Your
hard drive just stopped working. It never made any odd sounds like
screeching, popping, or clicking, and it didn't crash. It just quit and
it has some priceless data that isn't backed up to another device. This
guide may help you troubleshoot and correct any problems related to your
drive. (Alternatively, read up on how to recover data from the hard drive of a dead laptop.) Be sure to read all warnings before proceeding.
Steps
Basic Steps
- 1Inspect the outside of the hard drive for damage.
- Stop using your computer or external hard drive.
- Power down the computer or disconnect the external drive.
- Remove the hard drive from the computer or device.
- Examine it carefully for 'hot spots' or other damage on the external controller board.
- Check if there are broken parts.
- 2Replace the cables. Plug the hard drive in with new cables (power and data connection) that you know works and try again. Note that an IDE drive will need a flat-ribbon cable.
- 3If you have a PATA (IDE/EIDE) drive, switch drive pin settings.
- If it was “slave” or “cable select,” set it to “master.”
- Plug it in alone without any other device on that port and try again.
- 4Try other IDs and/or another PCI controller and try again. If you don't have another controller, a PCI card that adds ports to your computer, just change the ID.
- 5Plug it into an external drive adapter or external drive case (i.e. USB) if you have one.
- If it does not spin up, try connecting it to another power source (include data connection as some drives don't spin up without). If on both it does not spin up, the fault is most likely related to the Printed Circuit Board.
- 6Connect the drive into another computer and try again. If this works, it is possible that the motherboard is at fault and not your hard disk.
Replace the Drive's Controller Board
- 1Inspect the drive's controller board carefully to see if it can be removed without exposing the drive's platters. Most drives will have an externally-mounted controller board. If not, stop here.
- 2Find a sacrificial drive. It is important to match the exact same model number and stepping (i.e. firmware revision, printed circuit board number). Matching drives can sometimes be found at places like ebay, inspect the photo in the auction carefully to determine if the model and firmware match. Contact the seller to be sure the drive being auctioned matches the picture prior to buying.
- 3Remove the controller board of the failing drive.
- Remove the screws with the correct screwdrivers. Most drives use torx head which is available at home repair stores. Be careful, the screws are soft.
- Learn everything about how it is connected to the drive. Most drives are connected via ribbon cables and pin rows. Be gentle. Do not crimp or damage the connectors.
- 4Remove the controller board from the working drive. Again, be extremely careful.
- 5Attach the working board to the failing drive.
- 6Connect the drive to your computer or device and test. If it works, immediately copy your data onto another form of media or a different hard disk drive. If that didn't work, try to re-assemble the sacrificial drive with the working controller board. It should still work.
Using Linux to recover your Data
Many times when windows can not see your drive its because the filesystem itself is damaged. In the case of a damaged filesystem, it would be wise to first take an image of the hard drive before running any type of "filesystem repair" utility. The reason for this is if you have a drive that has both filesystem damage as well as minor physical damage, you may make matters worse. Taking an image of the drive prior to attempting to fix it will allow you to always revert back to the original state. If you are linux savvy you can use DD to image a hard drive. Be careful with DD as imaging the wrong way will be disastrous.You can boot up off of a windows XP installation cd and select the recovery console and once in a dos prompt use chkdsk to repair the file system like you see below. Replace (DRIVELETTER) with the applicable drive letter.
chkdsk (DRIVELETTER): /f
This will force windows to attempt to repair the file system itself. Newer versions of Linux may have the ntfs-3g program and ntfsprogs and it includes a program called ntfsfix which can help repair a windows ntfs file system so it can be mounted or booted. Linux might have no issues being able to see and actually access the data even if the drive is not bootable.
While you can try to mount the drive in a computer that is already running Linux you can also use a Live CD do the same without having to do anything other than downloading and burning the CD or building a bootable Linux system on a USB stick. To find out how to build a bootable Linux USB stick you can find detailed instructions up on the Pendrive Linux Website.
- Download a live disk. System Rescue CD is a good one for this application.
- Burn the .iso onto a blank CD with an Image Burner.
- Boot the computer, don't forget to change the boot order in the BIOS.
- Mount the drive by typing this command: mkdir /mnt/disk && mount -t auto /dev/sda1 /mnt/disk. If the drive is a IDE drive the command would be mount -t auto /dev/hda1 /mnt/disk assuming you only have one partition on the drive if in doubt Consult a basic linux guide for specifics.
- Mount another drive and backup data. Again, consult a basic linux guide for specifics.
Testdisk will help recreate the partition table.
- Boot into a Linux live disk. See above instructions
- Run the command: testdisk /log. This command is not on every live disk, it is on System Rescue CD.
- Follow find your drive and choose to
recreate the partition table. Read the Documention the Website for
Testdisk can be found online here.
The first partition on the C drive would be /dev/hda1 the second partition on that drive would be seen as /dev/hda2 and so on. Whenever running either testdisk or its companion program photorec always run it with the /log command unless the system you're attempting to recover data from is very small. What this does is give you the ability to run the command again if for some reason the program stops running without having to start all over again.
There is a second component to Testdisk that is called Photorec which can recover your data even if the partition table is not able to be recovered. It can take a long time to run but it does a great job, even with severely damaged Hard Drives.
Photorec
-Photorec is file/data recovery software originally designed to recover lost pictures from digital camera memory or even Hard Disks, it ignores the filesystem and instead is looking for what is known as file headers, this is the very first part of every file and generally tells the OS what kind of file it is without the system having to read the file extension. It has been seriously extended to search also for non audio/video headers. It can now search for over 80 different types of files. Photorec is part of the Testdisk package. To install the following package in a Debian based Linux Distro you would as the root user run the following command.
apt-get install testdisk
If you are not running as root just preceed the command with sudo like you see below.
sudo apt-get install testdisk
There are some basic rules when dealing with Photorec.
Photorec can also be used to recover deleted files as long as they were RECENTLY deleted.
When running photorec unless the device your running it against is very small (less than 1 gig)and not severly damaged it is always recommended to use the \log command function so if for any reason photorec stops its processing it can be restarted and it will continue from where it stopped as long as its is recognized as the same drive again
IE, /dev/sda
If you do not know which drive it is open up a console/shell and run the command dmesg and assuming the drive is connected via usb just plug it in and after perhaps a minute run dmesg then read the messages you see. After the drive is plugged in it will show up in the system and you will see this in the dmesg output.
If you do run photorec and or testdisk without the /log flag you will be forced to start again from the beginning if for some reason the program closes or does not complete. I have had seriously damaged drives take over 100 hours to complete but generally it takes perhaps 5 hours to do a recovery on a 40 gig drive. Also NEVER write back to the same device even if all other partitions are good.
To run Photorec on an image file in Linux, do: sudo photorec /log imagefilename -d /some/directory/to-store/recovered/items
To recover files directly from a device, run photorec without any arguments and you will be given a menu of available devices. sudo photorec /log
This utility should only be used if you are unable to mount that partition as your filenames will be lost but it does a great job of recovering data even if the hard drive is very damaged, as long as it will spin up you can pretty much expect to get some stuff back and frequently you can get virtually everything back.
What this program will do is search the HD for readable files by searching for the magic headers and copy them to where ever you tell it to with the -d flag. Another rule of thumb is if you are recovering 20 gigs of data in this fashion you will need a minimum of at least 40 gigs of free space. The resulting files will get dropped into folders and since your partition table doesn't exist or is not readable the file names would be lost and will instead be renamed with the inode number of where they were found on the drive.
In other words you will end up with files with names like f53247.doc or f21433.jpg that will be in folders named recup_dir.1, recup_dir.2 and so on.
The folders get created dynamically once they reach about 50 megs in size a new one is automatically created and the found files are copied into each folder as the program runs across the drive recovering data.
Many types of files actually have some data in the magic header or other locations that might enable you to recover some part of the original file name or at least give them more meaningful names. For instance Digital Cameras write what is known as exif data into the pics. You can use a Linux program called jhead to read this data and rename all of the files with the date and time the actual pictures were taken, Mp3's also save the ID3 tags which if they are correctly set will give you all the info you need when renaming your recovered files.
See this the Testdisk website for a detailed description of how to use Photorec and Testdisk. There is also some hints on how to rename and sort the resulting recovered files once the program is finished.
Tips
- NEVER use RAID 0 for anything but scratch data. It's fast, but has no redundancy, so it's twice as likely to crash with two drives than a single drive, and take your data with it. Recovery of these systems often is very difficult.
- If data comes in faster than backups, and is precious, consider RAID 1, RAID 5 or RAID 10 disk configurations. A RAID array will keep running when one physical drive dies. A good one will even re-write a replacement drive that's "hot swapped" into it without stopping. External controllers will do this better than ones integrated into motherboards.
- When you are unsure what to do, contact a professional company, repair on hard drives without the correct knowledge often results in worse situations heightening the costs for repair.
- Heat is the enemy of all electronics.
- Programs like GRC's Spinrite does an excellent job at getting down to every last bit and ensuring that everything is working on the most basic of levels, however, if it finds that a sector of a hard drive is corrupted, it will attempt a recovery of it. It has saved many hard drives from failing, and has helped recover gigabytes of data. Spinrite is in its 6th version and has proven very successful. Please note, while Spinrite and other software hard disk recovery programs work well, they will not permanently fix a problem every time. Therefore, it is recommended that software recovery only be used to backup the data.
- The partition table is located on the first sector (often 512 byte) of a hard disk. It contains all the information about how the drive is organized. Without it, a computer will simply think nothing is there.
0 Comments :
Post a Comment