0

I have an external that very suddenly conked out on me. It might not be in horrible shape, although I can't be sure.

I just tried to recover it by using ddrescue, straight to a big partition.

sudo dd if=/dev/sdb of=/dev/sda3 bs=4096 conv=notrunc,noerror,sync

It ran for a couple hours and said that 160 bg were copied. I did not make an image, just copied sdb over to sda3.

The disc light was light constantly that whole time, although i didn't hear any noise.

So then after it runs I find that the partition I saved to has lost its label and claims to be empty. Here is the info, sda3 is the partition I saved to:

sudo fdisk -lu

Disk /dev/sda: 2000.4 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders, total 3907029168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x0005901e

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1            2048     4294655     2146304   82  Linux swap / Solaris
/dev/sda2   *     4294656  1172654030   584179687+  83  Linux
/dev/sda3      1172654080  3907028991  1367187456   83  Linux
Note: sector size is 4096 (not 512)

In Gparted, I am told the superblock is bad on this partition. It does offer the option to assign a new UUID to the partition, which I haven't tried yet.

So I don't know what to do now, was the transfer made at all? Is the data on this partition?

I think the bad drive was mounted when I did the transfer, I wasn't warned about it and so didn't notice. I think I can get another copy of the disc but I do want to be careful here. Do I have anything worth working with, and can I get into this drive somehow? I understand that the sector size has changed due to the dd, and also that the error on the external is now on the partition.

But how to access this? Should I have made an image? ANY advice would be appreciated.

  • Do you mean "dd rescue" rather than "ddrescue" (is a separate program based on dd but not equivalent)? I don't see usage of ddrescue in the question. – Karl Richter Sep 20 '14 at 15:23
  • Sorry it was just dd, i used the command above in terminal. – RhZ Sep 21 '14 at 2:22
  • Oh, sorry, I rejected your edit - did not see the your question comment and answer. I will make the change now. – Volker Siegel Sep 21 '14 at 3:27
2

Check the result of dd with echo $? right after termination. It has to be 0! Check the output of dd for obvious error. I don't see the size of /dev/sdb in the question.

Specifying a device file without partition number doesn't copy the partition, but the whole device including the partition table. Either you know which partition to rescue, i.e. specify /dev/sdaX as if argument of dd or make and image of the whole device (better idea), mount it under a loop device, e.g. findout next free loop device with losetup -f, use it with losetup /dev/loopY /path/to/image.img and make the kernel recognize the partitions with kpartx /dev/loopYp? where ? should be the number of the partition you wanted to rescue the way described in you question.

Depending on how severely broken the disk it, i.e. whether further reads might damage it more, and how much space you have on any storage device, make an image of the original or of the copy (the result would be the copy of a copy, but this might prevent damage to the original by reading).

Speed up things: When you use the copy of /dev/sdb on /dev/sda3 (only use it if you have to), you are copying a lot of useless data if /dev/sdb is only 160 GB (the difference between the end of /dev/sdb and the end of /dev/sda3). If you want to skip that, tell dd to only copy the length of /dev/sdb with bs and count argument (man dd is mandatory reading in this case).

Maybe there's a way to tell the kernel with some tweaks that /dev/sda3/ contains a partition table, but I'd consider this rather tricky and experimental.

| improve this answer | |
  • Ok thank you very much, so you think I may have gotten the copy successfully and can make an image of that, I will try that first as I now have lots of drive space and of course want to be careful about getting this data finally. Thanks again Karl, great help. – RhZ Sep 20 '14 at 11:04
  • Great extra info, thanks!. Let me stick some keywords in here maybe it will help people search external hard drive enclosure recover disk make image dd rescue disk copy directions steps process – RhZ Sep 21 '14 at 2:39
0

Making an image is a good idea. Having holes in your data is to be expected. But once you have an image, you can fall back to it.

  1. fsck, if it fails, try again.
  2. Copy partitions to partions, disks to disks.

    • do not copy sdb to sda3 this is "disk to partition", not normal.
  3. If you do copy to a larger area, and fsck is OK, this may be as good as it gets, but you can still mine hex and text from the image. (maybe jpegs even).

  4. If it working and all good, and you have moved to a larger device, you can increase partition sizes and "grow the filesystem to fill the partition".

| improve this answer | |
  • Thanks for the additional input. I am still sitting here with the copy of the entire drive on the partition as mentioned above. I will deal with it soon, I just need to focus and its a bit above my skill level. I need to know clearly how to make the image. – RhZ Mar 10 '15 at 4:02
  • Probably a good idea not to alter it in any way, but copy it back to a new "test" drive. They are cheap enough. Time is a necessary hurdle unfortunately. – mckenzm Mar 10 '15 at 23:08
  • Thanks for your interest, I will try to do it this weekend. I have the disk to receive the image, and will use DD with the command to limit the image to the used space as the partition its on is 1T in size while the disk itself is much smaller, it was pretty full but probably only 150 gb or less in real data. I will report the result here. Thanks again! – RhZ Mar 12 '15 at 8:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.