Cool it!
When you have a harddrive that is starting to die on you (bad clusters, physical damage), it is imperative that you “upset” the disk as little as possible. In most cases the cause of your dieing disk is heat: hard drives can get very hot, especially when heavily used and poorly cooled. A good consideration is to make sure that your disks are placed freely floating so heat can get away easily. Also make sure that all of your fans in your computer blow in the same direction. A standard here is that fans in the front “inhale” air, while fans in the back of your computer “exhale”. If you are considering placing a fan inside your computer directly on your disk, it is best practice to let it blow away from the disk. This way you create a vacuum and no air anywhere, not even in the smallest holes, can sustain in a vacuum.
Another good practice is to attach your disks firmly to the computer, so the iron from the chassis can guide away heat from the disk. Note: Do this only by attaching the sides of the harddisks to the chassis.
Now, in case it is already too late and your disk is dieing, it may be that it works fine initially and then starts to make funny noises afterwards: probably the bearings have worn out or the platters are starting to distort and the heads are grating on the surface of the disk.
The most important thing here is to hurry up and get those files off that disk.
One suggestion I might give here might sound weird, but it worked for me already in many cases:
put the disk in the fridge for a while and then boot it up! Really, I’m not kidding. However, don’t freeze it, that will only make it worse. Put it in a normal refrigerator and let it cool down in there. Also put a towel around it to avoid condensation.
Another possibility here is to connect your disk externally through a disk-to-USB cable that you can buy for 20$ or less at your local computer shop. (or connect the disk to an IDE cable that hangs out of your PC like guts)
Now, should you have that, go and look for that wine cooler pack you got for your birthday, you know, those plastic things you put around a bottle to keep it cool (or go and buy it at your local grocery store). A gelpack to ease the muscles can also do the trick, but don’t get it out of the freezer where it’s minus 18° Celsius, that is far too cold and might damage your disk even more. Always wrap a towel around your disk first.
Now, once this is in place, you will have a better time window to start recovering files.
What you can try, from good to bad to worst case scenario.
In the best case you will be still able to mount the filesystem on the disk. Use mountallfs to search for all local filesystems.
Make sure you have a location to which you can copy your recovered files. This can be another local disk or a remote network filesystem such as a Windows share. How you should reach this safe haven is explained earlier in this document (Getting around with commands).
So let’s assume a few things:
-mountallfs manages to mount your filesystems on your dieing disk
-you mount a remote network share:
‘mount -o username=administrator,password=mypassword //10.0.0.5/c$ /mnt0’
-‘cd /hda1’ where hda1 is your dieing disk
-do an ‘ls’ to see that you can still see files there.
-go to the directory from which you would like to recover documents. Don’t start to try and copy all files, your time here is limited and it is very likely that your disk is damaged in places where it has read and written many times. In the case of a Windows system, this is the WINDOWS system directory. Stay out of it, there are normally no documents there.
More likely you will do something like this:
‘cd /hda1/Documents and Settings/John Doe/My Documents’
-If you don’t know how many documents you are going to save, do an ‘ls -l’. If you see there are many subfolders, do an ‘ls -lR’ or ‘du -h’. ‘ls -lR’ is the equivalent of a dos ‘dir /s’, but it is better to do ‘du -h’. This will tell you how much data there is in this folder, whether there are big files, small files, many files, etc…
-Once you know this, estimate what you have to rescue. Listen to what the disk has to say, if it starts making funny noises already, try to save important data first.
-Let’s say all is well, start a copy (first make a remote dir to save your files to):
‘mkdir /mnt0/recovered’
‘cp -rvf * /mnt0/recovered’
This command starts a copy of all files (*) to /mnt0/recovered, all subdirs (r), shows the progress file by file (v) and forces overwriting files on the remote location (f).
If this works out: good for you.
Otherwise…
If your disk starts to make funny noises and you see error messages such as
“Disk Seek Complete Error”, this means we are running into bad clusters and your copy operation will probably slow down dramatically.
In this case, try to start copying files or folders more separately. Skip the files first on which it runs into errors. There are other means to (maybe) recover them later.
If that works out, but you still need the other files, let’s try something else.
I recommend you let the disk rest for a while by turning it off for about 20 minutes and put it in the fridge wrapped in a towel.
Once you’ve started it up again, you might have another go at copying the bad files again, but cancel it as soon as you run into the same problems again.
In this case go over to using ddrescue.
ddrescue takes an input file and copies it to an output file, just as a normal dd would do. In this case, however, there are a few differences: it tries to copy raw data from a file, but it will not try for too long when it runs into bad, completely unreadable clusters; it will fill up the unreadable spaces with zeroes.
Example: ‘ddrescue /hda1/Documents and Settings/John Doe/My Documentsoutlook.pst /mnt0/recovered/outlook.pst’
You can see here that the rescue is file by file. Here is a quick oneliner to rescue a complete directory.
‘cd /hda1/Documents and Settings/John Doe/My Documents; for i in *; do ddrescue “$i” “/mnt0/recovered/$i; done”‘
Another way of trying to rescue your data is to go and copy complete disks or partitions. Just so you can be able to use Windows’ chkdsk later on the rescued filesystem, ddrescue the contents to another partition on another disk. It is also possible to rescue the filesystem to a file and try to mount the file as a loopback device from Linux/TRK, but you won’t be able to let Windows access it.
So here goes an example (make sure nothing is mounted, neither source nor destination): ‘ddrescue /dev/hda1 /dev/hdb1’
In this case you will raw copy the complete contents of your partition /dev/hda1 to /dev/hdb1. Make sure /dev/hdb1 is equal or bigger than /dev/hda1
Boot into Windows and let it run a chkdsk on it (or use the Windows install CD in recovery mode).
If your filesystem is native Linux, such as an ext2 filesystem, you can rescue it to a normal file somewhere and run e2fsck on it like that.
Example: ‘ddrescue /dev/hda1 /mnt0/rootfilesystem.img logfile-hda1’
If ddrescue was unable to rescue all of your hda1 because it had to skip certain sectors, try going into raw mode, which will bypass your kernel disk i/o layer and read sector per sector. In raw mode it is much slower, but ddrescue keeps its already completed work in a logfile and only does the sectors that were skipped.
Use it then like this:
‘modprobe raw’
‘raw /dev/raw/raw1 /dev/hda1’
‘ddrescue -r3 /dev/raw/raw1 /mnt0/recovered-hda1.img logfile-hda1’
Once you have this, restore the image to another disk that boots into a normal PC into Windows and try running chkdsk against it.
If it was a Linux filesystem (ext2 for example), there is no need to restore it:
‘e2fsck -v -f /mnt0/ rootfilesystem.img’
‘mount -o loop /mnt0/rootfilesystem.img /mnt1’
<= check your files…
NOTE: it is not recommended to try and perform a filesystem check that starts having physical I/O errors. It will probably make things even more unrecoverable.