Hard Drive Data Recovery – How to Recover Data from Hard Drive

fdiskhard drive

I have a dell laptop that recently "died" (It would get the blue screen of death upon starting) and the hard drive would make a weird cyclic clicking noises.

I wanted to see if I could use some tools on my linux machine to recover the data, so I plugged it into there.

If I run "fdisk" I get:

Disk /dev/sdb: 20.0 GB, 20003880960 bytes
64 heads, 32 sectors/track, 19077 cylinders
Units = cylinders of 2048 * 512 = 1048576 bytes
Disk identifier: 0x64651a0a

Disk /dev/sdb doesn't contain a valid partition table

Fine, the partition table is messed up. However if I run "testdisk" in attempt to fix the table, it freezes at this point, making the same cyclical clicking noises:

Disk /dev/sdb - 20 GB / 18 GiB - CHS 19078 64 32
Analyse cylinder   158/19077: 00%

I don't really care about the hard drive working again, and just the data, so I ran "gpart" to figure out where the partitions used to be. I got this:

dev(/dev/sdb) mss(512) chs(19077/64/32)(LBA) #s(39069696) size(19077mb)

* Warning: strange partition table magic 0x2A55.
Primary partition(1)
   type: 222(0xDE)(UNKNOWN)
   size: 15mb #s(31429) s(63-31491)
   chs:  (0/1/1)-(3/126/63)d (0/1/32)-(15/24/4)r
   hex:  00 01 01 00 DE 7E 3F 03 3F 00 00 00 C5 7A 00 00

Primary partition(2)
   type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX) (BOOT)
   size: 19021mb #s(38956987) s(31492-38988478)
   chs:  (4/0/1)-(895/126/63)d (15/24/5)-(19037/21/31)r
   hex:  80 00 01 04 07 7E FF 7F 04 7B 00 00 BB 6F 52 02

So I tried to mount just to the old NTFS partition, but got an error:

sudo mount -o loop,ro,offset=16123904 -t ntfs /dev/sdb /mnt/usb
NTFS signature is missing.

Ugh. Okay. But then I tried to get a raw data dump by running

dd if=/dev/sdb of=/home/erik/brokenhd skip=31492 count=38956987 

But the file got up to 59885568 bytes, and made the same cyclical clicking noises.

Obviously there is a bad sector, but I don't know what to do about it!

The data is still there… if I view that 57MB file in textpad… I can see raw data from files.

How can I get my data back?

Thanks for any suggestions,

Solution:

I was able to recover about 90% of my data:

  1. Froze harddrive in freezer
  2. Used Ddrescue to make a copy of
    the drive
  3. Since Ddrescue wasn't able to get
    enough of my drive to use testdisk
    to recover my partitions/file
    system, I ended up using photorec
    to recover most of my files

Best Answer

DDrescue is designed to get data off in situations like this. Then try mounting the image, and if files are missing give testdisk and photorec a chance on the image.

Related Question