[ale] Fwd: Hard Drive Death Spiral -- AKA Recovery Software?

[Greg Freemyer]

The first thing you need / want to do is make a full copy (image) of the drive.

So, buy a drive that is atleast 20% bigger.  (just to be sure).

Format it ext2 or some other basic FS.  (Definitely not FAT).

If the drive is more or less functional use dd to make the image.  If
not, look into dd_rescue (or ddrescue, I forget).

If it is a data drive, then all you have to do is:

boot normally.  dd if=/dev/sdX of=/image_file_on_big_drive bs=4k
conv=sync,noerror

If it is a boot drive, then boot a linux boot disk and do the same.

Once you have that working copy, you need to decide if you want to
make even another copy that you keep un-modified.

You can use gpart to guess / rebuild your partition table.

Once you know where your partitions are and you know what filesystem
type you have, you can use various recovery software to move forward.

To do the recovery, we use a professional tool, so I'm not sure what
low-end / free software is available to do the recovery.  (We use
either Encase Forensics ($3,000) or X-Ways Forensics. ($1200))

PTK is new opensource recovery tool that was released in the last few
months.  It may support linux filesystems.  Not sure.

HTH
Greg

On Thu, Dec 11, 2008 at 10:54 AM, H P Ladds <householdwords at gmail.com> wrote:
> Hey All,
>
> I have a hard drive that appears to be dieing, and I need data
> recovery software. Any suggestions?
>
> History of problem:
>
> 1. Somehow the partitions on the drive got out of order -- sda6 used
> sectors (4376 - 4618) and sda5 had (4619 - 19457).
> 2. In an effort to correct this situation, I deleted the partitions
> and recreated them using the same sectors.
> 3. I was hoping to do a e2fsck to recreate the superblocks and such.
> This was a bad plan, and partition sda5 is not mountable.
> 4. I did not reformat the partition, so I believe the information is
> still there.
> 5. I guess what I need to do is reformat the drive without destroying
> the data on the disk, which is mostly impossible -- right?
>
> Yes, I do have the info backed up on DVDs, but this seems to be a good
> opportunity to develop some data recovery skills, and maybe I can see
> what's on that disk I've had in the freezer for about two years.
>
> H. Preston
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
>



-- 
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
First 99 Days Litigation White Paper -
http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com