Any way to recover my 3TB USB HDD?

Question

I've got this 3TB USB HDD for which Ubuntu reports the following

Jul 15 13:30:00 ris kernel: [11395.274460] usb 1-1.3: New USB device found, idVendor=152d, idProduct=2329
Jul 15 13:30:00 ris kernel: [11395.274474] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=5
Jul 15 13:30:00 ris kernel: [11395.274477] usb 1-1.3: Product: USB to ATA/ATAPI bridge
Jul 15 13:30:00 ris kernel: [11395.274479] usb 1-1.3: Manufacturer: JMicron
Jul 15 13:30:00 ris kernel: [11395.274481] usb 1-1.3: SerialNumber: 71F14D08
Jul 15 13:30:00 ris kernel: [11395.275147] usb-storage 1-1.3:1.0: USB Mass Storage device detected
Jul 15 13:30:00 ris kernel: [11395.275324] usb-storage 1-1.3:1.0: Quirks match for vid 152d pid 2329: 8020
Jul 15 13:30:00 ris kernel: [11395.275401] scsi9 : usb-storage 1-1.3:1.0
Jul 15 13:30:00 ris mtp-probe: checking bus 1, device 6: "/sys/devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3"
Jul 15 13:30:00 ris mtp-probe: bus: 1, device: 6 was not an MTP device
Jul 15 13:30:01 ris kernel: [11396.306993] scsi 9:0:0:0: Direct-Access     ST3000DM 001-9YN166       CC9F PQ: 0 ANSI: 5
Jul 15 13:30:01 ris kernel: [11396.307439] sd 9:0:0:0: Attached scsi generic sg3 type 0
Jul 15 13:30:01 ris kernel: [11396.308206] sd 9:0:0:0: [sdc] Very big device. Trying to use READ CAPACITY(16).
Jul 15 13:30:01 ris kernel: [11396.308685] sd 9:0:0:0: [sdc] 5860533168 512-byte logical blocks: (3.00 TB/2.72 TiB)
Jul 15 13:30:01 ris kernel: [11396.309648] sd 9:0:0:0: [sdc] Write Protect is off
Jul 15 13:30:01 ris kernel: [11396.309654] sd 9:0:0:0: [sdc] Mode Sense: 28 00 00 00
Jul 15 13:30:01 ris kernel: [11396.312843] sd 9:0:0:0: [sdc] No Caching mode page found
Jul 15 13:30:01 ris kernel: [11396.312849] sd 9:0:0:0: [sdc] Assuming drive cache: write through
Jul 15 13:30:01 ris kernel: [11396.313668] sd 9:0:0:0: [sdc] Very big device. Trying to use READ CAPACITY(16).
Jul 15 13:30:01 ris kernel: [11396.339275]  sdc: sdc1 sdc2
Jul 15 13:30:01 ris kernel: [11396.340615] sd 9:0:0:0: [sdc] Very big device. Trying to use READ CAPACITY(16).
Jul 15 13:30:01 ris kernel: [11396.378241] sd 9:0:0:0: [sdc] Attached SCSI disk

lsusb

Bus 001 Device 006: ID 152d:2329 JMicron Technology Corp. / JMicron USA Technology Corp. JM20329 SATA Bridge

fdisk -l

Disk /dev/sdc: 3000.6 GB, 3000592982016 bytes
255 heads, 63 sectors/track, 364801 cylinders, total 5860533168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00052cdb

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1       196626432   732566271   267969920    7  HPFS/NTFS/exFAT
/dev/sdc2             256   196626431    98313088   83  Linux

gparted says unallocated, Windows says unallocated. Is there any way I can recover this HDD?

Answer 1

This is an explanation of what I personally would do in your situation. What I am about to say will void your warranty. So first, if you have a warranty, look into that. If not, consider this.

I would remove the hard-drive from the USB enclosure. I would guess that the device is most likely SATA. I would then install the SATA hard-drive into one of my desktop PCs. At that point, barring a more serious hardware malfunction, I would boot into Linux, and look at the disks SMART data, using the disks utility (gnome-disks). If you make it that far, please post back with the SMART data.

If the disk has IO errors, or failed sectors, or any thing like that, but still runs, I would get myself another 3TB or larger disk, and clone to that media.

If the disk causes boot problems, or system instability, or is just not recognized, not spinning up, or something else like that, I would consider professional data recovery.

if the disk is recognized, and or mounted, but my files are missing, I would post back with that detail.

if Every thing were there, and or the disk is operational, SMART data is okay, and I get my files back, I would know that the USB interface was the cause of the problems. I would then be done.

Else report results and I'll modify my answer.

Again, what I am recommending, is at your own risk, and liability, remove the hard-drive from its USB enclosure and evaluate the hardware condition first.

Answer 2

Before I did anything else with it, I would highly recommend making an image of the drive, mark it read-only, and play with that. Spending more time than necessary with the physical drive attached increases the odds that something's going to go wrong -- either a physical defect is going to get worse, or you're going to accidentally do something stupid.

The classic

dd if=/dev/sdc of=/somewhere/with/3TB/of/free/space.img

can be used if there are no physical problems with the drive, but if there are, it'll bail and you'll be stuck with a partial image, starting over again.

There are better dd-like variants that handle errors more gracefully. At minimum, it needs to skip over errors, leaving you zero'd blocks. Better ones retry. Smart ones don't retry right then, but rather remember them and go back to retry after getting the rest of the disk. A better tool, if it gets more than one error in a row, won't keep reading sequentially, hammering on the same section of the disc, but rather will skip increasingly large sections on the 1st pass until it gets an error-free read again. The ability to create a sparse image file so you don't necessarily need 3TB of free space is nice too.

"safecopy" is one dd-like program that will ignore errors so you can get a full image. For my last physical-recovery job I finally settled on GNU DDRescue. Here's how it might be used:

ddrescue -r 3 /dev/sdc /somewhere/with/3TB/of/free/space.img /somewhere/else/recovery_work.log

Once you have another copy of your data (the disk image file) you can breath easier and actually start trying to get your files. As someone else mentioned, photorec is a great program for finding deleted files, even with no directory entry (including raw disk search where there is no partition data). It works by searching the disk sectors for the "magic numbers", or byte pattern at the beginning (and sometimes further in) that are unique to a particular file type.

Answer 3

When lightening knocked out my external 3TB WD HDD, I removed it from its case. The PS in the case was toast, but the HDD worked, sort of. When I installed the drive in my computer, it displayed a very old partition table I had not used in years.

I ran ddrescue (it took 7+ hours to run) to recover my data. I was able to recover a very few of my more important files, but I lost the majority of what was on the drive.

The drive itself works flawlessly now.

The biggest problem I had was that I created and deleted partitions very many times on the HDD. Each partition table was still there as well as a list of all the files in them. I have come to the conclusion that I really need to do a disk wipe before changing partitions if I expect to recover data from the drive again.

Before removing the drive from the cabinet, I had to decide if the data I needed was more valuable than the drive. I killed a 3 year warranty 3 months after purchase, and I even purchased the extended warranty for 5 years. It sucks, but it's a choice.

Answer 4

Have you tried partition scanner yet? Testdisk is a great tool. Also, if you have access to a Windows machine, I have had a lot of luck with "FileScavenger"

Answer 5

You could try badblocks for finding bad sectors in HDD and then ignore these sectors for future use. more information is in here

http://linuxpoison.blogspot.in/2008/01/howto-check-disk-drive-for-errors-and.html

then use recovery software.