10

I have an old SATA harddrive with important footage on it. 15 years ago this harddrive "died" on a Windows OS. I saved the HD. Now I am going to plug it back into my Linux OS to see if the drive picks up in lsblk.

My question is what should I expect to see when I plug in the cable into my mobo and start up the server? Should the harddrive show up in lsblk right away or do I have to do something else?

Here is the help menu for ddrescue

mister mcdoogle
  • 475
  • 5
    Depends on which variety of "died" happened to the disk. More info could be found in /var/log/*. If it's "controller dead", you may see nothing. – waltinator Nov 04 '20 at 05:01
  • 3
    15 years in storage? Expect to see nothing. The spindle is almost certainly seized. Non-operational hard disks are not good long term (multiyear) data storage devices for a number of reasons. – fpmurphy Nov 04 '20 at 05:13
  • 1
    Speaking from experience, you may only get one shot at recovering data from the drive. Depending on how important the data is you may want to proceed directly to commercial drive recovery. Something like https://www.datarecovery.ca/services/hard-drive-recovery.html . It's pricey though. – studog Nov 05 '20 at 14:42

3 Answers3

19

I did something like that just a few weeks ago -- I got everything from a disk that had been sitting in storage for over 10 years! I had no intention of restoring the hard disk itself, I just wanted to get all the files from it, and put them onto my current disks. Fot that, I was hoping that the disk -- once plugged in -- would be alive long enough for me to grab an image of the whole disk as it is. And lucky me, it was indeed alive long enough for that.

First of all, boot into a Linux OS which isn't trying to be "smart" by automounting any disk it sees. You do not want to mount that old disk, you don't want to write to it whatsoever! Best yet, boot without the GUI. And also, make sure that you already have ddrescue installed. That's all you need, and of course, enough free space on your regular disk to hold the whole image from the old disk.

Find out which device your old disk is showing as, by using blkid or blockdev --report or lsblk.

For the example here, I'll use /dev/sdz -- you adjust "OLD" and "DEST" accordingly. Run these commands:

OLD=/dev/sdz
DEST=/path/to/where-you-want-to-put-the-image

ddrescue  $OLD  $DEST/saved.image  $DEST/saved.mapfile

If that finishes without errors, then you're done! You can now sync, poweroff, and remove the old disk from the computer.

But if you're not that lucky, then you can run another pass like this:

ddrescue -d -r3  $OLD  $DEST/saved.image  $DEST/saved.mapfile

Once you have the good image, then you don't need the old disk inside your computer anymore. Remove it, and put it back up on the shelf. You can now work with the image, (preferrably, make a copy of it), loop-mount it, and extract anything you want from it.

Good luck!

Pourko
  • 1,844
  • 2
    for god's sake make a second copy of the image, then upload a third copy to your cloud backup place if you have one. Otherwise you will inadvertently overwrite something and have to get the drive again. – user253751 Nov 04 '20 at 15:31
  • 1
    That goes without saying! Didn't want to overcomplicate the post -- just the essentials. – Pourko Nov 04 '20 at 19:22
  • If you have a Tableau or similar hardware write-blocker, be sure to use it. – fpmurphy Nov 05 '20 at 06:30
  • OP is dealing with a drive that was already broken at the time he stored it... It seems you dealt with a drive that was OK at the time you stored it. – rackandboneman Nov 05 '20 at 18:10
  • @rackandboneman: He didn't say "broken", he said "died", but in windows that can mean many things. – Pourko Nov 05 '20 at 18:50
5

Touch and go. If there's no physical fault it might power up fine, after which you can use dd to copy from the old disc to an image file which can be mounted and investigated (DO NOT mount the drive, and in particular DO NOT mount it r/w). If this doesn't make sense, find a specialist.

If the electronics is faulty then it needs to be repaired or replaced, and depending on the drive model it might be necessary to transfer calibration tables from a faulty to a replacement board.

If the heads have crashed or the drive enclosure is visibly damaged ... well, the NSA or GCHQ could probably get some of the data back but you'd have to make yourself /very/ unpopular for them to bother.

If a head has physically failed, it's a specialist repair of such magnitude that it will probably not be economic.

If the spindle has seized, it's a specialist repair.

If you've got "stiction" between the heads and platter, it's a specialist repair. There's hacks you can use, but they're probably not worth the risk.

I think those are the main failure modes. Once you get a price you'll have to decide whether the material on the disc is really worth it... I've only had to get this done once and it turned out that the chap who did the component-level repair was somebody I knew vaguely from working for a mainframe company.

Finally, the good news is that a SATA drive is definitely not "very old", and there are likely to be plenty of spare parts knocking around.

Whatever happens, DO NOT open the sealed drive enclosure yourself.

Mark Morgan Lloyd
  • 327
  • 3
    Oh, of course. NSA already has those files. Easier to just get them from them. – Pourko Nov 04 '20 at 19:29
  • 1
    If the disk refuses to spin up, try placing it in the refrigerator for a few hours and then trying again, particularly if its warm where you are. I've found in the past that the small shrinkage as a result can sometimes free things up. It's a last-ditch thing to try though. – Steve Shipway Nov 04 '20 at 20:32
  • 1
    If you're willing to pay the money, there are data-recovery companies that can get things from spectacularly damaged hard drives. Rule of thumb is that opening the case of the drive for a simple platter transplant is around $1000; if further effort is needed, the costs climb rapidly, but as long as the hard drive wasn't heated above the Curie point, at least some of the data will be recoverable. – Mark Nov 04 '20 at 22:26
  • @Pourko My comment on the NSA etc. was not intended as a joke: this is a serious question and somebody is asking for advice. My understanding is that high-end recovery cleanrooms are able to clean and mount individual platters (using "lathes" which are nothing to do with metalwork), then to do a complete read of the surface and possibly recover the address/data transitions. Chris Fenton did something similar to recover a Cray disk, and he only had student-level facilities. – Mark Morgan Lloyd Nov 05 '20 at 09:47
  • @Mark Morgan Lloyd: My comment was no joke either. :-) – Pourko Nov 05 '20 at 14:28
  • "DO NOT open the sealed drive enclosure yourself.". This might or might not be aged advice, it seems people have SOMETIMES gotten lucky with doing just that, then copying the data off ASAP. The advice to never do it might be from a time when destroying the drive in the process would have been an economic catastrophe, since they used to cost much much more. – rackandboneman Nov 05 '20 at 18:13
  • @rackandboneman read the OP: the data's valuable. With that stipulation, SOMETIMES isn't good enough. (And when I started off with this stuff, platters were 14" with heads flying at 6u and they could be cleaned.) – Mark Morgan Lloyd Nov 05 '20 at 19:29
  • @SteveShipway Putting it in the freezer (in a sealed plastic bag) is the "old-timey" fix. Has saved the day quite a few times actually. – gnicko Nov 05 '20 at 19:46
0

Are you familiar with stiction (also here ), its remediation, and why that doesn't work on newish drives?

Don't lose hope. I'm currently recovering date from 35-year-old 5.25" floppies and 25-year-old 3.5" diskettes.

Vlastimil Burián
  • 28,462
Eric Towers
  • 226