Damaged Hard Disk

From CGSecurity

Jump to: navigation, search

Bad sectors are the most common form of harddisk physical damage. They are early signs of disk crash as it deteriorates over time. A bad sector is a sector on the disk which data cannot be written or read due to a physical damage or inconsistencies of parity checking bits on disk (CRC or Cyclic Redundancy error). To recover your data, the best method is to copy its data to another hard disk before attempting to recover its data.

The new disk must be at least exactly the same size (check the number of LBA sectors) or larger; when larger, it's usually not a problem because the number of heads per cylinder and sectors per head will be the same if both disks use LBA mode. Windows may have some problems in dealing with bad sectors on a damaged hard disk, so the best solution is to use a Linux OS to copy data to another hard disk.

You can also use TestDisk to help analyze the sectors copied from a hard drive with physical problems onto a good drive.

Contents

Booting from Knoppix, a Linux LiveCD

If you don't have a Linux OS installed, download the Knoppix LiveCD , a free bootable CD with a fully functional Linux OS that runs only in memory!

  • Burn the .iso file to CD
  • Boot from the CD-ROM
  • At the boot prompt, type knoppix lang=us for a US keyboard/language.
  • You are automatically logged in as the user 'knoppix' on a GUI console.
  • Launch a Konsole/terminal
    (Note: Knoppix has a separate 'Konsole as root' choice, but copy/paste functions are deactivated in it, so we always recommend using the method described below for gaining root privileges from the normal user Konsole.)

Knoppix comes with TestDisk, PhotoRec, dd and dd_rescue. To access hard disks, you need to run these utilities with root (Administrator) privileges.

  • To become root from the Knoppix user account, select the Konsole and type sudo -s, then press the Enter key.
  • Now you can use all the powerful root commands you need for full disk access from this console.

Note for users of Knoppix version 4.0.2 CD:
To use TestDisk under Knoppix 4.0.2, you need to resolve a library problem by first executing: 

ln -s /usr/lib/libntfs.so.7 /usr/lib/libntfs.so.5

before running testdisk.

Note for users of Knoppix version 5.1 CD:
To use TestDisk under Knoppix 5.1, you need to resolve a library problem by first executing: 

ln -s /usr/lib/libntfs.so.10.0.0 /usr/lib/libntfs.so.9

before running testdisk. This problem shouldn't occur under any other Knoppix versions or with the Linux version avaible from our Download area.

Identifying an HDD's Linux device

Under Linux, the Primary Master IDE disk device is /dev/hda
Primary Slave IDE device is /dev/hdb
Secondary Master IDE device is /dev/hdc and so on.
SATA HDD device filenames usually begin at /dev/hde or /dev/sda
SCSI device filenames always begin at /dev/sda
USB devices often use SCSI device names: /dev/sda etc.

To list the partitions of a particular hard disk, as root, run: fdisk -l device.

Disk Duplication

Once you have verified the device names for your damaged disk and the new one to copy its data to, in a command-shell (CLI) or terminal console, not from within any OS on the damaged hard disk, you can start to duplicate the data.

The old and slow method using 'dd'

As root, run dd if=/dev/old_disk of=/dev/new_disk conv=noerror,sync
or to create an image file:
dd if=/dev/old_disk of=image_file conv=noerror
to copy the data. Be carefull, if you are copying a disk, the destination must also be a disk, not a partition. If you are copying a partition, the destination partition must be large enough. Copying the whole disk is recommanded.

To speed up the copy process, you can append bs=8k, it will read/write the disk by 16 sectors at a time.

Kurt Garloff's 'dd_rescue'

If you believe there are many damaged sectors on the drive, you can try using either Kurt Garloff's 'dd_rescue' (dd_rescue) instead of dd.

The best method: Antonio Diaz's 'ddrescue'

The best solution, both faster and more efficient, seems to be Antonio Diaz's 'ddrescue' (ddrescue)

# download ddrescue
wget http://download.savannah.gnu.org/releases/ddrescue/ddrescue-1.3.tar.bz2
# extract the source code
tar xjf ddrescue-1.3.tar.bz2
# compile ddrescue
cd ddrescue-1.3
./configure && make
# first, grab most of the error-free areas in a hurry:
./ddrescue -n /dev/old_disk /dev/new_disk rescued.log
# then try to recover as much of the dicy areas as possible:
ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log

Early detection of bad sectors

Modern harddisk can detect physical problems using SMART Monitoring.


Return to TestDisk

Data Recovery