From owner-freebsd-questions@freebsd.org Sat Oct 14 19:50:06 2017 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5D091E2B205 for ; Sat, 14 Oct 2017 19:50:06 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mailrelay13.qsc.de (mailrelay13.qsc.de [212.99.187.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.antispameurope.com", Issuer "TeleSec ServerPass DE-2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id CD2617E6E2 for ; Sat, 14 Oct 2017 19:50:05 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mx01.qsc.de ([213.148.129.14]) by mailrelay13.qsc.de; Sat, 14 Oct 2017 21:49:29 +0200 Received: from r56.edvax.de (port-92-195-74-193.dynamic.qsc.de [92.195.74.193]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx01.qsc.de (Postfix) with ESMTPS id 9936F3CBF9; Sat, 14 Oct 2017 21:49:31 +0200 (CEST) Received: from r56.edvax.de (localhost [127.0.0.1]) by r56.edvax.de (8.14.5/8.14.5) with SMTP id v9EJnQNr003036; Sat, 14 Oct 2017 21:49:26 +0200 (CEST) (envelope-from freebsd@edvax.de) Date: Sat, 14 Oct 2017 21:49:26 +0200 From: Polytropon To: Ernie Luzar Cc: FreeBSD Subject: Re: How to recover data from dead hard drive. Message-Id: <20171014214926.2fed03aa.freebsd@edvax.de> In-Reply-To: <59E21214.4020509@gmail.com> References: <59DBA387.4050108@gmail.com> <20171009191435.145c9dd2.freebsd@edvax.de> <72772933-C642-43DB-AFD6-6B5D40EEF39E@fjl.co.uk> <59E21214.4020509@gmail.com> Reply-To: Polytropon Organization: EDVAX X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-cloud-security-sender: freebsd@edvax.de X-cloud-security-recipient: freebsd-questions@freebsd.org X-cloud-security-Virusscan: CLEAN X-cloud-security-disclaimer: This E-Mail was scanned by E-Mailservice on mailrelay13.qsc.de with D3A8768345F X-cloud-security-connect: mx01.qsc.de[213.148.129.14], TLS=1, IP=213.148.129.14 X-cloud-security: scantime:.1557 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Oct 2017 19:50:06 -0000 On Sat, 14 Oct 2017 09:33:08 -0400, Ernie Luzar wrote: > I friend of mine went through a devoice a few years back. He did not get > his personal xp pc in the settlement, only the hard drive which makes > a squealing noise when running. He tried to install it into his dell > desktop. But not being a computer geek he know nothing about > master/slave on the ribbon or the jumpers on the H.D. Have no idea what > damage he may have caused doing this. Usually none, except he did something forcedly with the power connector (Molex plug). Using a wrong master / slave configuration with (parallel) ATA drives usually results in no reaction of the drive, i. e., none of the connected drives is being recognized. Putting the 40 pin cable wrong may cause the drive to not spin up. > He told me it was dead and he wanted his data recovered. "My grandfather is dead, but I want him to answer my questions." :-) Of course the expectation to get data from "dead drives" is not fully wrong, but it's not something you do as a side project, in 10 minutes... > I used a ata to usb adapter and connected it my win10 lap top [...] Don't do that. Connecting a drive intended to be recovered to a "Windows" PC may destroy the last remains of your data if you aren't careful (and even if you are, it can still happen). Use a machine with as few automatisms and as much control of your own as possible. Unsurprisingly, "Windows" does not fulfill this requirement. > [...] and was > surprised when it spin right up and indeed it was noisy. At least it runs. Again, this _could_ damage data, but if the drive runs, you have a good chance to acquire an image (if the basic read operation of the drive does still work). > Win 10 > automatically ran disk scan on it and fixed the damaged index. And this kind of automatisms could - given a specific situation you cannot imagine or exclude - damage your data. Avoid any write access to the drive, not "repair", no "fixed", it could go wrong and you have "successfully" destroyed what could have been recovered. > I had to > muck around a bit to copy off 12gb which was everything but 2 router > manuals in pdf format. Luckily! So there probably just was some MFT damage (common on NTFS-formatted drives) that could be repaired, and no data was overwritten. Data loss is common on NTFS when a few filesystem inconsistencies appear (can be damaged files, files disappearing, and so on). The simple kind of errors can be repaired by "Windows" and usually result in only a minor data loss - hopefully it didn't affect the data you're most interested in... > In my book that is a successfully data recovery. Definitely. You were just lucky that you didn't shoot your foot with this careless approach. :-) > Never needed to use freebsd to recover data. I've been using FreeBSD data recovery tools for many years now, including for my own purposes and for clients. It could recover things that "professional software" (read: cheap as well as expensive crap for "Windows") couldn't even detect. There are great tools - depending on what went wrong - to recover data from hard disks, USB sticks, SD cards, or optical media. Some of them are filesystem-agnostic, and others are filesystem- specific. You have to know about the problem in order to choose the correct tool. If you don't know, first make an 1:1 copy and work with the image. In this case, if you've accidentally done something wrong, reset the image (for example with a 2nd copy of it) and try something different. However, there are programs like Spinrite or UFS Explorer which can be really helpful, even in their trial versions. You don't need a "Windows" license to run them, as wine is fully sufficient for that. > The lesson here is try the simple recover stuff first, especially if > it's a Microsoft drive. The lesson is to never trust a system that you do not control. The lesson also is not to bet on pure luck. ;-) -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...