Linux – NTFS drive damaged after unsafe removal from Windows 7

You could try ddrescue:

GNU ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.

A good primer for ddrescue is on the ForensicsWiki. Install it on Ubuntu by running sudo apt-get install gddrescue. Next, you'll recover the partition. Quoting from the article:

First you copy as much data as possible, without retrying or splitting sectors: ddrescue --no-split /dev/hda1 imagefile logfile

Now let it retry previous errors 3 times, using uncached reads: ddrescue --direct --max-retries=3 /dev/hda1 imagefile logfile

If that fails you can try again but retrimmed, so it tries to reread full sectors: ddrescue --direct --retrim --max-retries=3 /dev/hda1 imagefile logfile

The imagefile is going to be as big as the partition you want to recover, so make sure you have plenty of hard drive space (obviously not on the same HD you are recovering from).

Replace /dev/hda1 with the partition (ie /dev/sda2) you are trying to recover. Once you do this, you can mount the imagefile like this:

sudo mount -t ntfs-3g -o loop,ro imagefile /mnt

This mounts the image read-only at the directory /mnt.

The first thing you MUST do if you want your data back is stop abusing it!

Most common problems with hard drives ...

• Clicking (head crash - caused by wear and tear)
• Scratching (serious head crash cause by enormousness gravitational shock)
• Buzzing noise (does not spin up either because of seized spindle or head stick)
• Unresponsive (lots of bad sectors developed in data area)
• Does not detect (failure of data in service area or firmware corruption)
• Detects but cannot read (bad sectors on MFT - Some software can reconstruct but results vary)

That is a very simple list and unfortunately they expand into a more complicated subset of problems. The only problem you can deal with your self if MFT corruption. But you first know 100% that is the problem. If you start a long reconstruction process and it turns out to be something else you will destroy the HDD completely.

The best software that is available to end users is WinHex - It is not easy to use but it is a good forensics programme.

I would not recommend using tools like Spinrite.

If your data is very important then just fork out and get a pro to do it. A reasonable price is about £450 - Depending on your area you can use the hddguru forum to research professionals in your area. Be careful of cowboys who will charge thousands and return a door stopper.

Good Luck - And be sensible...

--

You might search the internet for tips and advice. These do not work.

• Put the hard drive in a freezer for 24 hours (this will cause damp damage after it thaws out)
• replace the PCB (it could work but if it does not the data will be lost forever because PCB's have unique firmware that write data to service areas. Replacing one PCB will overwrite the old PCB;s service areas - overwrite = deleted forever)
• Open the drive (Drives should only be opened in clean rooms - because even a small spec of dust can get stuck under the head and scratch the perfect surface of the platter - and cause serious head crash. Turning your HDD into a door stop)