Failing HDD detected but not

Printable View

03-13-2014, 03:59 AM
Fegkari

Failing HDD detected but not

So I've never encountered a problem quite like this before, and I genuinely can't even begin to figure out how to search for it. I've tried but, you know, so I apologize in advance if this has been discussed before.

I have a HDD that began showing basic symptoms of early-stage failure. Bad sectors, hangs during loading times, but what tipped me off was a particular series of events. A rather large game update failed to download, and the first attempt I made to run a disk check and filesystem repair never finished and instead crashed the system after the monitor went on standby. Reboot resulted in the OS telling me to repair it with the installation DVD, so I did, and after supposedly successfully accomplishing this, told it to run a disk check and filesystem repair prior to startup. Reboot. Disk check never initiated and boot up locked on the splash screen. Had to force reboot. OS told me to repair it with the DVD again. Repair environment hung on initial scan following repair command. Force shut down. Fired up KNOPPIX. Simply opening the Disk Utility revealed I had over 200 bad sectors on the drive. Immediately I knew it was boned. Stupidly were it not for Microsoft having incredibly appallingly unstable software, I would have been suspicious a lot sooner. yes this was windows and i really wish i never had to pick it back up again (I was pure Linux for a couple of years)

This happened... three days ago. Instead of trying to repair the filesystem via KNOPPIX (actually I couldn't even get it to mount any of the partitions on that disk at all), I opted to get a replacement drive and just clone the data on the failing one to the new one when it arrived. At the time I had shut it down from KNOPPIX, everything could still see this drive. I left the machine containing this abhorrent thing off until the new drive arrived and I could plug it in via enclosure (it's a laptop) and proceed with the cloning. Normally I never turn it off. Cut to today. The instant the new drive hit my doorstep I was testing it on another machine to make sure it worked and went straight to setting it up to clone.

Already as soon as the machine made it past POST I noticed something was amiss. The readouts I was receiving were definitely not the same ones I was watching just a few days ago. I started with Ubuntu Live at first pretty much entirely because it booted a little quicker. When I ran 'fdisk -l' in terminal (as root, of course), Ubuntu couldn't see the original HDD at all. Not entirely sure what to think, I decided 'well okay, I'll swap to KNOPPIX then'. As a precautionary measure, before getting all the way into KNOPPIX just to reboot again, I decided to check the BIOS. The drive no longer showed up on the main page, but checking the SATA configuration menu showed that the BIOS knew it was still there in some fashion.

I ran 'fdisk -l' as root again in KNOPPIX, and what came back was somewhat curious. I have three drives connected to the laptop: the original HDD, which would normally read as 'sda', the USB stick that KNOPPIX and Ubuntu Live were on read as 'sdb', and the replacement drive reads as 'sdc'.

Ubuntu read the USB stick as 'sda' and the replacement drive as 'sdb'.

KNOPPIX on the other hand, while also only coming back with two drives, assigned the USB stick as 'sdb' and the replacement drive as 'sdc'.

I have not attempted to do any data transfer or cloning at all. Once I hit this bewildering snag I stopped and did my best to try and research what it means and if I could still try to clone the failing drive.

...This is ridiculously long-winded just to ask a question, wow, sorry. I'm really bad at summarizing, actually.

I guess I have a couple of questions:

What does this read discrepancy mean?

and:

Is it still possible to salvage the data with the tools provided in KNOPPIX, or is it beyond hope?

Part of me is still holding out that I won't have to ship the blasted thing off to become an extraordinarily costly bill, but at this point I'm not holding my breath.
03-13-2014, 12:15 PM
Werner P. Schulz

Does (within Knoppix)

Code:

hwinfo --disk

recognize the Windows HD? If so, tell us the output from hwinfo for this device.
03-13-2014, 02:15 PM
Fegkari

It does, yes:

Code:

18: IDE 00.0: 10600 Disk [Created at block.243] UDI: /org/freedesktop/Hal/devices/storage_model_TOSHIBA_MQ01ABD0 Unique ID: 3OOL.+voAsJPWH+C Parent ID: w7Y8.RaWgTNXfPu5 SysFS ID: /class/block/sda SysFS BusID: 0:0:0:0 SysFS Device Link: /devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0 Hardware Class: disk Model: "TOSHIBA MQ01ABD0" Vendor: "TOSHIBA" Device: "MQ01ABD0" Revision: "AX00" Driver: "ahci", "sd" Driver Modules: "ahci" Device File: /dev/sda Device Files: /dev/sda, /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 Device Number: block 8:0-8:15 Geometry (Logical): CHS 38913/255/63 Size: 625142448 sectors a 512 bytes Drive status: no medium Config Status: cfg=new, avail=yes, need=no, active=unknown Attached to: #13 (SATA controller)
03-13-2014, 06:29 PM
Werner P. Schulz

Ok. this is a sign of live and perhaps you can restore somethings with "testdisk". Read the Documentations, especially "Step by step"

But first of all clone your Windows HD using ddresue and let testdisk only try to repair the cloned HD!

Part 2b: Cloning directly to a new disk
03-15-2014, 03:21 AM
Fegkari

So I don't think it worked. Ran ddrescue, 16 hours later not a single block of data was error free according to the readout. It came back with one error the size of the entire drive. I couldn't find anything on the new drive, checked with TestDisk anyway, the only partitions it recovered were deleted from the previous owner. TestDisk's wiki about rescuing data off of a failing drive mentioned dd but also warned to use caution with it. Is there anything else I could attempt or is that pretty much it. Since I've never had to do this before I'm incredibly paranoid I'll screw something up.
03-17-2014, 03:34 PM
Fegkari

UPDATE: I genuinely can't figure out how to edit posts on this forum and it makes me feel silly, but I've investigated a little bit further. When I find the original NTFS HDD in the file browser, I'm able to locate it in /media/ and all six partitions are in the view. Trying to browse them yields every partition as empty, which is admittedly unsurprising. Running TestDisk to detect the partitions or data on the drive is currently yielding nothing but read errors for all 320GB of space on the disk and it finds no partitions. It's very confusing. What does it mean? Do I need professional help? I'll admit that I wouldn't be trying to dig the data out of here at all if not for the art I have that exists only on this drive. It's a lot of hard work to lose.
03-17-2014, 06:24 PM
Werner P. Schulz

Quote:

I genuinely can't figure out how to edit posts on this forum

Use double "new line" for new section.

You can use the "Go Advanced" button to have more abilities to format the posting; before sending your posting use "Preview" to see how it looks like.

If "noscript" (within Iceweasel/Firefox) is active for http://knoppix.net/forum/ disable it for this website; otherwise you cannot use the format abilities.

Below the editor area is the "Additional Options" area. With "Attachments => Manage Attachments" you can upload images and after this insert them in your posting.

Quote:

Do I need professional help?

I fear you need it, but it will be very expensive and nobody can give a guarantee to be successful.
03-18-2014, 07:10 PM
Smokey

Quote:

Originally Posted by Fegkari

So I don't think it worked. Ran ddrescue, 16 hours later not a single block of data was error free according to the readout. It came back with one error the size of the entire drive. I couldn't find anything on the new drive, checked with TestDisk anyway, the only partitions it recovered were deleted from the previous owner. TestDisk's wiki about rescuing data off of a failing drive mentioned dd but also warned to use caution with it. Is there anything else I could attempt or is that pretty much it. Since I've never had to do this before I'm incredibly paranoid I'll screw something up.

Actually, use dd...

It is very important (especially on a failing HDD) to create an image as soon as possible and work on that image.. First of all, depending on the problem, different tools will take different actions and there is a great chance that you will completely loose your data by working directly on the hdd..

So .. be sure your failing hdd is unmounted and run

Code:

dd if=/dev/sda of=/home/user/backup.img bs=512

where you should replace /dev/sda with your failing hard-disk... Be careful just not to point of= on a disk or on a partition.
It will take a while so be patient.. If it fails, like ddrescue did, try to append skip=1 (that means 512 * 1 bytes) or greater values (calculate the middle for example!?) to see if it's at least partially recoverable... If it's not, there isn't much you can do.. But don't do any direct disk recovery from it, specially if you intend to go to a professional later on..

If it works, you can then treat the image as an hdd (e.g. use fdisk on it).. Even mount partitions from it (http://stackoverflow.com/questions/1...ntains-a-parti)... And most of all, use TestDisk and/or PhotoRec on it.. :)