0

The hard drive in my old laptop started returning errors, so I stopped using it (probably a bit too late). It's in an external cradle now, that I've mounted read-only a couple of times. Unfortunately I don't think I have the disk capacity lying around to image the whole drive, so for now I just have an image of the first 2 GiB.

The first 160 or so MiB of the hard drive are unreadable (bad sectors), so the MBR and partition table are gone. Readable data is present after that point though. I may have some notes regarding my partition table somewhere, but they probably don't contain sector counts.

I have backups of the most important things, but there are still a lot of things on that drive that would be inconvenient to lose permanently. I have since gotten myself a better backup system involving tarsnap.

The disk should contain several ext3 filesystems, along with possibly an ext2 (/boot) and NTFS (vestigial windows).

What would be a good approach here? Piecewise dd-rescue and searching for magic numbers to find the start of partitions?

1

The first rule of datarecovery is to create a copy. Buy a separate drive for this. You will probably be updating the copy. Because the drive itself is dead, you will need to work on the copy.

Note that the deeper you go, the more work has to be done and the more you learn about files and filesystems.

First, use ddrescue to create a copy.

Next step would be testdisk. If you're lucky, it may recover your filesystem. Testdisk may even be able to restore parts of your partition table.

My third step is usually PhotoRec. I have good experiences with this for images and videos. Some report that it works good for other filetypes as well and I've seen other files recovered.

Then, foremost or scalpel.

And, if everything else fails and you're looking for ascii-text, you may resort to strings

1
  • There is more than one filesystem on the disk. I don't about the first filesystem, but I see no reason the later filesystems could not be recovered whole. Your post contains some useful tools though. – AI0867 Oct 23 '20 at 17:04
0

Truly at this point the disk is very likely not recoverable by software tools. So for the computer replace it and reinstall the operating system.

For your damaged drive, contact a local drive recovery agency and see if they will refund, or not charge for, work done that does not yield positive results.

My experience with drive failing like this is that the drive went terminally broken.

You can try software recovery tools (Recuva and others) but the drive does appear to be inaccessible.

2
  • I'm not seeking to recover the drive or ever use it again. I just want whatever recoverable data is still on it. – AI0867 Oct 23 '20 at 15:55
  • A local agency can also recover files which is why I mention this approach. You can try software tools but the drive looks to be inaccessible. – John Oct 23 '20 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.