7. OS X
Imaging a corrupt hard drive
These steps describe my own journey... you will need to adapt them for your own unique set of circumstances. Standard disclaimer applies, as always: You are 100% responsible for your own actions. Using this guide, visiting a link, downloading a program, in short, living, is done entirely at your own risk (and joy).
- Failing 2.5" hard drive, NTFS / Windows XP
- PC with a large internal hard drive formatted as ext3
- USB IDE adapter
- Knoppix 5.1.1 disc
- dd_rhelp, which uses dd_rescue (see IV.3 below for using ddrescue instead)
- Boot computer from Knoppix 5.1.1 disc
- Download and extract dd_rhelp to Knoppix Desktop
- Connect failing drive to USB IDE adapter and plug in
- Partition(s) from failing drive (sda1 in this example) appear(s) on Desktop. Do not mount!
- Mount hda3 (an ext3 partition on PC's internal hard drive with plenty of space) by clicking its Desktop icon and changing read/write mode from the context menu.
- cd to dd_rhelp directory and run:
dd_rhelp /dev/sda1 /media/hda3/recovered.img
- Mount the image as a loop device:
ntfs-3g -o loop /media/hda3/recovered.img /mnt -f
- cd /mnt and check out your files!
- All commands issued from root prompt.
- Had the failing drive been formatted FAT32, step 7 might have been: mount -o loop /media/hda3/recovered.img /mnt
- I used dd_rhelp (as recommended by the author of Knoppix Hacks) and it did a wonderful job. However, in dd_rhelp's readme, the author states that GNU ddrescue is superior to his own tool, so you may want to try that instead:
- Download and extract ddrescue to the Desktop
- cd to the ddrescue directory (e.g., ddrescue-1.9)
- $ ./configure
- $ make
- $ make install
- In the example scenario above, we might use: $ ddrescue -v /dev/sda1 /media/hda3/recovered.img logfile.txt
- dd_rhelp 0.1.2 requires dd_rescue 1.03 or higher. Fortunately, Knoppix 5.1.1 includes dd_rescue 1.11. Also, note that since version 0.1.0, dd_rhelp no longer requires compiling - just extract and run!
- While testing, I managed to use up all 8 loop devices, and began receiving a "could not find any free loop device" error. Rebooting would have solved the problem of course, but a little Googling turned up the losetup command. List all loop devices with losetup -a and delete loops with losetup -d /dev/loop#.
- In my experience, File Scavenger has mounted NTFS disk images that Linux/NTFS-3G could not (despite trying ntfsfix, forcing, etc). I have also seen it recover virtually all desired data from a hard drive that was: partitioned, formatted, subjected to a Windows Vista install, and bombarded with new apps.
- Other Windows-based image mounting apps that may be useful (untested): Mount Image Pro, p2 eXplorer, Partition Find and Mount, ImDisk Virtual Disk Driver, and OSFMount.
- If your image file won't mount at all, you can try Foremost (and other data carving apps) using the CAINE Live CD or your favorite Linux distro.
- DataRescue's DD (DrDD) can image drives reading either forwards (the default) or backwards (which disables the look ahead buffer, thus reducing the risk of lock up on a full track). Windows and Mac binaries available.
- If you create a full disk image instead of a partition image, see Mounting partitions from full disk images for mounting methods.
Mac OS X
- iMac with ailing hard drive booted into FireWire Target Disk Mode (which, alas, is disappearing)
- MacBook Pro
- 9-Pin to 9-Pin FireWire 800 cable or 6-Pin to 6-Pin FireWire 400 cable
- Mac OS X 10.5.5
- Start iMac in FireWire Target Disk Mode by pressing and holding "T" until FireWire logo appears
- Download and extract ddrescue to MacBook Pro
- Disable automounting on MacBook Pro (see OS X: Mount disks as read only or block automounting altogether for more methods):
sudo chflags uchg /Volumes
- Plug in FireWire cable to iMac and MacBook Pro
- Find the correct identifier (e.g., disk2s5) for the iMac partition to recover by running:
- Run ddrescue. In this example, the command could be:
sudo ddrescue -v /dev/disk2s5 ~/recovered.dmg some_log_name.log
- When recovery is complete, attach the disk image to the system as a device:
hdiutil attach -nomount ~/recovered.dmg
You should receive output like:
- Make a mount point (e.g., mkdir ~/temp)
- Mount the device listed in step III.7:
mount -t hfs -r /dev/disk3 ~/temp
- cd ~/temp and have a look at the loot!
- When finished copying recovered data, etc, we need to unmount, detach, and clear the immutable flag:
sudo umount -f ~/temp
hdiutil detach /dev/disk3
sudo chflags nouchg /Volumes
- Thanks to biovizier for his locking idea to prevent automounting.
- ddrescue can be interrupted with Ctrl+C, and will resume from where it left off. You can also resume using the -C option:
sudo ddrescue -C /dev/disk2s5 ~/recovered.dmg some_log_name.log
- Step III.7 was necessary for me, as attempting to mount the dmg file directly returned an error ("no mountable file systems").
UPDATE: The following command might have been able to mount the image by bypassing the file system and disk structure check:
hdiutil attach -noverify -noautofsck recovered.dmg
- Without the force option in step III.11, umount would always return "Resource busy".