Rescuing Data From A Failing Hard Disk
Posted on May 8th, 2015
One of the best ways to avoid having to rescue data from a failing hard disk is always make sure you have backups because once a disk starts to fail, there are no guarantees that you will be able to recover everything or anything. I’m not referring to states where you need to recover a deleted file or un-format a disk. I’m talking about situations where the hardware itself starts failing and you need to get that data off. I have always been pretty adamant about backups, mostly because I have always followed the philosophy that everything fails. Every component of a computer or network has an end-of-life and that’s why redundancy is important.
Having said that, now, and many times in the past, I have been in the unfortunate scenario where I have had to perform recoveries on disks which were on their last legs and I have learned a lot about it in the process. Even if you believe, as I do, in the importance of backups, you may have that friend or family member who calls you and says their computer is broken and they need access to files. Recently that friend had called me and having to put on that recovery hat, it reminded me of everything I have learned and I have picked up some new knowledge as well.
Before I continue, I want to stress, this is for a hardware failing disks; bad sectors, failing components, odd clicking sounds, etc.
You should have a disk that is the same size or larger as the disk you want to recover as we will be transferring as much data as we can from the failed disk to the new disk. You should also have something else you can write a file to. This is a small file and any typical USB drive will work. This file will be actively modified during the recovery so you need something with simple rewrite access; i.e. we don’t want to burn this to a CD. For the two disks, you should label which one is the new disk and which one is the old disk via either masking tape, a post-it note, etc. You should also write down on a piece of paper the model number and the serial number for both disks and write down if it’s the model/serial for the new disk or for the old disk. That way you can look at the sheet at any time see what the model and serial is for either the new disk or the old disk.
One of the best programs I have found for recovery is GNU ddrescue (also referred to as gddrescue or ddrescue). There is a similarly named dd_rescue, written by Kurt Garloff. This program attempts to do the same thing as gddrescue but I have had better experience with gddrescue than dd_rescue. gddrescue typically runs on Linux or BSD based systems. If you are trying to recover a Windows HDD or a OSX HDD, that’s OK. The program provides sector-level recovery of the disk so it doesn’t matter what OS is installed on the disk you are trying to recover. An easy way to get access to gddrescue, if you don’t have a Linux system available, would be to download the latest version of Ubuntu and either burn a CD or set a USB drive to boot from it. Ubuntu CD installation disks allow you to run the OS live from the installation media (CD or USB) without actually installing the Ubuntu onto the computer and it’s very clear to a layman if you choose to only try the software. If you had accidentally clicked the options to install, you would still be presented with many different prompts that you can cancel out of before the installation process would start so it’s really quite hard for a layman to accidentally install the OS when they don’t want to. I would also recommend that if you are going to use a USB stick, and you should, that you allow for persistent data storage because this will be the simplest way for you to save the file I had mentioned earlier that you will need to write.
Once you have the bootable media, you will need to attach both the old hard drive and the new hard drive to the computer before we start. Insert the bootable media and when you power the computer on, you will have to tell it to boot from the media. This is usually done in the BIOS which is the screens that appear before the OS starts. You can usually configure the BIOS by pressing the F2 or DEL key on the first screen that appears when you turn your computer on and you can usually just select which device to boot from by pressing the F12 key at this screen instead of the other two. Which keys to press vary from manufacturer to manufacturer so you will probably have to look to see.
Once you have the live Ubuntu system running, you will need to pull up a terminal (in the menu) and type sudo apt-get install gddrescue to install gddrescue. You will than need to run the command lshw -class disk to see which disk has which character device (the path to the disk to the OS). At this point you will see a list of data about each hard drive including the manufacturer, the product, the serial number and more. By matching the product and serial number that you wrote down earlier, find the section for each disk and look at the logical name: field. Here you will see something like one disk has the logical name /dev/sda and the other has the name /dev/sdb or something similar to this. Write down which one you see for the new disk and which one you see for the old disk.
You will now want to run the command ls -l /dev/disk/by-id/ata-* | grep -v — -part to display a name that can be referenced for the disk that will not change after a reboot. You will probably see lines that look like the following:
lrwxrwxrwx 1 root root 9 May 8 15:37 /dev/disk/by-id/ata-ST3250310AS_6RYMMSXN -> ../../sda
You will want to note the /dev/disk/by-id/ name (the left underlined part) that matches the logical name (the right underlined part) that corresponds to your drive. You will need to do this for both the old drive and the new drive.
Now, to begin recovery, you will run the ddrescue command as ddrescue -r3 -d -T30 /dev/disk/by-id/ata-AAA-BBB /dev/disk/by-id/ata-XXX-YYY ~/ddrescue.log to begin recovery. In the example I have just given, replace /dev/disk/by-id/ata-AAA-BBB with the logical name you have for the old disk and /dev/disk/by-id/ata-XXX-YYY with the logical name you have for the new disk. The -r3 command tells ddrescue to do a 3 pass recovery / 3 retries (if it’s needed). The -d option is for direct disc access for recovery and should almost always be used when you are trying to recover from a HDD. ddrescue can also recovery from images, CDs, DVDs, etc but when you are recovering from a disk, -d is a good option to use. The -T30 option tells ddrescue to quit if it has been unable to read from the disk within 30 seconds.
The -T30 option is actually very important when a hard drive is failing. Depending on the state of failure, this may not be needed at all or it may be needed many, many times. Essentially there will be times when the disk may (and probably will) enter a state where it becomes inaccessible until it has been disconnected and reconnected. If the program continues to run while the disk is in this state then not only will it be unable to recovery anything while the drive is in this state but it can lead to erroneous data in the logs. On most home desktop systems you will probably need to restart the system at this point. Though SATA drives, the most common type of connection to home drives, allows for hot plugging by design, most disk controllers on home systems will not support it so you will probably need to reboot. After the reboot, you will need to run the command again.
Recovering data off of a failing drive can, and usually does, take a long time. Sometimes this may take a few hours. Often it can take a few days. Sometimes it can take a few weeks. This is all due to the nature of how badly damaged the drive is and there is no way to predict it. You may also be required to reboot your system quite often. Once gddrescue is complete, you be able to replace the failed drive with the new drive and boot off of it. If gddrescue was unable to complete you may want to use the new drive to try and recover files from the restore it had attempted to complete. This can become complicated and is outside of the scope of this post but you can always Google for how to attempt to extract files from a failed recovery.
It’s important to remember that we are working with failed media here and there is no guarantee that recovery at any level will be achieved. This is all best effort attempts to try and restore data that had not been backed up from a disk that only has limited use left before it finally becomes unusable. Having said that, I have had a lot of success with gddrescue in the past and I would say that 1 out of 10 times I have not been able to recover to where the HDD could be booted from. The other 90% of the time, I was able to use the new disk to completely replace the old disk.
Your mileage may vary and I wish you best of luck. If you have been able to successfully restore your data then the final bit of advice I can offer is look into a backup solution so you never have to worry about this again.