like magic auto play kicked in and let me open the disk as normal
(no format errors or anything) and got everything back.
Cracking stuff although I don't know what was more painful, all that, or reinstalling vista and its 1 million updates.!!!

Thanks again