5

Several days ago, I dropped my USB external hard disk. As a result, I cannot read some of the files. I would like to recover it, and now I am using safecopy. I used the following command,

sudo safecopy /dev/sdb1 data.img --stage1

However, at around 93%, then there is a message something like "cannot read from source". Then I tried to mount this partially recovered image, but failed. What are the things I can do more to recover the data?

==================================================================

I have tried to use

sudo safecopy /dev/sdb data.img --stage1

Now, it is done. Then, I

fdisk -lu data.img

It produces this result,

Disk data.img: 310.8 GB, 310798626816 bytes
255 heads, 63 sectors/track, 37785 cylinders, total 607028568 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xb1bec32c

   Device Boot      Start         End      Blocks   Id  System
data.img1              63   625137344   312568641    7  HPFS/NTFS/exFAT

Then, I tried to mount with

sudo mount -o loop,offset=32256 -t ntfs data.img /mnt/temp

but failed with this output

Failed to read last sector (625137281): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

How should I do to recover the data from here?

Allen
  • 339
  • The blog post that covers this Q&A by the OP is here: http://allencch.wordpress.com/2011/11/20/the-way-of-data-recovery/ – slm Sep 12 '14 at 05:49

1 Answers1

2

First, you may want to try safecopy --stage2 and safecopy --stage3 as well, to try to extract a little more from the disk.

If your copy is partial, you have a damaged filesystem. Run fsck on it (e.g. fsck -y copy-of-data.img) to attempt to repair. Note that for NTFS, you'll need a recent version of NTFS-3g. Repairing means turning the filesystem into a valid filesystem, it may well lose some of the data. So do this on a copy of the image. Then mount the image and try to recover files from it: sudo mount -o loop copy-of-data.img /mnt. Note that if fsck finds some data that it's unable to relate to a file name, it'll store it under the lost+found directory.

Sometimes, when fsck runs, it discards data because that data doesn't seem to belong to any file. A different approach for data recovery is to look for fragments on the disk that look like useful data. This works especially well for file formats that have a recognizable header, such as pictures. So try running carving tools on the copy of the disk image where you haven't run fsck. See How to recover data from a bad SD card? If these carving tools aren't easily available on your system, try the Testdisk live CD.

Community
  • 1
Gilles 'SO- stop being evil'
  • 829,060
  • Now I have the completed image of the whole hard disk, not the partition only, and I failed to mount based on http://wiki.edseek.com/guide:mount_loopback. And I tried "fsck -y copy-of-data.img", it does not work. – Allen Nov 13 '11 at 15:14
  • @Allen If you have an image of the whole disk, you need to mount and run fsck on the partition. First run losetup with the right offset (probably 512 bytes), then run fsck and mount on the loop device (proabbly /dev/loop0). See Reading a filesystem from a whole disk image – Gilles 'SO- stop being evil' Nov 13 '11 at 15:23
  • I have losetup the hard drive. Now is the problem of fsck. Since fsck I am using only works on fsck.ext2, what equivalent fsck for NTFS? – Allen Nov 15 '11 at 10:58
  • @Allen ntfsck or fsck.ntfs (which fsck will call automatically if you have it). Note that you need a recent version of NTFS-3g (it's possible that your distribution's package is too old). If you don't have ntfsck, you can try your luck without it, but you may not be able to mount the filesystem (depending on exactly which parts were damaged). – Gilles 'SO- stop being evil' Nov 15 '11 at 11:09
  • ntfs-3g I am using is 2011.4.12. I also tried ntfs-3g-ar, also 2011.4.12. But both of them do not provide ntfsck or fsck.ntfs – Allen Nov 15 '11 at 13:15
  • After safecopy with stage2, though the safecopy doesn't complete, now I can mount the ntfs partition with "-o loop,offset=32256" option. – Allen Nov 19 '11 at 13:11