Damaged Hard Disk

From CGSecurity

Jump to: navigation, search

en.png english version de.png deutsche Version es.png versión español fr.png version française ru.png Русская версия


Bad sectors are the most common form of harddisk physical damage. They are early signs of disk crash as it deteriorates over time. A bad sector is a sector on the disk which data cannot be written or read due to a physical damage or inconsistencies of parity checking bits on disk (CRC or Cyclic Redundancy error). To recover your data, the best method is to copy its data to another hard disk before attempting to recover its data.

The new disk must be at least exactly the same size (check the number of LBA sectors) or larger; when larger, it's usually not a problem because the number of heads per cylinder and sectors per head will be the same if both disks use LBA mode. Windows may have some problems in dealing with bad sectors on a damaged hard disk, so the best solution is to use a Linux OS to copy data to another hard disk.

You can also use TestDisk to help analyze the sectors copied from a hard drive with physical problems onto a good drive.

Contents

Booting from Knoppix, a Linux LiveCD

If you don't have a Linux OS installed, download the Knoppix LiveCD , a free bootable CD with a fully functional Linux OS that runs only in memory!

  • Burn the .iso file to CD
  • Boot from the CD-ROM
  • At the boot prompt, type knoppix lang=us for a US keyboard/language.
  • You are automatically logged in as the user 'knoppix' on a GUI console.
  • Launch a Konsole/terminal
    (Note: Knoppix has a separate 'Konsole as root' choice, but copy/paste functions are deactivated in it, so we always recommend using the method described below for gaining root privileges from the normal user Konsole.)

Knoppix comes with TestDisk, PhotoRec, dd and dd_rescue. To access hard disks, you need to run these utilities with root (Administrator) privileges.

  • To become root from the Knoppix user account, select the Konsole and type sudo -s, then press the Enter key.
  • Now you can use all the powerful root commands you need for full disk access from this console.

Note for users of Knoppix version 4.0.2 CD:
To use TestDisk under Knoppix 4.0.2, you need to resolve a library problem by first executing:

ln -s /usr/lib/libntfs.so.7 /usr/lib/libntfs.so.5 

before running testdisk.

Note for users of Knoppix version 5.1 CD:
To use TestDisk under Knoppix 5.1, you need to resolve a library problem by first executing:

ln -s /usr/lib/libntfs.so.10.0.0 /usr/lib/libntfs.so.9 

before running testdisk. This problem shouldn't occur under any other Knoppix versions or with the Linux version avaible from our Download area.

Identifying an HDD's device

Identifying an HDD's Linux device

linux.png Under Linux, the Primary Master IDE disk device is /dev/hda
Primary Slave IDE device is /dev/hdb
Secondary Master IDE device is /dev/hdc and so on.
SATA HDD device filenames usually begin at /dev/hde or /dev/sda
SCSI device filenames always begin at /dev/sda
USB devices often use SCSI device names: /dev/sda etc.

To list the partitions of a particular hard disk, as root, run: fdisk -l device.

Identifying an HDD's Mac OS X device

macosx.png To identify the disk/partition numbers,

  • Start the Terminal program, found in the /Applications/Utilities folder.
  • type diskutil list in the terminal

There are two types of devices:

  • raw devices /dev/rdisk*, communication is direct with the disk.
  • buffered devices /dev/disk*, data transit via buffer.

When using dd or other duplication programs, always use raw device.

In Mac OS X, partitions are labeled with "slices". An example in a volume in GPT format is typically s2, i.e, rdisk4s2.

Disk Duplication

Once you have verified the device names for your damaged disk and the new one to copy its data to, in a command-shell (CLI) or terminal console, not from within any OS on the damaged hard disk, you can start to duplicate the data.

The classic method using 'dd'

dd is very powerful and can be used to write from disks to files and files to partitions or volumes.

  • To copy a disk as root, run
dd if=/dev/old_disk of=/dev/new_disk conv=noerror,sync

conv=noerror,sync is used for disks with bad blocks, where the intent is to replace bad blocks with zero placeholders and continue copying.

  • To copy the disk to an image file
dd if=/dev/old_disk of=image_file conv=noerror

As user under Mac OS X or Ubuntu users, always prepend the sudo command to dd and use your user password to validate the command.

Be careful, if you are copying a disk, the destination must also be a disk, not a partition. If you are copying a partition, the destination partition must be large enough. Copying the whole disk is recommended.

The default block size for dd is 1 block (512 bytes), the command bs= is used to increase the block size. To read/write the disk by 16 sectors at a time, use

  • macosx.png bs=8192
  • linux.png bs=8k

Example commands:

  • linux.png To copy the first ide disk to the second one using 64 block sizes
 sudo dd bs=131072 if=/dev/hda /dev/hdb conv=noerror,sync
  • macosx.png To duplicate an entire disk at disk0 (usually the internal) to another disk (disk1) using 64k block sizes and replacing bad block data with zeros
 sudo dd bs=131072 if=/dev/rdisk0 of=/diskcopy conv=noerror,sync
  • macosx.png To copy a volume on disk 0(the entire partition) to another partition on disk 1
 sudo dd bs=131072 if=/dev/rdisk0s2 of=/dev/rdisk1s2 conv=noerror,sync
  • macosx.png To copy a disk or partition to a file, specify the full path name or the file will be created in the current/default directory
 sudo dd bs=131072 if=/dev/rdisk0s2 /home/john/rdisk0s2.dd conv=noerror

Kurt Garloff's 'dd_rescue'

If you believe there are many damaged sectors on the drive, you can try using either Kurt Garloff's 'dd_rescue' (dd_rescue) instead of dd.

The best method: Antonio Diaz's GNU 'ddrescue'

The best solution, both faster and more efficient, seems to be Antonio Diaz's 'ddrescue' (ddrescue)

# download ddrescue
wget http://download.savannah.gnu.org/releases/ddrescue/ddrescue-1.8.tar.bz2
# extract the source code
tar xjf ddrescue-1.8.tar.bz2
# compile ddrescue
cd ddrescue-1.8
./configure && make
# first, grab most of the error-free areas in a hurry:
./ddrescue -n /dev/old_disk /dev/new_disk rescued.log
# then try to recover as much of the dicy areas as possible:
./ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log

Early detection of bad sectors

Modern hard disks can detect physical problems using SMART Monitoring.


Return to TestDisk

Data Recovery
Security