Here at GeekyProjects we have been receiving hard drives for a while from all over the world and recovering their data in exchange for donations to the site. (We even received one from a soldier stationed in Afghanistan once).   However, lately our focus has shifted towards the website itself and we no longer have the time to continue with the service. Nevertheless, we have decided to share our knowledge with the public in a series of articles, and this one is probably one of the most important. How to recover data even when the hard drive is damaged.

Many data recovery services charge big dollars for this, and it is a procedure you can do at home, without having to open the hard drive. This procedure however, does not work for all cases, but it does work for a big percentage of them even when the hard drive has the famous “click noise of death”.

Note: Before attempting this procedure, make sure the damaged hard drive is being detected by the computer’s BIOS. If the computer cannot detect the hard drive then no software will detect it. To do this the drive must be connected directly a computer’s IDE or SATA cable, not by USB. Then you must go into the computer’s BIOS to see if it is being detected.

Ubuntu Rescue Remix and Ddrescue

Ubuntu Rescue Remix is a Linux Live CD. It already comes with a whole array of data recovery tools. One of them is Ddrescue. Ddrescue, is one of the best data recovery programs available and it is free. Ddrescue works by extracting a raw image of your hard drive and transferring it to another drive.  It extracts data bit by bit, regardless of the file system on the drive. The reason it works even when hard drives are dying is because Ddrescue retries several times and even tries to read data backwards. The procedure sometimes can take days, but it is very effective.

The Setup

The procedure involves 3 drives:

1) Your source drive (your damaged hard drive),

2) Your destination drive, this hard drive has to be slightly bigger than the source because it contains the raw image which will occupy the exact same size as your “source” drive, you then need a little extra space for the log files created by DDrescue. This drive must be totally empty or data in it will be overwritten!!!.

3) A drive to extract the raw image to. This drive can be the exact same size or bigger than your original “source” drive, but never smaller. This drive must also be totally empty or the data in it will be overwritten!!!.

Tips

As you can see by the picture down below I have two hard drives connected to the computer’s controller card. One is the source and the other the destination drive. I usually flip them upside down so that gravity helps a little if the arms are too close to the plates. However, some hard drives have the arms upside down, so see what works best for you. Be sure to place the drives on a flat surface to prevent vibration. Both hard drives in the picture are SATA, nevertheless, you can have IDEs restoring to SATAs and vice versa (or even to USB drives, but they can be harder for Ubuntu Rescue Remix to detect).

Keep Hard Drive Cool During Recovery

Place a 125mm case fan on top of the broken hard drive, making sure the air flows downwards in the direction of the hard drive. If you have a smaller 2.5 inch laptop hard drive you can use a smaller fan. Just make sure the fan is a little bigger than the hard drive, otherwise, the air won’t be able to escape and therefore won’t cool the sides of the hard drive. This is done to ensure optimal performance during recovery. This is optional but highly recommended. Sometimes the drive starts functioning properly just by cooling it off!.

Extracting the Raw Image

Download the ISO CD image of Ubuntu Rescue Remix (It’s linux, so it’s free), burn the CD and boot the computer with it.

Plug in the source and destination drives and run the following command that will tell you how many drives Ubuntu is seeing:

sudo lshw -C disk -short

The “lshw” command can sometimes be unreliable. If not all of your hard drives are being displayed, try the following command:

cat /proc/partitions

The “cat” command might not give you many details about the drives, but it will display all of them reliably.  For example, if  “lshw” only shows you one out of two drives, just by running the “cat” command and using simple deduction you can determine what the logical name of the missing drive is. (“Cat” will display drives and its partitions; drives are the ones without numbers at the end. Example: a drive will show as /dev/sda and a partition as /dev/sda1)

Identify the logical name of your destination drive (the drive where you will dump the contents of the damaged hard drive to). Create a Linux partition on that drive so that you can dump the image from your bad hard drive in there. Lets say, for this example, you have identified your destination drive as: /dev/sda. (yours could be sdb, sdc, sdd, etc. So change the following command according to what you have). *** Make sure not to confuse your source and destination drives, or you might end-up overwriting all your data***. Issue the following command at your shell prompt to format the destination drive:

sudo mkfs.ext3 /dev/sda

After formating, mount the destination drive, create a “recovery” directory, and get inside it.  To do this execute the following commands one by one (some of these commands may require sudo in front):

sudo mkdir mnt
sudo mount /dev/sda mnt
cd mnt
sudo mkdir recovery
cd recovery

After issuing the last command “cd recovery” you are inside the newly created recovery directory in your destination drive. Now, assuming you have identified your source hard drive as /dev/sdb (the broken hard drive you will be extracting the data from), run Ddrescue to extract the raw data, creating a file on the destination drive called “image” and a log file called “log”:

sudo ddrescue -r 3 /dev/sdb image log

This command will begin extracting the raw image from the bad hard drive, placing it inside the “recovery” directory on your destination drive. Take a look at the last two words in your command line; “image” is the name you are giving your your raw data image file, so, all your data will be stored in one single file named “image”. The las word “log”, is the name of your log file. You can change the name of these two file names to whatever you wish. The log file is extremely useful since it tells Ddrescue at what point it is during the data extraction process, therefore, it will know at what point to begin again if the process gets interrupted. In case of such an event all that needs to be done is to issue the same previous command, using the same file and log names inside the same directory containing the partial raw image file.

Restoring the Raw Image

sudo umount /dev/sda

sudo mkdir mnt
sudo mount /dev/sda mnt
cd mnt
cd recovery

Then and assuming your destination is /dev/sdb (your new empty drive where the raw image will be restored to), make sure your drive it empty otherwise you will overwrite your data) issue the following command to restore the image to your new drive:

sudo ddrescue image /dev/sdb

Make partition Active

Connect your hard drive to another computer (as a slave or by USB) and see if you can access the files. If you cannot, and the partition inside the hard drive is a Windows partition (NTFS, Fat, etc.), you might need to make the partition “active” using another Windows computer. If that is the case, connect the hard drive (as a slave or by USB) to a computer that has Windows and do the following: