Damaged Hard Disk

Damaged Hard Disk From CGSecurity Jump to: navigation, search english version

deutsche Version

versión español

version française

Bad sectors are the most common form of harddisk physical damage. They are early signs of disk crash as it deteriorates over time. A bad sector is a sector on the disk which data cannot be written or read due to a physical damage or inconsistencies of parity checking bits on disk (CRC or Cyclic Redundancy error). To recover your data, the best method is to copy its data to another hard disk before attempting to recover its data. The new disk must be at least exactly the same size (check the number of LBA sectors) or larger; when larger, it's usually not a problem because the number of heads per cylinder and sectors per head will be the same if both disks use LBA mode. Windows may have some problems in dealing with bad sectors on a damaged hard disk, so the best solution is to use a Linux OS to copy data to another hard disk. You can also use TestDisk to help analyze the sectors copied from a hard drive with physical problems onto a good drive. Contents [hide]

1.

1 Booting from Knoppix, a Linux LiveCD

2.

2 Identifying an HDD's device

1.

2.1 Identifying an HDD's Linux device

2.

2.2 Identifying an HDD's Mac OS X device

3.

3 Disk Duplication

1.

3.1 The classic method using 'dd'

2.

3.2 Kurt Garloff's 'dd_rescue'

3.

3.3 The best method: Antonio Diaz's GNU

'ddrescue'

4.

4 Early detection of bad sectors

Booting from Knoppix, a Linux LiveCD If you don't have a Linux OS installed, download the Knoppix LiveCD , a free bootable CD with a fully functional Linux OS that runs only in memory! 1.

Burn the .iso file to CD

2.

Boot from the CD-ROM

3.

At the boot prompt, type knoppix

4.

You are automatically logged in as the user 'knoppix' on a GUI console.

lang=us

for a US keyboard/language.

Launch a Konsole/terminal (Note: Knoppix has a separate 'Konsole as root' choice, but copy/paste functions are deactivated in it, so we always recommend using the method described below for gaining root privileges from the normal user Konsole.) 5.

Knoppix comes with TestDisk, PhotoRec, dd and dd_rescue. To access hard disks, you need to run these utilities with root (Administrator) privileges. 1. sudo

To become root from the Knoppix user account, select the Konsole and type -s, then press the Enter key.

2. Now you can use all the powerful root commands you need for full disk access from this console. Note for users of Knoppix version 4.0.2 CD: To use TestDisk under Knoppix 4.0.2, you need to resolve a library problem by first executing: ln -s /usr/lib/libntfs.so.7 /usr/lib/libntfs.so.5

before running testdisk. Note for users of Knoppix version 5.1 CD: To use TestDisk under Knoppix 5.1, you need to resolve a library problem by first executing: ln -s /usr/lib/libntfs.so.10.0.0 /usr/lib/libntfs.so.9

before running testdisk. This problem shouldn't occur under any other Knoppix versions or with the Linux version avaible from our Download area.

Identifying an HDD's device Identifying an HDD's Linux device Under Linux, the Primary Master IDE disk device is /dev/hda Primary Slave IDE device is /dev/hdb Secondary Master IDE device is /dev/hdc and so on. SATA HDD device filenames usually begin at /dev/hde or /dev/sda SCSI device filenames always begin at /dev/sda USB devices often use SCSI device names: /dev/sda etc. To list the partitions of a particular hard disk, as root, run: fdisk -l device.

Identifying an HDD's Mac OS X device To identify the disk/partition numbers, 1.

Start the Terminal program, found in the /Applications/Utilities folder.

2.

type diskutil

list

in the terminal

There are two types of devices: 1.

raw devices /dev/rdisk*, communication is direct with the disk.

2.

buffered devices /dev/disk*, data transit via buffer.

When using dd or other duplication programs, always use raw device. In Mac OS X, partitions are labeled with "slices". An example in a volume in GPT format is typically s2, i.e, rdisk4s2.

Disk Duplication Once you have verified the device names for your damaged disk and the new one to copy its data to, in a command-shell (CLI) or terminal console, not from within any OS on the damaged hard disk, you can start to duplicate the data.

The classic method using 'dd' dd is very powerful and can be used to write from disks to files and files to partitions or volumes. 1.

To copy a disk as root, run

dd if=/dev/old_disk of=/dev/new_disk conv=noerror,sync

is used for disks with bad blocks, where the intent is to replace bad blocks with zero placeholders and continue copying. conv=noerror,sync

1.

To copy the disk to an image file dd if=/dev/old_disk of=image_file conv=noerror

As user under Mac OS X or Ubuntu users, always prepend the sudo command to dd and use your user password to validate the command. Be careful, if you are copying a disk, the destination must also be a disk, not a partition. If you are copying a partition, the destination partition must be large enough. Copying the whole disk is recommended. The default block size for dd is 1 block (512 bytes), the command bs= is used to increase the block size. To read/write the disk by 16 sectors at a time, use 1.

bs=8192

2.

bs=8k

Example commands: 1.

To copy the first ide disk to the second one using 64 block sizes sudo dd bs=131072 if=/dev/hda /dev/hdb conv=noerror,sync

To duplicate an entire disk at disk0 (usually the internal) to another disk (disk1) using 64k block sizes and replacing bad block data with zeros 1.

sudo dd bs=131072 if=/dev/rdisk0 of=/diskcopy conv=noerror,sync

1.

To copy a volume on disk 0(the entire partition) to another partition on disk

1 sudo dd bs=131072 if=/dev/rdisk0s2 of=/dev/rdisk1s2 conv=noerror,sync

To copy a disk or partition to a file, specify the full path name or the file will be created in the current/default directory 1.

sudo dd bs=131072 if=/dev/rdisk0s2 /home/john/rdisk0s2.dd conv=noerror

Kurt Garloff's 'dd_rescue' If you believe there are many damaged sectors on the drive, you can try using either Kurt Garloff's 'dd_rescue' (dd_rescue) instead of dd.

The best method: Antonio Diaz's GNU 'ddrescue' The best solution, both faster and more efficient, seems to be Antonio Diaz's 'ddrescue' (ddrescue) # download ddrescue wget http://download.savannah.gnu.org/releases/ddrescue/ddrescue1.8.tar.bz2 # extract the source code tar xjf ddrescue-1.8.tar.bz2 # compile ddrescue cd ddrescue-1.8 ./configure && make # first, grab most of the error-free areas in a hurry: ./ddrescue -n /dev/old_disk /dev/new_disk rescued.log # then try to recover as much of the dicy areas as possible: ./ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log

Early detection of bad sectors Modern hard disks can detect physical problems using SMART Monitoring. Return to TestDisk Category: Data Recovery Views 1.

Article

2. View source Personal tools 1.

Data Recovery 1.

TestDisk

2.

PhotoRec

Log in / create account

3.

download

Password recovery 1.

CmosPwd

2.

Lilo Password

3.

chntpw for dos

Security 1.

Publications

Misc 1.

Donations

2.

Mon CV (FR)

3.

PGP Public Key

4.

Euro coins

5.

Roller

6.

Links

1. 2.

This page was last modified 17:33, 1 August 2008.

Content is available under GNU Free Documentation License 1.2.