0

In short. I have problems with accessing files on my hard drive. I also assume that it is not a hardware problem (it is more on the "software level"). I would like to know if there are ways (Linux commands, Linux tools) that can help to monitor the hard drive and to detect the problem. Here is a more detailed description of what happened.

I have a Verbatim hard drive with a lot of files. Today I have tried to use it under Ubuntu. In the file browser I saw the Verbatim folder and tried to open it. As a result I saw a clock indicating that the process runs and needs more time. I weighted for one minutes or so, saw the same picture (still running, the folder is not opened) and tried to do the same in terminal. I used cd to enter the Verbatim folder, then being in the folder I execute ls -ltr. As a result I got nothing. I tried to cancel the command by Ctrl C, it did not work, so I just closed the terminal. Then on the panel I tried to eject or unmount the device (I do not remember how it is called) and the Ubuntu wrote me that device is busy executing ls (or something like that) command. I disconnected the device anyway.

Then I tried to access the files on the hard drive using another computer that runs under Windows. The windows recognized the device but told me that an error is detected and it is recommended to make a scan (however, there was still an option to show the files without a scan). I have chosen to make a scan. It took too long without showing any progress and I have canceled the scan.

Then I have disconnected the device and inserted again. There was still the option to scan. The scan could be performed with two options: (1) detect errors and correct it automatically and (2) detect missing files and try to restore them. The first option was checked by default (the previous (canceled) scan I run in this way). This time I checked also the second option (so the both options have been checked) and started the scan again. Again it was too slow without showing any progress so I canceled it again.

Then I started the scan with the first option checked (find errors and correct them automatically) and gave it enough time. After about 20-30 minutes it was ready. As a result I got a message that some of the folders could not be reached and have been removed permanently. After that I was able to use the devise (enter folders and sub-folders and see the files).

Then I tried the device under Ubuntu again. It took about one minute for Ubuntu to recognize the device (it is too long). Then I had the same problem (I could not see the folders located on the hard drive). It means that I see the hard drive folder, I can go into this folder but I was unable to see what files are there.

Then I have connected the device to the Windows machine and it was unable to recognize the device (it does not see it at all). I suppose that on the Ubuntu I made unmount (or something like that) and in this was I have blocked the hard drive (so that it is not seen by the Windows machine). However, I am not sure about this assumption. Probably the device is somehow broken.

Could somebody please help me with that because on the device I have all my family photos for the last 7 years.

11
  • 1
    Why were you messing around with the drive so much if it contained the only copies of your precious photos? Now the only option left to you might be to try various data recovery tools, such as PhotoRec for example.
    – Karan
    May 4, 2015 at 7:36
  • @Karan, what do you mean by "messing around"? I just tried to access the files on the hard drive + when Windows proposed to make a scan because there is an error, I just accepted it. Probably the bad thing that I made is to cancel the processes before they were finished. But I did not know how log they will take (another 10 minutes, another 10 years or forever).
    – Roman
    May 4, 2015 at 7:39
  • 4
    Half your trouble seems to have been caused by impatience, the other half by not having a backup. Recuver or PhotoRec may be your best chances now.
    – Tetsujin
    May 4, 2015 at 8:07
  • 1
    The first step is you need to take the hdd out of your computer, purchase an external enclosure, and basically replace the hdd. The next step is to accept recovery of you files might not be passible. once you have a bootable system you can begin the process of file recovery. The more data you write to it the chances of file recovery will disappear entirely.
    – Ramhound
    May 4, 2015 at 11:02
  • 1
    I think it's hardware problem. Bad sector or loose cable. Check your drive status using a tool like gnome-disks which is availabile in ubuntu. a.k.a disks
    – totti
    May 6, 2015 at 12:08

4 Answers 4

1
+250

Firstly you should ascertain the type of filesystem used on that drive. It is most likely FAT32. You can do this by using the fdisk command:

fdisk -l

This will return a list of devices and in each line there will be a "Type" which will reveal the filesystem:

Device     Boot     Start       End   Sectors   Size Id Type
/dev/sda1  *         2048 219353087 219351040 104.6G 83 Linux
/dev/sda2       219355134 234440703  15085570   7.2G  5 Extended
/dev/sda5       219355136 234440703  15085568   7.2G 82 Linux swap / Solaris

If you have another drive available that is equal to or larger than the failing drive the easiest way to attempt a recover in my experience is to use a tool called dd-rescue. More information can be found here: dd-rescue

You can also manually use dd to make an image of the entire drive into a file. If the hard drive is large this may take a very long time. You would also need to be sure that you had enough disc space on whichever disc you plan to create the backup image and also be sure that the filesytem in use supports files large enough to contain the size of the entire drive.

Here is an example of how you might accomplish this manually:

dd bs=4k if=/dev/sda of=/path/to/backup.img conv=noerror,sync 

In the above command /dev/sda is the damaged disc and backup.img is the file that will contain the contents of the entire disc as a backup. More information on this command can be found here:

recover-data-from-a-dead-hard-drive-using-dd

It may be better to use a smaller block-size argument so that you risk losing less data when errors are encountered. e.g. "bs=1024" however this will cause the operation to take even longer.

It is very difficult to determine if a hard drive is actually failing unless your hard drive has features like SMART enabled. It is possible that your disc is not failing and that your problem is due to file-system corruption.

Unfortunately I do not know of a good way to realistically determine how damaged a hard disc is other than features like SMART which is usually controlled by the BIOS.

Once you have determined the type of filesystem you are using on that disc you can attempt to repair the filesystem as you did before on Windows in Linux using the fsck command: (make sure you are using the fsck that matches your specific filesystem type.

fsck.vfat /dev/sdb1

It should be noted that Linux is not always good at repairing ntfs or fat partitions and so this should not be attempted until you have verified your backup. In fact I would recommend that you perform the attempted repair on the backup image instead. Instructions for performing an fsck on a backup file can be found here: mounting-a-raw-partition-file-made-with-dd

Depending on how the filesystem was mounted the ls command could indeed corrupt the filesystem if it is changing file, or directory meta-data; specifically by updating access time. Unplugging the drive while it is writing anything will cause errors in the filesystem, especially in filesystems that do not have good journaling features (such as FAT32) These errors can normally be corrected with fsck.

I am very sorry that you are in such a precarious position and I hope that you are able to recover these files.

2
  • ddrescue is usually a better choice than dd for marginal source media. It will do a single pass to recover as much as possible from the source, then once that's done will keep retrying failed reads until the source drive either gives up completely or everything has been copied.
    – user
    May 8, 2015 at 13:36
  • ddrescue is pretty amazing, I think buying another drive then attempting recovery with ddrescue is probably what I would do in this situation. Also he might consider setting up a RAID6 SAN box for family photos in the future, that's what I do. May 8, 2015 at 19:02
1

Go back to your Linux system.

Open a root terminal, and type tail -f /var/log/kern.log, maximize this window.

Connect your hard drive.

If you have a hardware issue with the drive, it will show up here. If it's a problem with the USB connection, you'll get messages saying "Unable to enumerate device" or similar. If there is a media problem with the drive, you'll get messages about bad blocks.

If you have a USB connection error, there may be an issue with the USB cable, connector, or USB-to-SATA adapter that's in the hard drive enclosure (broken pins, connector falling off board, etc.)

Assuming your model of external hard drive does not have encryption features on the USB board, you can remove the drive from the enclosure, directly attach it to a PC, and work with it as any internal drive. If it does have encryption - you really need to get that board working, and should try to get with someone good with electronics/soldering to replace the USB connector or solder a cable directly to the pads on the board (which hopefully are not ripped off). The hard drive will still work on another system, but you won't be able to get your data.

Example of the USB board that would be inside of the enclosure:

enter image description here

Once you have eliminated any hardware issue, you can try to run Testdisk to see what it can recover. You can install this from apt-get on a root terminal under Ubuntu, or download and run the Windows version. Have another drive ready to copy files, and backup your data next time.

Good luck.

4
  • What is kern.log? Is that an Ubuntu-specific log? It's not on other Linux distros.
    – snapshoe
    May 10, 2015 at 22:19
  • 1
    @snapshoe I believe kern.log is only present in systems not using a journal-based log system (syslog). It's essentially the output of dmesg. Semi-source
    – int_541
    May 13, 2015 at 4:50
  • This is what I get for using Debian, lol.
    – LawrenceC
    May 13, 2015 at 12:21
  • I run Arch, which has jounal-based logs, and I don't have a kern.log. There is a kernel.log.
    – snapshoe
    May 13, 2015 at 13:14
0

There is no way to repair a failing hard drive without the risk of losing files. Depending on how much the data on the drive is worth to you a professional data recovery service may be your best option. I believe that these services start at around $500 and go up, sometimes dramatically depending on how much effort it takes to recover data. Even the best data recovery service may not be able to recover all of your data but they have a much better chance at it than anything you could do on your own.

I would recommend you explore Seagate Recovery Services for more information.

I am sure this is not what you want to hear, but professional data recovery can open up the drive and preform other procedures that simply are not possible to do on your own. Data recovery takes expertise, specialized software and tools, hard drive parts and must be done in a clean room. It is not possible to do at home.

0

Have you tried to do a full disk check with Windows manually?

If you open a cmd and enter chkdsk /?, it comes up with all possible options.

For an NTFS partition, you can do chkdsk /F /R /B /X, which does the most complete checking. For FAT32, leave out /B.

Be aware that this takes a lot of time depending on your hard drive. But it could be a possibility to rescue some data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .