Damaged Hard Disk
From CGSecurity
english version
deutsche Version
versión español
version française
Русская версия
Bad sectors are the most common form of harddisk physical damage. They are early signs of disk crash as it deteriorates over time. A bad sector is a sector on the disk which data cannot be written or read due to a physical damage or inconsistencies of parity checking bits on disk (CRC or Cyclic Redundancy error). To recover your data, the best method is to copy its data to another hard disk before attempting to recover its data.
The new disk must be at least exactly the same size (check the number of LBA sectors) or larger; when larger, it's usually not a problem because the number of heads per cylinder and sectors per head will be the same if both disks use LBA mode. Windows may have some problems in dealing with bad sectors on a damaged hard disk, so the best solution is to use a Linux OS to copy data to another hard disk.
You can also use TestDisk to help analyze the sectors copied from a hard drive with physical problems onto a good drive.
Contents |
Booting from Knoppix, a Linux LiveCD
If you don't have a Linux OS installed, download the Knoppix LiveCD , a free bootable CD with a fully functional Linux OS that runs only in memory!
- Burn the .iso file to CD
- Boot from the CD-ROM
- At the boot prompt, type
knoppix lang=us
for a US keyboard/language. - You are automatically logged in as the user 'knoppix' on a GUI console.
- Launch a Konsole/terminal
(Note: Knoppix has a separate 'Konsole as root' choice, but copy/paste functions are deactivated in it, so we always recommend using the method described below for gaining root privileges from the normal user Konsole.)
Knoppix comes with TestDisk, PhotoRec, dd and dd_rescue. To access hard disks, you need to run these utilities with root (Administrator) privileges.
- To become root from the Knoppix user account, select the Konsole and type
sudo -s
, then press the Enter key. - Now you can use all the powerful root commands you need for full disk access from this console.
Note for users of Knoppix version 4.0.2 CD:
To use TestDisk under Knoppix 4.0.2, you need to resolve a library problem by first executing:
ln -s /usr/lib/libntfs.so.7 /usr/lib/libntfs.so.5
before running testdisk.
Note for users of Knoppix version 5.1 CD:
To use TestDisk under Knoppix 5.1, you need to resolve a library problem by first executing:
ln -s /usr/lib/libntfs.so.10.0.0 /usr/lib/libntfs.so.9
before running testdisk. This problem shouldn't occur under any other Knoppix versions or with the Linux version avaible from our Download area.
Identifying an HDD's device
Identifying an HDD's Linux device
Under Linux, the Primary Master IDE disk device is /dev/hda
Primary Slave IDE device is /dev/hdb
Secondary Master IDE device is /dev/hdc and so on.
SATA HDD device filenames usually begin at /dev/hde or /dev/sda
SCSI device filenames always begin at /dev/sda
USB devices often use SCSI device names: /dev/sda etc.
To list the partitions of a particular hard disk, as root, run: fdisk -l device.
Identifying an HDD's Mac OS X device
To identify the disk/partition numbers,
- Start the Terminal program, found in the
/Applications/Utilities
folder. - type
diskutil list
in the terminal
There are two types of devices:
- raw devices
/dev/rdisk*
, communication is direct with the disk. - buffered devices
/dev/disk*
, data transit via buffer.
When using dd or other duplication programs, always use raw device.
In Mac OS X, partitions are labeled with "slices". An example in a volume in GPT format is typically s2, i.e, rdisk4s2
.
Disk Duplication
Once you have verified the device names for your damaged disk and the new one to copy its data to, in a command-shell (CLI) or terminal console, not from within any OS on the damaged hard disk, you can start to duplicate the data.
The classic method using 'dd'
dd is very powerful and can be used to write from disks to files and files to partitions or volumes.
- To copy a disk as root, run
dd if=/dev/old_disk of=/dev/new_disk conv=noerror,sync
conv=noerror,sync
is used for disks with bad blocks, where the intent is to replace bad blocks with zero placeholders and continue copying.
- To copy the disk to an image file
dd if=/dev/old_disk of=image_file conv=noerror
As user under Mac OS X or Ubuntu users, always prepend the sudo
command to dd and use your user password to validate the command.
Be careful, if you are copying a disk, the destination must also be a disk, not a partition. If you are copying a partition, the destination partition must be large enough. Copying the whole disk is recommended.
The default block size for dd is 1 block (512 bytes), the command bs= is used to increase the block size. To read/write the disk by 16 sectors at a time, use
-
bs=8192
-
bs=8k
Example commands:
-
To copy the first ide disk to the second one using 64 block sizes
sudo dd bs=131072 if=/dev/hda /dev/hdb conv=noerror,sync
-
To duplicate an entire disk at disk0 (usually the internal) to another disk (disk1) using 64k block sizes and replacing bad block data with zeros
sudo dd bs=131072 if=/dev/rdisk0 of=/diskcopy conv=noerror,sync
-
To copy a volume on disk 0(the entire partition) to another partition on disk 1
sudo dd bs=131072 if=/dev/rdisk0s2 of=/dev/rdisk1s2 conv=noerror,sync
-
To copy a disk or partition to a file, specify the full path name or the file will be created in the current/default directory
sudo dd bs=131072 if=/dev/rdisk0s2 /home/john/rdisk0s2.dd conv=noerror
Kurt Garloff's 'dd_rescue'
If you believe there are many damaged sectors on the drive, you can try using either Kurt Garloff's 'dd_rescue' (dd_rescue) instead of dd.
The best method: Antonio Diaz's GNU 'ddrescue'
The best solution, both faster and more efficient, seems to be Antonio Diaz's 'ddrescue'
(ddrescue)
# download ddrescue wget http://download.savannah.gnu.org/releases/ddrescue/ddrescue-1.8.tar.bz2 # extract the source code tar xjf ddrescue-1.8.tar.bz2 # compile ddrescue cd ddrescue-1.8 ./configure && make # first, grab most of the error-free areas in a hurry: ./ddrescue -n /dev/old_disk /dev/new_disk rescued.log # then try to recover as much of the dicy areas as possible: ./ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log
Early detection of bad sectors
Modern hard disks can detect physical problems using SMART Monitoring.
Return to TestDisk