The way of data recovery
Beginning
Recently, I accidentally dropped down my 320G USB external hard disk. This make me very sad. Because I got some precious data in the hard disk. The hard disk is unable to be detected on Windows 7. Then I tried to connect with two USB ports to provide more power to the hard disk, hopefully it was detectable. Yes, it was detected. Then I immediately used
[code] CHKDSK /v /f /x f: [/code]
This was to hope to fix any file system problem. Then I went to sleep. Late in the night, I found that the CHKDSK was not responding, and the hard disk was stop operating. Unplugged the hard disk, and shut down computer. So, I knew that it was really a bad sign.
Linux
Next day, I boot into the Linux, and tried to use USB 3.0 port for the connection, thinking that it might provide more power for the hard disk. Right, it was detectable with the USB 3.0 port. Then, I mounted the hard disk and preparing to copy out the data. Now, copying the data did not work well, because the hard disk might stop operating and undetectable suddenly. So, I failed to copy out all the files. Then I looked for a better solution.
Unstoppable copier
I found a software, that is unstoppable copier. At first, I found that it was not bad. Because it will automatically skip the unreadable file and continue the copying. However, the problem of hard disk undetected was still existed. As a result, unstoppable copier did not work also.
(Note about unstoppable copier for Linux. The time stamp of the files are not copied with the original time stamp, but I am not sure about Windows version. This will cause the problem, if we want to do the synchronization in the future. Meaning that, if we copy out a corrupted file, since the time stamp is newer, this will overwrite the older file during the synchronization.)
safecopy: partition only
So, I tried for alternative, that was “safecopy”. This is a low level copying utility. By using this, I needed a hard disk greater than the 320G, so that it can copy the whole data to the location. At first, I entered
[code]sudo safecopy /dev/sdb1 data.img –stage1[/code]
This was to copy the partition to a file called data.img.
However, at around 93%, then there is a message something like “cannot read from source”. Because, again, hard disk was not detected. Then, I tried to mount this partially recovered image, but failed.
safecopy: whole hard disk
Next, I tried to enter
[code]sudo safecopy /dev/sdb data.img –stage1[/code]
This was to copy the whole hard disk to a file called data.img.
Yeah. With this command, I was able to copy the whole hard disk to the image file with 100% done. Then, the next problem was coming. I was not able to mount the image file. So, I posted the question to unix.stackexchange.com.
Mounting
To mount the file, firstly, I used
[code]fdisk -lu data.img[/code]
to see the hard disk image partition. Then, it produced,
Disk data.img: 310.8 GB, 310798626816 bytes
255 heads, 63 sectors/track, 37785 cylinders, total 607028568 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xb1bec32c
Device Boot Start End Blocks Id System
data.img1 63 625137344 312568641 7 HPFS/NTFS/exFAT
From here, I thought that everything should be okay. But I failed to mount the partition. I mounted with this command,
[code]sudo mount -o loop,offset=32256 -t ntfs data.img /mnt/temp[/code]
This mount the NTFS partition from the hard disk image with offset 32256. This 32256 comes from 512*63.
Then, the following output was produced,
Failed to read last sector (625137281): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Then, I thought it was partition problem.
Partition problem
Continue to read from other resources for data recovery of NTFS, some mentioned about using parted command, I tried. But it could not print the partition of the hard disk image. That means, the hard disk image has some problem. I then tried the testdisk. It is a tool to solve the partition problem. But I tried, yet it did not work for my case.
Some of the resources mentioned about fsck.ntfs. For your information, there is no such thing yet. Do not waste your time to search for it. They also mentioned about ntfsfix. But it did not work for me, and it will asked for CHKDSK. I also tried ntfsresize, to resize the partition, but not worked also.
Since everything point to the CHKDSK again, I tried to boot into Windows to CHKDSK the disk image, but this command does not work to the image file!
Back to Linux, I tried to use VirtualBox and installed a virtual Windows XP. Hopefully to mount the data.img as a hard disk for the virtual Windows XP, and then can use CHKDSK. But failed again upon mounting the hard disk image.
I also tried gparted with gpart to fix the drive. But failed also.
I think most of the ways, I already tried. So, if you have the similar problem as mine, tried all the utilities I mentioned above.
safecopy again
Since there was no way to mount the hard drive image, I just try to use safecopy again for stage 2. I didn’t tried it, because safecopy with 320G needs too much time for me. And I thought that it was nothing more but just recover a little more. And also, my faulty hard disk might stop operating suddenly. So, I didn’t take this step at the beginning. But then, as a last choice, safecopy again,
[code]sudo safecopy /dev/sdb data.img –stage2[/code]
I went to sleep. Then see the result. Right, the safecopy was not completed, and stop responding, and the hard disk was stop operating. So, the worst case was, I lost most of my data. But, before giving up, try again.
[code]sudo mount -o loop,offset=32256 data.img /mnt/temp[/code]
It works! Yes, it really works.
So, I tried to mount again with my ownership to copy out the file.
[code]sudo mount -o loop,ro,offset=32256,uid=myusername,gid=users,umask=002,noatime data.img /mnt/temp[/code]
Hooray, safecopy! Now I am copying out the files. But, still, some files are not able to be copied. But I solve the faulty hard disk problem.