I had a very bad thing happen to my regular work PC last week.Â Â I use a Windows PC for my normal desktop machine, and when I turned it on one morning is refused to boot up.Â Â After several attempts, it became obvious that the hard drive was dying and wouldn’t last much longer.Â Â I have most of my irreplaceable files backed up to Amazon S3 via JungleDisk, but it is still a huge pain to try and reinstall an operating system, all of my applications, and try to get back to a working system
Fortunately, at a recent CALUG meeting, we had Barry Grundy give a presentation on Data Recovery.Â Â Barry is the author of LinuxLEO – a pretty comprehensive document about Data ForensicsÂ using open-source tools.Â In his presentation he covered a number of open-source tools that are super-useful for recovering raw data and then in making sense of it.Â Â Â The main tool that I found useful was GNU ddrescue which is a variant of dd specifically created to retrieve as much data as possible from a failing drive.’
ddrescue works by reading data from the drive.Â When it encounters a bad sector it skips forward a ways and tries to read again.Â Â If it is unsuccessful, it skips forward a larger amount and continues until it is able to read something successfully.Â That process repeats until it has gone through the whole drive.Â Â Â This retrieves as much good data from the drive as possible.Â Â You can then run it again with some different parameters to go back and retry those error areas to retrieve all of the questionable areas.
The drive that I had failing was a 160 GB SATA drive that was over 4 years old. Â The first round with ddrescue looked pretty bad – it had around 25% of the drive was bad or questionable.Â After some experimenting to figure out the ideal parameters and a few passes through the entire drive I ended up recovering my entire drive minus just 110kb of bad sectors.
At that point I had almost all of my data, but I wasn’t able to boot off of the drive.Â There were some problems with the master boot record and the NTFS volume was corrupt and wouldn’t mount cleanly.Â I ended up attaching the drive to a working machine so that I could run chkdsk on it which solved the NTFS corruption problems.Â Â I had to work around quite a few problems, but eventually was able to restore it to a point where I was able to boot just fine.