[NTLUG:Discuss] HDD recovery

[agoats at compuserve.com]

I've had to do disk recoveries on some of my computers at home. ddrescue 
has been of great help, and has even helped with recovering damaged CD's 
and DVD's. NOTE: you have to do all of this at root privilege level

With Slackware, I've been able to use cp and copy one drive to the next 
as long as the second drive is equal or larger than the drive being copied:

cp /dev/sdb  /dev/sdc   (assuming drive sdb is the failing drive and sdc 
is the new drive). By not using any partitions, it starts at head zero, 
cylinder zero and starts streaming to the new drive. This copies the low 
level boot strap, the partition record, the MBR and any other data to 
the new drive. This method can crash before the disk is copied if the 
bad drive is really that bad.

ddrescue /dev/sdb /dev/sdc will do the same, but will continue to break 
the bad parts down until it is able to copy all of the data over or fail 
after a given number of trials. It will copy everything possible, even 
if the drive is truly bad; you just lose data in the bad spots. The only 
time this didn't work completely, the drive died totally and became a 
brick (I'm thinking of making a clock from it's remains....).

Skipping the partition number means you copy the entire drive from start 
to finish and capture ALL partitions. Doing cp  /dev/sdb1 /dev/sdc  will 
only copy the first partition to the the new drive and will skip the 
partition information with partition format, boot records, etc. The 
second drive is typically not usable for most operating systems.

Either method is independent of the operating system on the disk, be it 
DOS, Windows95, 98, Vista, XP, 7, CP/M, Solaris, MacOS, or what ever 
else. It's copying the raw data from drive to drive.

If the bad drive is small enough and there is a drive with enough space, 
you can copy the drive to a raw  image (iso extension is nice):

cp /dev/sdb  FailingDrive.iso

or

ddrescue /dev/sdb FailingDrive.iso

The iso file can then be used however you need.

Check all of the options for ddrescue to see what other items might be 
helpful. On one damaged drive, I wanted everything from a multipartioned 
500G drive with mixed operating systems and formats. I set ddrescue to 
try forever and got down to 5 files that were not recoverable. Also, it 
took 5 days to copy.... ;D  (think DOS 6.22, Windows98, ext2, rfs and 
ext3 on the same drive).

Once you get the drive copied over, be sure to run a check disk of 
whatever sort is required for the OS and partition format. This will 
help recover errors (typically CRC correction data).

KEEP IN MIND: Doing this method means the hard drive will lie to you! A 
320G to 500G move will make the 500G look like a 320G to all operating 
systems! Use whatever disk copying software you want and copy to a third 
drive with the third drive configured correctly. Once copied and 
verified, take the 500G pretending to be a 320G and use Linux fdisk to 
set things correctly (mostly delete all of the partitions and start 
over). Worst case, use hdparm to force it back to factory settings. I'm 
not sure if the drive manufacturer's OEM software will fix this or not, 
I've only had to use fdisk so far.

Alvin




On 10/15/2015 07:29 PM, Eric Schnoebelen wrote:
> Fred writes:
> - I friend has a Vista system with an error message about imminent
> - hdd failure, probably from S.M.A.R.T. He is obviously upset because
> - of no backups (ever) and about a gig of total usage (os + data).
> -
> - I can bring his hdd here and dd his old 320G drive to a new 500G
> - but having never actually having cloned a drive to a larger one,
> - I have a few questions:
>
> - 1) dd if=/dev/sdX of=/dev/sdY is the basic cmd but how do I decide
> -     what bs to use? What about other options?
>
> You want to use a multiple of the largest sector size of the
> between the two devices.  These days, 4k is a good, safe
> starting point.  Of course, you can specify a small block size
> for the failing disk, and a larger block size for the target
> disk to minimize any possible loss to to failed sectors.
>
> - 2) Will this clone the disk including the MBR? My guess is yes...
>
> Yes.
>
> - 3) What to do after the dd cmd? How to make the remaining 180G (or
> -     so) available?  If parted will do it, how?
>
> I know NetBSD's fdisk will do it automatically, so I can't
> imagine that reading the MBR into parted, and then writing it
> back out wouldn't do the same.
>
>
> You might want to look at g4u (aka ghost for unix) as a tool to
> handle all of the ugly stuff for you..  It works on local disk,
> or over the network.  (http://www.feyrer.de/g4u/)
>
> --
> Eric Schnoebelen		eric at cirr.com		http://www.cirr.com
>    There are two ways of constructing a software design: one way is to make
>    it so simple that there are obviously no deficiencies, and the other is
>    to make it so complicated there are no obvious deficiencies - CAR Hoare
>
> _______________________________________________
> http://www.ntlug.org/mailman/listinfo/discuss
>