tinyapps.org / docs / Imaging a corrupt hard drive

These steps describe my own journey... you will need to adapt them for your own unique set of circumstances. Standard disclaimer applies, as always: You are 100% responsible for your own actions. Using this guide, visiting a link, downloading a program, in short, living, is done entirely at your own risk (and joy).

Windows

I. Hardware

  1. Failing 2.5" hard drive, NTFS / Windows XP
  2. PC with a large internal hard drive formatted as ext3
  3. USB IDE adapter

II. Software

  1. Knoppix 5.1.1 disc
  2. dd_rhelp, which uses dd_rescue (see IV.3 below for using ddrescue instead)

III. Procedure

  1. Boot computer from Knoppix 5.1.1 disc
  2. Download and extract dd_rhelp to Knoppix Desktop
  3. Connect failing drive to USB IDE adapter and plug in
  4. Partition(s) from failing drive (sda1 in this example) appear(s) on Desktop. Do not mount!
  5. Mount hda3 (an ext3 partition on PC's internal hard drive with plenty of space) by clicking its Desktop icon and changing read/write mode from the context menu.
  6. cd to dd_rhelp directory and run:
    dd_rhelp /dev/sda1 /media/hda3/recovered.img
  7. Mount the image as a loop device:
    ntfs-3g -o loop /media/hda3/recovered.img /mnt -f
  8. cd /mnt and check out your files!

IV. Notes

  1. All commands issued from root prompt.
  2. Had the failing drive been formatted FAT32, step 7 might have been:
    mount -o loop /media/hda3/recovered.img /mnt
  3. I used dd_rhelp (as recommended by the author of Knoppix Hacks) and it did a wonderful job. However, in dd_rhelp's readme, the author states that GNU ddrescue is superior to his own tool, so you may want to try that instead:
    1. Download and extract ddrescue to the Desktop
    2. cd to the ddrescue directory (e.g., ddrescue-1.9)
    3. ./configure
    4. make
    5. make install
    6. In the example scenario above, we might use:
      ddrescue -v /dev/sda1 /media/hda3/recovered.img logfile.txt
  4. dd_rhelp 0.1.2 requires dd_rescue 1.03 or higher. Fortunately, Knoppix 5.1.1 includes dd_rescue 1.11. Also, note that since version 0.1.0, dd_rhelp no longer requires compiling - just extract and run!
  5. While testing, I managed to use up all 8 loop devices, and began receiving a "could not find any free loop device" error. Rebooting would have solved the problem of course, but a little Googling turned up the losetup command. List all loop devices with losetup -a and delete loops with losetup -d /dev/loop#.
  6. In my experience, File Scavenger has mounted NTFS disk images that Linux/NTFS-3G could not (despite trying ntfsfix, forcing, etc). I have also seen it recover virtually all desired data from a hard drive that was: partitioned, formatted, subjected to a Windows Vista install, and bombarded with new apps.
  7. Other Windows-based image mounting apps that may be useful (untested): Mount Image Pro, p2 eXplorer, Partition Find and Mount, ImDisk Virtual Disk Driver, and OSFMount.
  8. If your image file won't mount at all, you can try Foremost (and other data carving apps) using the CAINE Live CD or your favorite Linux distro.
  9. DataRescue's DD (DrDD) can image drives reading either forwards (the default) or backwards (which disables the look ahead buffer, thus reducing the risk of lock up on a full track). Windows and Mac binaries available.
  10. If you create a full disk image instead of a partition image, see Mounting partitions from full disk images for mounting methods.
  11. As noted below, mounting an image under OS X is a little different:
    # mount -o loop -t ntfs -r recovered.img /mnt/
    mount_ntfs: -o loop: option not supported
    # mount -t ntfs -r recovered.img /mnt/
    mount_ntfs: recovered.img on /mnt: Block device required
    #     hdiutil attach -nomount recovered.img
    Password:
    /dev/disk3
    #     mount -t ntfs -r /dev/disk3 /mnt/
    Check /mnt for recovered files, then:
    # umount /dev/disk3
    # hdiutil detach disk3
    "disk3" unmounted.
    "disk3" ejected.

Mac OS X

I. Hardware

  1. iMac with ailing hard drive booted into FireWire Target Disk Mode (which, alas, is disappearing)
  2. MacBook Pro
  3. 9-Pin to 9-Pin FireWire 800 cable or 6-Pin to 6-Pin FireWire 400 cable

II. Software

  1. Mac OS X 10.5.5
  2. ddrescue

III. Procedure

  1. Start iMac in FireWire Target Disk Mode by pressing and holding "T" until FireWire logo appears
  2. Download and extract ddrescue to MacBook Pro
  3. Disable automounting on MacBook Pro (see OS X: Mount disks as read only or block automounting altogether for more methods):
    sudo chflags uchg /Volumes
  4. Plug in FireWire cable to iMac and MacBook Pro
  5. Find the correct identifier (e.g., disk2s5) for the iMac partition to recover by running:
    diskutil list
  6. Run ddrescue. In this example, the command could be:
    sudo ddrescue -v /dev/disk2s5 ~/recovered.dmg some_log_name.log
  7. When recovery is complete, attach the disk image to the system as a device:
    hdiutil attach -nomount ~/recovered.dmg
    You should receive output like:
    /dev/disk3
  8. Make a mount point (e.g., mkdir ~/temp)
  9. Mount the device listed in step III.7:
    mount -t hfs -r /dev/disk3 ~/temp
  10. cd ~/temp and have a look at the loot!
  11. When finished copying recovered data, etc, we need to unmount, detach, and clear the immutable flag:
    sudo umount -f ~/temp
    hdiutil detach /dev/disk3
    sudo chflags nouchg /Volumes

IV. Notes

  1. Thanks to biovizier for his locking idea to prevent automounting.
  2. ddrescue can be interrupted with Ctrl+C, and will resume from where it left off. You can also resume using the -C option:
    sudo ddrescue -C /dev/disk2s5 ~/recovered.dmg some_log_name.log
  3. Step III.7 was necessary for me, as attempting to mount the dmg file directly returned an error ("no mountable file systems").
    UPDATE: The following command might have been able to mount the image by bypassing the file system and disk structure check:
    hdiutil attach -noverify -noautofsck recovered.dmg
  4. Without the force option in step III.11, umount would always return "Resource busy".
  5. A volume that refused to mount was imaged with ddrescue, but the image would not mount either. Running hdiutil mount -nomount -readwrite foobar.dmg allowed the image to appear in DiskWarrior, which was able to repair the image and make it mountable. See OS X: Imaging and repairing a volume that won't mount for details.
  6. Tools/tips to recover data from a corrupt DMG disk image?
  7. Comparison of ddrescue, HDDSuperClone, and Deepspar's RapidSpar

created: 2008.02.24, updated: 2017.03.21