Re: [PLUG] hard drive recovery services?

[Jon Nelson <lists@linuxnotes.net>]

On Fri, 2007-07-06 at 00:29 -0400, JP Vossen wrote:
> Short version: does anyone have any thoughts/recommendations on "send it 
> out to the clean-room" hard drive recovery services (e.g. On-track)?
> 
> Long version:
> A neighbor has a hard drive that died suddenly and he'd like to recover
> some of the data.  (Don't even ask about backups.)  I got my hands on 
> the drive and its behavior is--odd.  My theory is that the drive's 
> electronics suffered a component failure somewhere in the data path 
> between the drive firmware and hardware.  It was apparently working at 
> 9:30 AM and just dead by 11:30 AM, with no known issues (no storm, etc.) 
> and no previous warning signs.
> 
> When I installed it as the only drive (IDE master), the test PC (Dell PE 
> 350) BIOS didn't see the drive at all.  So I threw in another drive and 
> set it to master and the failed drive to slave.  Then the PC BIOS could 
> see the failed drive.  As far as I can tell, the platters spin up fine.
> 
> So I booted up Ubuntu and started poking around.  fdisk can see /dev/hda 
> (good) but not /dev/hdb (failed).  Yet, /proc/ide/hdb is populated [1]. 
>   Yet, dd has been running for 14,000+ seconds and has copied 0 bytes 
> (dd if=/dev/hdb of=/mnt/good/image.dd conv=noerror).
> 
> I plan to let dd run overnight then try the freezer trick, just in case.
> 
> But unless that changes things, it seems to me that SpinRite, or 
> recover2000.com or whatever other home-use software solutions (as 
> suggested by another list) won't help, since I can't even dd the raw 
> data...  Anyone disagree?

You could try to dd a portion of the disk instead of the whole thing.
If this completes then you might be able to carve some of the data from
the image.  You can check dd's status during the process by (from the
man page):

       Sending  a USR1 signal to a running `dd' process makes it print
       I/O statistics to standard error and then resume copying.

              $ dd if=/dev/zero of=/dev/null& pid=$!
              $ kill -USR1 $pid; sleep 1; kill $pid

              18335302+0 records in 18335302+0 records out  9387674624
              bytes (9.4 GB) copied, 34.6279 seconds, 271 MB/s

What type of box did this drive come from?  Some manufactures prevent
data from being read if the drive is removed, so you might need to image
it in the original tower (use Knoppix).

Jon

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug