1

A student gave me a hard drive that he says no longer works. I told him I'd at least take a look at it, since I run Ubuntu 13.10 on my desk computer. I didn't make any promises, but I'd very much like to help this student recover his data.

sudo fdisk -l shows:

Disk /dev/sdf: 250.1 GB, 250059350016 bytes`
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xa6c460d8

Device Boot      Start         End      Blocks   Id  System
/dev/sdf1   *        2048      409599      203776    7  HPFS/NTFS/exFAT
/dev/sdf2          409600   448610303   224100352    7  HPFS/NTFS/exFAT
/dev/sdf3       448610304   488183807    19786752    7  HPFS/NTFS/exFAT
/dev/sdf4       488183808   488395119      105656    c  W95 FAT32 (LBA)`

/dev/sdf2 is the partition I'm hoping to recover! So I'll run ntfsfix to tackle any issues.

Unfortunately, sudo ntfsfix /dev/sdf2 results in:

stead@ws-stead:/media/usb$ sudo ntfsfix /dev/sdf2
Mounting volume... $MFTMirr does not match $MFT (record 3).
FAILED
Attempting to correct errors... 
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... FAILED
Correcting differences in $MFTMirr record 3...OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Failed to sync device /dev/sdf2: Input/output error
Error opening '/dev/sdf2': No such device or address
Remount failed: No such device or address

I've been googling this error for a little bit - both the "Failed to sync" error and "Remount Failed", to no avail. Looking at the output, "No such device or address" leads me to believe that the device is disconnecting and reconnecting or shorting out in some way. fdisk -l again returns the same table for this device as listed above.

Is there another tool I should be using for a next step from here? Does this look like physical device damage and I should throw in the towel?

Here's some nasty notices in the syslog:

Oct 21 10:54:43 ws-stead kernel: [250925.728715] end_request: critical target error, dev sdf, sector 2936
Oct 21 10:54:43 ws-stead kernel: [250925.728721] Buffer I/O error on device sdf1, logical block 111

Thanks! I'd be happy to provide any more information or clarify anything!

Improve this question
7
  • Assuming that professional recovery services are out of discussion, the first thing you should have done was to create an image of the disk if possible then play around with various destructive methods.
    – Cristian Ciupitu
    Oct 21, 2013 at 18:35
  • 1
    just out of curiosity, have you checked the smart stats on the disk to determine if it is mechanically healthy? if not, image it before proceeding. also ntfsfix is a handy tool, but its no replacement for windows chkdsk. have you considered putting it in a windows box and running 'chkdsk -r' to check for and mark bad blocks on the disk?
    – Frank Thomas
    Oct 21, 2013 at 18:36
  • Thanks Frank! It's a laptop hard drive, and I don't have the necessary adapters to get it connected up to any of my Windows Desktops. The user reported that Windows repeatedly suggests to format the drive on his laptop every time it's plugged in. I'll see if chkdsk is available at that stage.
    – SteadH
    Oct 21, 2013 at 18:38
  • 1
    Oh... SMART reports back: Read Device Identity failed: scsi error medium or hardware error (serious). I'm guessing I have a physically sad drive.
    – SteadH
    Oct 21, 2013 at 18:56
  • then I would recommend you use ddrescue to attempt to take an image of the partition you want to recover. if you can get a decent image, you can probably recover most of the partition, if the bad blocks aren't in the filesystem meta tables themselves, though some files will likely be damaged.
    – Frank Thomas
    Oct 21, 2013 at 19:28

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.