Recovering files from a dead HD?

bjesus · 2008-01-04 11:37:42

Hey all...

Yesterday I tried burning an Audio CD with cdrecord, and since it was a 90min CD-R I had a lot of songs there. cdrecord failed the burning and said I could use -ignsize if I'm sure my drive is capable to burn this kind of CD. I guess it wasn't, but now it's too late... cdrecord died after ~5 tracks, and weird stuff started happening. First I got 'Read-only filesystem" error when trying to run some program, so I wanted to check what's going on, but 'mount' wasn't there. I tired ls'ing the /usr/bin directory, but didn't have permissions. After a minute or so, my 'screen' session died with 'signal 7', the mouse froze, and then everything else.

I did an hard-reboot and my BIOS said it has nowhere to boot from. I'm using a laptop - Dell Inspirion 6400, and the tools that came with it on the BIOS said there's no HD.

Now, that's what happened. Later on, I tried these steps:
I booted from an Arch CD to find it doesn't recognize no HD - there was no /dev/sd* nor /dev/hd*. After messing around, I did a boot without the CD and GRUB came up. It was slow, very slow, but the kernel loaded and the boot started. It got to the point where it should mount my root filesystem, /dev/sda4, and it starting "Checking transaction log". I'm using a ReiserFS on this filesystem. After a while (it took about 10 minutes), a few errors showed up with "ata1.01:" "softreset", "SRST Error", etc'. Then - a kernel panic.

Doing some tests, I saw that whenever I try booting from Arch's CD - it doesn't know nothing about my /dev/sda, unless I boot it with 'arch root=/dev/sda4", which then starts the drive, shows all the partitions on it, but fails with the same kernel panic after "Checking transaction log".

Actually, I don't mind much about the drive. I got backups of most of the stuff there, unless one important thing - my poetry directory, which has about 200 text-files of my poems. I don't have any kind of backup of it, and it would be awful to lose it.

The thing is I can't run any of reiserfs repair tools, since if boot without specifying "root=/dev/sda4" I don't have any /dev/sda4 to repair. If I boot with it, it won't pass the check.
I tried passing 'root=/dev/sda2' to my boot entry, which is my boot ext2 partition, but I got a kernel panic not finding init in there. Though, I does starts and list my HD's partitions.

Any advice would be a lot of help to me.
I'm thinking about 2 options:
- Disabling the check and hope I can see some files. Is there anyway to skip the check?
- Booting without passing the 'root' argument, but repopulating the /dev/ directory so it will find my sda drive. How can repopulate it? How can I repeat the steps the 'root=/dev/sda4' does, so it starts my drive?
Any other idea is good too I've got nothing to do but try.

Thanks a lot, and hope I didn't miss to much info (I can't copy-n-pass logs...).
Yo'av.

Last edited by bjesus (2008-01-04 11:41:43)

Mr Green · 2008-01-04 15:12:49

ok ... try a livecd see if it sees drive! take out hard drive test it either using one of the external kits you can get off ebay or hook it up to a friends machine

before you right off drive completely would be vary careful using any file system recovery tools too soon as you may cause more damage

cannot be much more help as it may be drive thats gone u/s

MrG

bjesus · 2008-01-05 08:05:24

Hey, well, as I wrote - I tried it with Arch's CD. It's shouldn't be any different then another LiveCD. It didn't see the drive unless I passed 'root=/dev/sda*' to the kernel, which then it couldn't mount it and gave me a kernel panic.

As for taking the drive outside, I guess it would be my next step unless I figure out how to see the drive without mounting it - How to skip the checking at startup, or how to reproduce the steps it takes so it sees the drive. Also, don't forget it's a laptop HD, so I'm not sure I can connect it to another PC so easily. Can I? Does it uses the same cables? I never messed with a laptop before.

Thanks.

Last edited by bjesus (2008-01-05 08:06:11)

bjesus · 2008-01-10 16:56:09

Well, I've made a few steps but still need some help.

I managed to start the computer with the HD on by passing 'swap=/dev/sda3' to the kernel. This way it starts the drive and doesn't fail - the sda3 partition is working good.

Now I can see sda4 - my data partition - and dd it, reiserfsck it, etc'.

So I tried use dd on it, and well - it partly worked. After creating 1.5GB file - errors started taking over - the HD shut down. Since then, I tried it a couple of times more, with no luck - at some point, the HD doesn't response until reboot.

So I'm left with my 1.5GB file, but I'm dieing to see what files it has in it.
How can I?

I don't want to do dd it to the dead partition, because maybe I'll be able to get some more stuff from there later on. I don't want to overwrite it.
I can't make it to mount -o loop. I've sent the file through ssh to another computer, but when I try to mount it, using

mount -o loop,offset=937681920 -t reiserfs imagefile directory

but it won't work. My logs says this:

Jan 10 18:44:00 localhost kernel: [343413.589447] ReiserFS: loop0: found reiserfs format "3.6" with standard journal
Jan 10 18:44:00 localhost kernel: [343413.589842] ReiserFS: loop0: using ordered data mode
Jan 10 18:44:00 localhost kernel: [343413.590388] ReiserFS: loop0: journal params: device loop0, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30
Jan 10 18:44:00 localhost kernel: [343413.594227] ReiserFS: loop0: checking transaction log (loop0)
Jan 10 18:44:00 localhost kernel: [343413.595220] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.595231] loop0: rw=1, want=209977472, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.595238] Buffer I/O error on device loop0, logical block 26247183
Jan 10 18:44:00 localhost kernel: [343413.595247] lost page write due to I/O error on loop0
Jan 10 18:44:00 localhost kernel: [343413.596053] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.596060] loop0: rw=1, want=163580824, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.596065] Buffer I/O error on device loop0, logical block 20447602
Jan 10 18:44:00 localhost kernel: [343413.596071] lost page write due to I/O error on loop0
Jan 10 18:44:00 localhost kernel: [343413.596874] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.596881] loop0: rw=1, want=134684064, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.596886] Buffer I/O error on device loop0, logical block 16835507
Jan 10 18:44:00 localhost kernel: [343413.596892] lost page write due to I/O error on loop0
Jan 10 18:44:00 localhost kernel: [343413.597724] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.597732] loop0: rw=1, want=228099096, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.597738] Buffer I/O error on device loop0, logical block 28512386
Jan 10 18:44:00 localhost kernel: [343413.597743] lost page write due to I/O error on loop0
Jan 10 18:44:00 localhost kernel: [343413.598546] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.598553] loop0: rw=1, want=170383736, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.598558] Buffer I/O error on device loop0, logical block 21297966
Jan 10 18:44:00 localhost kernel: [343413.598564] lost page write due to I/O error on loop0
Jan 10 18:44:00 localhost kernel: [343413.599416] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.599424] loop0: rw=1, want=130418480, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.599809] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.599816] loop0: rw=1, want=129253888, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.600200] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.600207] loop0: rw=1, want=129253776, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.600590] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.600597] loop0: rw=1, want=191897064, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.600981] attempt to access beyond end of device
Jan 10 18:44:00 localhost kernel: [343413.600988] loop0: rw=1, want=205783160, limit=2900768
Jan 10 18:44:00 localhost kernel: [343413.602422] ReiserFS: loop0: warning: journal-1226: REPLAY FAILURE, fsck required! buffer write failed
Jan 10 18:44:00 localhost kernel: [343413.602442] ReiserFS: loop0: warning: Replay Failure, unable to mount
Jan 10 18:44:00 localhost kernel: [343413.603300] ReiserFS: loop0: warning: sh-2022: reiserfs_fill_super: unable to initialize journal space
Jan 10 18:44:11 localhost kernel: [343424.499399] ReiserFS: loop0: warning: sh-2021: reiserfs_fill_super: can not find reiserfs on loop0
Jan 10 18:49:34 localhost kernel: [343747.442696] ReiserFS: loop0: warning: sh-2021: reiserfs_fill_super: can not find reiserfs on loop0
Jan 10 18:50:31 localhost kernel: [343803.939307] ReiserFS: loop0: warning: sh-2021: reiserfs_fill_super: can not find reiserfs on loop0
Jan 10 18:52:29 localhost kernel: [343921.886901] ReiserFS: loop0: warning: sh-2021: reiserfs_fill_super: can not find reiserfs on loop0

Any idea how to mount the file? I calculated the offset from 512*1831410 (the start of the partition, by fdisk -ul), though I get pretty much the same error without the offset. I know the image creation did not complete, but I'm hoping at least some of my files of interest are there.
Anyone know a program which can see the files in it? Something?

Thanks.

Last edited by bjesus (2008-01-10 16:59:27)

Stanley · 2008-01-11 22:02:40

Hi. I've got a very similar problem, using Ubuntu 7.10 on an Athlon 64 Dual Core. The description in your first post, and the code in the previous, are essentially the same as for me.

Like you bjesus, I was using CDrecord (and Rythymbox). I bought the Ubuntu box basically to back up several hundred CDs.

Because I have the CDs I was happy to lose the contents. I did several reinstalls, put FC 8 on, put XP on, put Ubuntu back on. All give similar problems.

So it looks like it isn't to do with architecture.

Stan

mpie · 2008-01-13 01:15:06

try bootin with pclos or knoppix, both have testdisk you can revocer diles that way, if its due to a failing disk, but if others are having simular issues sounds like incompatability

Mr Green · 2008-01-13 08:03:16

dd_rescue would help you make a backup of that drive......

bjesus · 2008-01-13 19:18:12

Hey Stanley! That's starting to sound odd Can you give me more details? Are you using a laptop? What filesystem were you using? Did you managed to format the HD after the damage and then reinstall? Did you too used the --ignsize option?

It seemed to me like the drive was dead. I never thought I could reuse it (and I'm not yet trying to format it since I'm still working on getting my files from it).

What's really wired is that it doesn't seem like the content of the drive is damaged. It's simply shuts down every once in a while, so while reading from it, the link to the drive is gone and nothing can be read from it. That's why dd and dd_rescue is giving me problems - it's copying stuff as it should, but after a few minutes (can be 2 and be 30) it is losing the drive and can't read from it no more - until after few reboots.
Feels like the drive gets hot at shuts itself down or something Stanley, was your experience similar?

any ideas?

Last edited by bjesus (2008-01-13 19:19:32)

bjesus · 2008-01-13 19:39:18

As a side note, I'll just say I did manage to get some files from the HD.

Instead of directly trying to mount the image file I created with dd (or dd_rescue), I first create the loop device manually using 'losetup'.
Then I can fix the device - rebuild the filesystem - using reiserfsck --rebuild-sb, --rebuild-tree and --check. Then, I can finally mount the device.

But, because of the problems I wrote above - my HD shutting down every once in a while - I can't get the image file to contain too much files. So mounting the device is working, but only has a little portion of my drive.

barebones · 2008-01-14 19:40:00

It seems strange to me that the hard drive would take a dive like that after using the optical drive. Have you tried disconnecting the optical drive and seeing if the system works without it?

bjesus · 2008-01-16 19:23:12

Well, the optical drive is working good so I didn't suspect it, but the main reason it's been 2 weeks and I still didn't take the laptop apart is that I'm afraid about my warranty... I'm checking with Dell to see if taking the HD/CD-Rom outside would stop the warranty, but until then I'm trying to make it work without actually touching it.

Although, your comment about how odd it is for the HD to behave like that is absolutely true. It makes me think that maybe none of the data is lost, and there's simply something preventing me from reaching it (the HD controller? cables? what?).

I'm not quite sure how Stanley reinstalled another OS over and over again, since my HD doesn't work for more than half an hour without shutting down...

Before taking the laptop apart, I have 2 ideas:
- Try to image the drive by parts. Using some script to continue from where that last dd stopped. Any ideas for such script?
- Understating how to restart the power to the HD from the CLI, without restarting the whole computer. Must be some low-level way to do that.
- Other ideas?..

Thanks!

Stanley · 2008-01-17 22:11:44

bjesus wrote:

Hey Stanley! That's starting to sound odd Can you give me more details? Are you using a laptop? What filesystem were you using? Did you managed to format the HD after the damage and then reinstall? Did you too used the --ignsize option?
It seemed to me like the drive was dead. I never thought I could reuse it (and I'm not yet trying to format it since I'm still working on getting my files from it).
What's really wired is that it doesn't seem like the content of the drive is damaged. It's simply shuts down every once in a while, so while reading from it, the link to the drive is gone and nothing can be read from it. That's why dd and dd_rescue is giving me problems - it's copying stuff as it should, but after a few minutes (can be 2 and be 30) it is losing the drive and can't read from it no more - until after few reboots.
Feels like the drive gets hot at shuts itself down or something Stanley, was your experience similar?
any ideas?

Hi BJ. My mahcine is a desktop, an Isis machine. All the varieties of Linux were using ext3 (and swap) and the XP was NFTS.

I didn't have any trouble with reinstalls. Everything would work for an hour or two, in one case for a whole day, before crashing. I didn't use any options on installs.

I don't have your problem with getting data off, because for me it was always music which I wanted to archive. It was the actual crashing process you described that sounded like mine.

Sorry I went off air for a few days. Hope you've made progress.

Stan

barebones · 2008-01-22 01:47:41

bjesus: have you tried loading any live cd aside from arch's? I would say a best case scenario would be booting to knoppix, mounting the data partition as you would on a normal install, then copying the text files you want to save directly to a flash drive via usb. This would be Ideal, since you would be able to copy the text files directly (if they're text files, they can't be that big, right?) instead of the shotgun dd approach.

iphitus · 2008-01-22 11:02:27

bjesus wrote:

Hey Stanley! That's starting to sound odd Can you give me more details? Are you using a laptop? What filesystem were you using? Did you managed to format the HD after the damage and then reinstall? Did you too used the --ignsize option?
It seemed to me like the drive was dead. I never thought I could reuse it (and I'm not yet trying to format it since I'm still working on getting my files from it).
What's really wired is that it doesn't seem like the content of the drive is damaged. It's simply shuts down every once in a while, so while reading from it, the link to the drive is gone and nothing can be read from it. That's why dd and dd_rescue is giving me problems - it's copying stuff as it should, but after a few minutes (can be 2 and be 30) it is losing the drive and can't read from it no more - until after few reboots.
Feels like the drive gets hot at shuts itself down or something Stanley, was your experience similar?
any ideas?

try ddrescue like MrGreen suggested. You might get a more useful image to work with.

kiloecho7 · 2008-01-22 16:24:56

Hey, I've recovered files from two dead hard drives before now, here is my advice. It will take lots of time and some money, but it is the surrest way to go I believe. Download the linux distro GRML onto a live CD from http://grml.deb.at/grml_1.0.iso.torrent and then go buy a good screw driver kit and an external hard drive rescue kit from somewhere besides walmart Buy an new external hard drive (bigger than your dead disk, of course) then borrow a friend's computer, boot it up with the GRML, then reformat the new external drive into ext3 with GRML. Now take your dead hard disk from the laptop and plug it into the GRML box with the USB rescue kit. Don't mount the broken filesystem, then use this command to make a workable copy of the old drive.

# dd_rhelp /path/to/dead/disk /path/to/new/disk/folder/where/you/want/nicename.img

then use foremost or photorec (either will get all file types automatically) to get the data from nicename.img

# cd /path/to/new/disk/folder/where/you/want/
# photorec nicename.img

Hope it helps! Please post if you're successful. Best wishes.

kiloecho7

bjesus · 2008-01-22 19:01:18

Hey,
Sorry for not posting for a few days. I can't quite believe I'm still working on it

So, Dell told me that as long as I don't damage the device/the laptop I can take it apart as I wish. So I tried doing a few simple checks - I removed the optical drive, but nothing changed.
I also took the HD outside and had a look at it (wasn't sure what I was thinking to find...), and replaced it back in place. Still the same.

I tried dd_rescue before, it still fails when the HD shuts down. That's why I started believing that there no damage to the data itself, since there were no errors that dd_rescue needed to skip on - there was only a moment when the HD stopped working and since that moment nothing could be read from it.
That's why dd and dd_rescue gave me more or less the same result.

I never heard about foremost and photorec, I'll take a look at that.
Buying this rescue kit isn't much of an option to me. I already recovered my poems using the WayBackMachine website (my website used to have them, and I found it in the archives), and now I'm mostly trying to save my music files, photo albums and some coding projects. Not something that I can afford losing, but I still want to try everything I can without investing money in it. That would go for the new HD...
Though, what I'm doing now isn't too different from your suggestion - I'm starting the laptop with a livecd, not mounting the HD but using dd to back it up to another PC over the home network. That PC has a 320GB HD, so there's no space problem.

Barebones - Yeah, I'm using all kinds of rescue livecds, not only arch's one. Thing is I can't get the filesystem to ever mount, because it needs to check the transaction log, which fails after a around 10 minutes.

Thanks for all the ideas, hope to be back with good news soon.

bjesus · 2008-01-22 19:16:28

Hey, I just read at dd_rhelp that it can be stopped and then resume from where it stopped by reading its logs - I think I'll try to use this function to read through the whole HD!

rhfrommn · 2008-01-23 17:04:50

If you have no success, the last resort is to send it to a data recovery service. The one I know of is Kroll Ontrack, their building was next to one I worked at in an office park in Minnesota. They can recover data from drives with physical damage of all kinds (melted in fire, cracked platters, etc.), so even if it isn't working at all you will be able to get your data back most likely. Only problem is they are NOT cheap - hundreds of dollars would be likely. Depends on what you need to get back if that kind of solution is worth it I guess.

Arch Linux

#1 2008-01-04 11:37:42

Recovering files from a dead HD?

#2 2008-01-04 15:12:49

Re: Recovering files from a dead HD?

#3 2008-01-05 08:05:24

Re: Recovering files from a dead HD?

#4 2008-01-10 16:56:09

Re: Recovering files from a dead HD?

#5 2008-01-11 22:02:40

Re: Recovering files from a dead HD?

#6 2008-01-13 01:15:06

Re: Recovering files from a dead HD?

#7 2008-01-13 08:03:16

Re: Recovering files from a dead HD?

#8 2008-01-13 19:18:12

Re: Recovering files from a dead HD?

#9 2008-01-13 19:39:18

Re: Recovering files from a dead HD?

#10 2008-01-14 19:40:00

Re: Recovering files from a dead HD?

#11 2008-01-16 19:23:12

Re: Recovering files from a dead HD?

#12 2008-01-17 22:11:44

Re: Recovering files from a dead HD?

#13 2008-01-22 01:47:41

Re: Recovering files from a dead HD?

#14 2008-01-22 11:02:27

Re: Recovering files from a dead HD?

#15 2008-01-22 16:24:56

Re: Recovering files from a dead HD?

#16 2008-01-22 19:01:18

Re: Recovering files from a dead HD?

#17 2008-01-22 19:16:28

Re: Recovering files from a dead HD?

#18 2008-01-23 17:04:50

Re: Recovering files from a dead HD?

Board footer