Re: [PLUG] Need to recover an external HD

[JP Vossen <jp@jpsdomain.org>]

>  On Wed, Oct 12, 2011 at 11:12:33PM -0400, Amul Shah wrote:
> >  My father-in-law unplugged his external USB drive from his Windows laptop...

Well there's your problem...  :-)

+1 for 'ddrescue' as well, but watch out, there are 2 of them:
      1 ddrescue - copy data from one file or block device to another
      2 gddrescue - the GNU data recovery tool

You probably want the "gddrescue" package, or maybe try both.

Other packages (from Ubuntu Lucid LTS Repos):
	foremost - Forensics application to recover data
	gpart - Guess PC disk partition table, find lost partitions
	ext3grep - Tool to help recover deleted files on ext3 filesystems
	friendly-recovery - Make recovery more user-friendly
	magicrescue - recovers files by looking for magic bytes
	recoverdm - recover files/disks with damaged sectors
	recoverjpeg - tool to recover JPEG images from a filesystem image
	scrounge-ntfs - Data recovery program for NTFS filesystems
	testdisk - Partition scanner and disk recovery tool

	autopsy - graphical interface to SleuthKit
	sleuthkit - collection of tools for forensics analysis on volume and 
file system data


Autopsy/sleuthkit may well be overkill (or too much trouble), but 
'foremost' might be useful.  I've never used it for real, but 
"recovered" JPEG files off a camera just as a test:
	$ sudo foremost -v -t jpg -i /dev/sdb1 -o .

Depending on what was on the drive, running a bunch of those commands 
might help.  IIRC you lose file names though.


But having said all of that, after creating the image, I'd look at the 
easy stuff first.  Even Windows won't have had too much time to foul 
things up if he unplugged it suddenly, so it's probably something basic 
like the partition table or maybe root directory entries.  Or maybe it's 
just set to unclean and a Linux force mounting followed by an fsck might 
fix it.  I have am MP3 player that flakes out now and then, and simply 
mounting the memory stick under Linux then cleanly unmouting it makes it 
work again.

Final random thoughts:
* Try as many different computers, OS versions and USB enclosures as you can
* Try mounting internally/directly if possible to remove the USB variables

If any of the above "works" but the data is still missing:
* Make an image (via whichever ddrescue)
* Work on a copy of the image (you need lots of free disk space & time!)
* Try simple stuff using some/all of:
	fdisk, sfdisk, cfdisk, parted, gparted
* Try stuff as makes sense from "other packages" above.


Good luck, let us know how it turns out,
JP
----------------------------|:::======|-------------------------------
JP Vossen, CISSP            |:::======|      http://bashcookbook.com/
My Account, My Opinions     |=========|      http://www.jpsdomain.org/
----------------------------|=========|-------------------------------
"Microsoft Tax" = the additional hardware & yearly fees for the add-on
software required to protect Windows from its own poorly designed and
implemented self, while the overhead incidentally flattens Moore's Law.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug