Cool it!
When you 've got a harddrive that 's starting to die on you (bad clusters, physical damage), it 's imperative that you "upset" the disk as little as possible. In most cases the cause of your dying disk is heat: hard drives can get very hot, especially when heavily used and poorly cooled. A good consideration is to make sure that your disks are placed freely floating so heat can get away easily. Also make sure that all of your fans in your computer blow in the same direction. A standard here is that fans in the front "inhale" air, while fans in the back of your computer "exhale". If you 're considering of placing a fan inside your computer directly on your disk, it 's best practice to let it blow away from the disk. This way you create a vacuum and no air anywhere, not even in the smallest wholes can sustain in a vacuum.Another good practice is to attach your disks firmly to the computer, so the iron from the chassis can guide away heat from the disk. But do this only by attaching the sides of the harddisks to the chassis.
Now, in case it 's already too late and your disk is dying, it might be that it works fine the first minutes and starts to make funny noises afterwards: probably the bearings have worn out or the platters start to bend and the heads are grating the surface of the disk.
Thing here is to hurry up and get those files off that disk.
One suggestion I might give here might sound weird, but it worked for me already in many cases:put the disk in the fridge for a while and then boot it up! Really, I 'm not kidding. But don 't freeze it, that will make it only worse. Put it in a normal refrigerator and let it cool down there. Also put a towel around it to avoid condensation.
Another possibility here is to connect your disk externally through a disk-to-USB cable that you can buy for 20$ or less at your local computershop. (or connect the disk to an IDE cable that hangs out of your PC like guts)
Now, should you have that, go and look for that winecooler pack you got for your birthday, you know, those plastic things you put around a bottle to keep it cool (or go and buy it at your local grocerie store). A gelpack to ease the mussles can also do the trick, but don 't get it out of the freezer where it 's minus 18° Celsius, that 's way too cold and might damage your disk even more. And always wrap a towel around your disk first.
Now, once this is in place, you will have a better timewindow to start recovering files.
What you can try, from good to bad to worst case scenario.
In the best case you 'r still able to mount the filesystem on the disk. Use mountallfs to search for all local filesystems.Make sure you have a location where you can copy your recovered files to. This can be another local disk or a remote network filesystem like a Windows share. How you should reach these safe haven is explained earlier in this document (Getting around with commands).
So let 's assume a few things:
-mountallfs manages to mount your filesystems on your dying disk
-you mount a remote network share: 'mount -o username=administrator,password=mypassword //10.0.0.5/c$ /mnt0'
-'cd /hda1' where hda1 is your dying disk
-do an 'ls' to see that you can still see files there.
-go to the directory from which you like to recover documents. Don 't start to try and copy all files, your time here is limited and it 's very likely that your disk is damaged on places where it has read and written many times. In the case of a Windows system, this is the WINDOWS system directory. Stay out of it, there are normally no documents there.
More likely you will do something like this: 'cd /hda1/Documents\ and\ Settings/John\ Doe/My\ Documents'
-If you don 't know how many documents you are going to save, do an 'ls -l'. If you see there are many subfolders, do an 'ls -lR' 'or du -h'. 'ls -lR' is the dos equivalent of a 'dir /s', but better is to do 'du -h'. This will tell you how much data there is in this folder, whether there are big files, small files, many files, etc...
-Once you know this, estimate what you have to rescue. Listen to what the disk has to say, if it starts making funny noises already, try to save important data first.
-Let 's say all is well, start a copy (first make a remote dir to save your files to):
'mkdir /mnt0/recovered'
'cp -rvf * /mnt0/recovered'
This command starts a copy of all files (*) to /mnt0/recovered, all subdirs (r), shows the progress file by file (v) and forces overwriting files on the remote location (f).
If this works out: good for you.
Otherwise...
If your disk starts to make funny noises and you see error messages like "Disk Seek Complete Error", this means we 're running into bad clusters and your copy operation will get slowed down dramatically.In this case, try to start copying files or folders more separately. Skip the files first on which it runs into errors. There are other means to (maybe) recover them later.
If that works out, but you still need the other files, let 's try someting else. I recommend you let the disk rest for a while by turning it off for about 20 minutes and put it in the fridge wrapped in a towel.
Once you 've started it up again, you might have another go at copying the bad files again, but cancel it as soon as you run into the same problems again.
In this case go over to using ddrescue.
Ddrescue takes an input file and copies it to an output file, just like a normal dd would do. But in this case there are a few differences: it tries to copy raw data from a file, but it will not try too long when running into bad, completely unreadable clusters; it will fill up the unreadable spaces with zeroes.
Example: 'ddrescue /hda1/Documents\ and\ Settings/John\ Doe/My\ Documents\outlook.pst /mnt0/recovered/outlook.pst'
You can see here that the rescue is file by file. Here 's a quick oneline to rescue a complete directory.
'cd /hda1/Documents\ and\ Settings/John\ Doe/My\ Documents\; for i in *; do ddrescue "$i" "/mnt0/recovered/$i; done"'
Another way of trying to rescue your data is to go and copy complete disks or partitions. Just so you can be able to use Windows' chkdsk later on the rescued filesystem, ddrescue the contents to another partition on another disk. It 's also possible to rescue the filesystem to a file and try to mount the file as a loopback device from Linux/TRK, but you won 't be able to let Windows access it.
So here goes an example (make sure nothing is mounted, neither source or destination): 'ddrescue /dev/hda1 /dev/hdb1'
In this case you will raw copy the complete contents of your partition /dev/hda1 to /dev/hdb1. Make sure /dev/hdb1 is equal or bigger dan /dev/hda1
Boot into Windows and let it run a chkdsk on it (or use the Windows install CD in recovery mode).
If your filesystem is native Linux, like an ext2 filesystem, you can rescue it to a normal file somewhere and run e2fsck on it like that.
Example: 'ddrescue /dev/hda1 /mnt0/rootfilesystem.img logfile-hda1'
If ddrescue was unable to rescue all of your hda1 because it had to skip certain sectors, try going into raw mode, which will bypass your kernel disk i/o layer and read sector per sector. In raw mode it 's way slower, but ddrescue keeps his already done work in a logfile and only does the sectors that were skipped.
Use it then like this:
'modprobe raw'
'raw /dev/raw/raw1 /dev/hda1'
'ddrescue -r3 /dev/raw/raw1 /mnt0/recovered-hda1.img logfile-hda1'
Once you got this back, restore the image to another disk that boots into a normal PC into Windows and try running chkdsk against it.
If it was a Linux filesystem (ext2 f.e.), there 's no need to restore it:
'e2fsck -v -f /mnt0/ rootfilesystem.img'
'mount -o loop /mnt0/rootfilesystem.img /mnt1'
<= check your files...
NOTE: it is not recommended to try and perform a filesystem check that starts having physical I/O errors. It will probably make things even more unrecoverable.