|JP Vossen on 13 Oct 2011 13:06:51 -0700|
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
|Re: [PLUG] Need to recover an external HD|
On Wed, Oct 12, 2011 at 11:12:33PM -0400, Amul Shah wrote:My father-in-law unplugged his external USB drive from his Windows laptop...
Well there's your problem... :-) +1 for 'ddrescue' as well, but watch out, there are 2 of them: 1 ddrescue - copy data from one file or block device to another 2 gddrescue - the GNU data recovery tool You probably want the "gddrescue" package, or maybe try both. Other packages (from Ubuntu Lucid LTS Repos): foremost - Forensics application to recover data gpart - Guess PC disk partition table, find lost partitions ext3grep - Tool to help recover deleted files on ext3 filesystems friendly-recovery - Make recovery more user-friendly magicrescue - recovers files by looking for magic bytes recoverdm - recover files/disks with damaged sectors recoverjpeg - tool to recover JPEG images from a filesystem image scrounge-ntfs - Data recovery program for NTFS filesystems testdisk - Partition scanner and disk recovery tool autopsy - graphical interface to SleuthKitsleuthkit - collection of tools for forensics analysis on volume and file system data
Autopsy/sleuthkit may well be overkill (or too much trouble), but 'foremost' might be useful. I've never used it for real, but "recovered" JPEG files off a camera just as a test:
$ sudo foremost -v -t jpg -i /dev/sdb1 -o .Depending on what was on the drive, running a bunch of those commands might help. IIRC you lose file names though.
But having said all of that, after creating the image, I'd look at the easy stuff first. Even Windows won't have had too much time to foul things up if he unplugged it suddenly, so it's probably something basic like the partition table or maybe root directory entries. Or maybe it's just set to unclean and a Linux force mounting followed by an fsck might fix it. I have am MP3 player that flakes out now and then, and simply mounting the memory stick under Linux then cleanly unmouting it makes it work again.
Final random thoughts: * Try as many different computers, OS versions and USB enclosures as you can * Try mounting internally/directly if possible to remove the USB variables If any of the above "works" but the data is still missing: * Make an image (via whichever ddrescue) * Work on a copy of the image (you need lots of free disk space & time!) * Try simple stuff using some/all of: fdisk, sfdisk, cfdisk, parted, gparted * Try stuff as makes sense from "other packages" above. Good luck, let us know how it turns out, JP ----------------------------|:::======|------------------------------- JP Vossen, CISSP |:::======| http://bashcookbook.com/ My Account, My Opinions |=========| http://www.jpsdomain.org/ ----------------------------|=========|------------------------------- "Microsoft Tax" = the additional hardware & yearly fees for the add-on software required to protect Windows from its own poorly designed and implemented self, while the overhead incidentally flattens Moore's Law. ___________________________________________________________________________ Philadelphia Linux Users Group -- http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug