Date: Mon, 18 Sep 2017 01:17:47 +0200 From: Polytropon <freebsd@edvax.de> To: Shamim Shahriar <shamim.shahriar@gmail.com> Cc: Ralf Mardorf via freebsd-questions <freebsd-questions@freebsd.org> Subject: Re: Recovering data from a broken HDD Message-ID: <20170918011747.519b488a.freebsd@edvax.de> In-Reply-To: <b1f1a0bd-bb03-3301-af92-ad17a1292614@gmail.com> References: <b1f1a0bd-bb03-3301-af92-ad17a1292614@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 17 Sep 2017 23:39:20 +0100, Shamim Shahriar wrote: > Good evening all, hope everyone is well. > > a little background: > I have a couple of portable HDD. One of them was dropped a few weeks > back, and then the computer stopped recognising it and asked it to be > formatted. Probably "Windows" asked for this - sometimes suggests to "repair" a disk, often with the result of causing much more damage. :-) > Once formatted, it appeared to start working again -- even > though all previous data had been lost, and no, I am not trusting that > device to hold any important data. Just because the file system on the disk has been initialized, it does not neccessarily imply that the actual data has been lost (read: overwritten or zeroed). Forensic tools often can still get most of the data of a formatted disk. > Last week, another HDD slipped through the hands (literally). This one > too is showing the same/similar symptoms as the previous one. I believe > that the data is still there, but somehow the alignment has shifted and > hence the HDD controller is unable to provide the data. I am wondering, > can anyone please suggest a data recovery programme that I can try on > the drive? The HDD being not in the western/relatively-more-techy region > cannot be sent to a data recovery company (and I have been told they > cost you a fortune), but have access to m$ or Mac or Linux or BSD > systems. So if anyone could please suggest something to try on (Yes, I > had been on google, and found a huge amount of tools -- but I would much > rather try out something that someone has already tried and can give > some insight on). I suggest you first create an 1:1 image from the disk using dd, or in case of errors, dd_rescue. Then continue working with the image only. UNDER NO CIRCUMSTANCES write to the disk, as this will usually make things more complicated. There are several tools for data recovery. Which tool to use depends on several factors, such as what has actually happened to the disk's content, and what you want to rescue from it (and how). Those factors also include the kind of file system on the disk (FAT, UFS, HPFS, ...) and the kind of slicing and partitioning (none, MBR, GPT), as well as the intended target (reconstruct file system, just get data, get data with file names and directory hierarchy, ...). There is no "one size fits all" kind of egg-laying woolmilksow tool. ;-) In case there is just a partition misalignment, consider using the "recoverdisk" tool, provided natively by FreeBSD. Allow me to repeat my "famous list of recovery tools" that I post on this mailing list from time to time. System: dd fsck_ffs clri fsdb fetch -rR <device> recoverdisk <- as suggested Ports: ddrescue dd_rescue ffs2recov magicrescue testdisk The Sleuth Kit: fls dls ils autopsy scan_ffs recoverjpeg foremost photorec fatback Proprietary (free test version for diagnostics): SysDev Laboratories LLC "UFS Explorer" Most tools require you to know what you're doing, so learning how to use those tools appears to be mandatory. As I said, work with (a copy of) the copy of the disk if possible, so in worst case you can start from the beginning without feeling guilty that you did something wrong. ;-) Good luck! -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20170918011747.519b488a.freebsd>