Computer Tips -Tech Info

Recovering Data from a Dying Hard Drive. This is something that I probably do at least once a month. Is it really possible to recover data from a hard drive that is failing? It depends. It depends on the state of the drive and what kind of tools you have available at hand. Many people move their data over to USB drives not realizing that they are as likely to fail as their internal drive and they have to face the prospect of USB Data Recovery. One thing that is better than hard drive crash data recovery is a good backup strategy (well implemented.)

The following suggestions and procedures basically work as well for a desktop hard drive as a notebook hard drive or even a portable external hard drive.

Hard Drive Failure Monitoring

To me this is my first line of defense against hard drive failure. IF you can have even 12 hours warning that a drive is about to fail wouldn’t it be worthwhile? YES, absolutely. That’s why I have setup many systems I administer with hard drive monitoring and the ability to send a scripted email when they “don’t feel well.”

I’ve found that if you can catch the failure early using something like SmartMonTools to give you a warning when the drive is not healthy, you can usually replace a drive before it is too far lost. So, do I wait until the S.M.A.R.T. monitoring tells me that the drive is failing it’s health assessment? No, I have a fairly low threshold for tolerating S.M.A.R.T. errors. Even if it’s a simple failure to run the complete S.M.A.R.T. test I will usually start planning for the drive replacement. I have a tendency on the machines that I administer to want to install blat as well as smartmontools if it’s a Windows based machine and configure the smartd to email failure reports to me. Now, admittedly I see false alarms, but 1 pending sector that can’t be read, if it resolves itself in a few days is probably not enough to make me replace a drive. If I see that number start to increase though, or if I see reports of ATA errors start to go up, then it’s time to swap the drive.

So, that’s what I use for early reporting. On my linux machines I always have a mailer installed so they can email me problem reports as well. It’s worth configuring smartd to report trouble and test (at least once) that you can receive the warning messages. Learn a little bit about the types of error reports that you may see and you’ll get your own feel for what is a message you should be concerned about.

Cloning a Hard Drive

If you want a good clean image of a drive (like a snapshot in time). Of course, having a snapshot of the working system after you’ve installed all of your software is a great restore solution to quickly get you back up to speed. It may not replace your data, but I highly encourage you to take a system snapshot of a newly provisioned machine. It’s really easy to accomplish. I use Clonezilla for hard drive cloning. Here’s what’s great about Clonezilla. 1) It’s open-source. Freely available and redistributable. You can download it for free. 2) It can clone disk to disk or disk to file. That means that if you want to just make a FILE on a memory stick or other storage device with the disk image you can. 3) It supports many different network communication types. If you have an ftp server or samba server (windows file and print sharing) or ssh server on your network you can use those to store your disk image. 4) Fast if it understands the filesystem. If it’s a supported filesystem NTFS, Fat32, Reiserfs, Ext2, Ext3, most other linux filesystems, then it only copies the data. It doesn’t bother cloning the empty space. This makes it fast and makes the image files relatively small. If it can’t recognize the file system it still works, it just reverts back to a bit for bit copy of the disk. I’ve seen 10 minute disk imaging before OVER the network. I’ve also done an image to a USB thumb drive for a particular custom built kiosk machine. It’s possible to automate the process of restoring an image from a boot cd as well.

Yes, but that’s before your disk fails, what if it’s failing?

Recovering Data from a Sick Disk

If the disk is starting to give the early warning signs of failure through something like SmartMonTools, or you see an increasing number of bad blocks in your chkdsk scans. My first tool of choice is still Clonezilla. I’ve had good luck with it if I can catch the failure of the drive early. If this program fails to rescue your data you will need to move to the next step though.

Recovering Data from a VERY Sick Disk

Ghost4Linux has been a somewhat controversial project. It was originally copied almost directly from Ghost4Unix without attribution (a big faux pas in the open source world (and most any other)). However, it has since been handed off to a new developer and rewritten from scratch. I used to make use of the direct disk to disk copy function of Ghost4Linux for healthy disks or those that I caught in the early stages of failure. That was before I discovered clonezilla, now I make use of Ghost4Linux only when the disk is beyond Clonezilla’s ability to copy. When a disk fails you will many times have parts of the disk that simply cannot be read. This can cause some copy processes to simply freeze or to stop altogether. Under the Utilities section of ghost4linux though there is a tool called dd_rescue. dd_rescue essentially starts a full bit for bit copy of the old drive to the new one, but it realizes that it may find a place on the disk that it can’t read from and so instead of freezing or bailing out entirely, it decides to skip to the end of the disk and then start working backwards. Then it finds another part of the disk it can’t read and it skips again to another area, continually narrowing the unreadable area of the disk. Obviously if there are parts of the disk that can’t be read there is a chance that you’re going to lose data, but I’ve had pretty good sucess with this method.

In some cases I’ve had success at least getting the data to a stable drive where it can then be copied from without fear that it’s crumbling during every file copy process.

Cloning affects on Windows

Windows will likely still boot after a Clonezilla copy of a disk if it booted before the Clonezilla copy. It’s not something that Windows would “freak out” about because it’s installed on a different hard drive. (Put it in a different computer and it will panic and cause all sorts of pain.) But, if you’ve had the drive start to fail and take data with it causing either a Windows boot problem before the cloning, or you had to use a tool like dd_rescue, then you will likely have to reinstall Windows if you want to boot from that disk.

If the challenge and expense in time and money of installing everything from scratch is too much and you just want to move the data to a new PC, then you can of course use the tools above to just move your data to a “stable” drive and then you can copy the data over at your leisure. If this is the situation, you may need to run chkdsk on the copied data a few times to make sure the filesystem is in good shape.

Lifeboat off a dying Hard Drive

In some cases I’ve had dd_rescue fail a complete run too. I don’t know why, I haven’t taken time to try and figure out why, when there’s a drive failing at a quick pace. For this I usually punt to my absolute last chance. Hook the drive up via a usb adapter and try to copy the data using a linux system.

Why linux? Because when I hook a usb drive up to a Windows machine it scans the contents of the entire drive to figure out what options to give me, (play music, view pictures, browse folders, etc.) I’ve seen one iffy drive pushed over the edge by this sudden burst of activity. Linux systems and boot cds don’t have the same quick ransack of the disk contents and I’ve had much better luck with them just being able to connect the drive and surgically retrieve a few data files.

Advanced Data Rescue Techniques

If it’s still possible to read from the drive and the filesystem is trashed you could try a hex editor to read the data directly from the drive and try to reconstruct. If you want to do this you’ve probably had fun reconstructing paper run through a crosscut shredder though.

If the drive fails to spin up it’s possible to put it in the freezer over night and get a last bit of life out of it the next day. (I’ve seen it work once or twice.) Make sure that you take steps to seal up the drive so that humidity isn’t a problem.

Data Recovery Companies

If all the above fails and you’re to the last line of defense it’s really up to the data recovery companies. All the above options will probably cost you less than $400 if you pay someone to try those to reclaim lost data from a hard drive. Data Recovery companies can cost well over $1000, many start around $2000. So, that’s out of reason and reach for many people. If your data is worth that much and you don’t have time to waste and have the money then your best bet is to skip most all of the above suggestions and get it to a data recovery company before more damage is done. You might want to ask yourself if it’s worth it to use one of these data recovery services. If it’s irreplaceable data, it may be worth it.

Yes, every moment can count and if the drive is failing quickly you might make their job easier (read that as cheaper) if you can get it to them before it’s been making that strange grinding noise for two weeks now.

After you’ve got your system running again, make sure to make backing up your data a regular routine so that next time you have a hard drive fail it won’t be a matter of great emergency to get something off of THAT drive. Yes, it’s more convenient if you can recover the drive even if you have backups, but you’ll at least have the peace of mind that if there’s now way any data can come off of it, you still have a plan B.

   Send article as PDF