Data recovery - photorec vs. testdisk vs. ddrescue?

Topics about disk partitioning (fdisk, parted, gparted, partimage), Volumes Management (lvm, evms, dmraid), Storage, file systems, ...
Post Reply
JStevenson
Posts: 1
Joined: 25 Aug 2009, 17:35

Data recovery - photorec vs. testdisk vs. ddrescue?

Post by JStevenson » 25 Aug 2009, 20:37

Hi all,

Wasn't sure which forum to put this under...hopefully this is okay. I have a physically failing Hitachi 250GB Sata hard drive from my Dell laptop (Vista 64bit OS). I've already put it in an external enclosure and have been using this rescue CDs to see the partitions, etc. (since Windows can't see the drive and hangs when trying). I am a noob at Linux however...and at hard drive stuff too. I am keeping the drive on ice packs to avoid overheating and additional damage.

I've been running Photorec and managed to recover a whole variety of files, except of course the two Open Office (.odt) files I most desperately want. The Photorec log shows input/output errors as it tries to read sectors. I know there are a whole variety of bad sectors and the drive seems to physically have more difficulty at the beginning of the NTFS partition with all the data. I have done basic analysis with Testdisk as well but didn't want to try file system repair before getting everything I could off the disk.

So here are my questions (please pardon errors in terminology - I'm still learning):
1. Will other approaches besides Photorec be likely to recover more or different data? Things like Testdisk or ...? Would repairing the filesystem (if possible) make fragmented data more likely retrievable since the size/location of files might be recovered?

2. Would it be worth using ddrescue (Diaz' version) to either image or clone my drive before playing around with filesystems? And is an image or file-type copy better?

3. If ddrescue is worth trying, how do I set up my external target drive? I have a WD external HD that is the same size as my failing laptop drive. I recently wrote zeros to it to erase all data however, so it has no partition table. To do either the image or the file copy, how should I reformat/partition my WD HD (fat32? NTFS? multiple partitions or one big one?)? And if I only image the main NTFS partition of the failing drive, will I still be able to use tools like Testdisk on the image?

4. Is data that you use frequently more likely to be at the beginning of the partition? I don't quite get how data is stored on a hard drive. My drive was pretty new so I'd only used a small portion of the 250GB. Can I focus on the first part of the partition with Photorec, etc. or do I need to run it through the entire drive?

Thanks so much for your time!
Jen

RobertCarnegie
Posts: 8
Joined: 13 Nov 2009, 21:25

Re: Data recovery - photorec vs. testdisk vs. ddrescue?

Post by RobertCarnegie » 13 Nov 2009, 22:23

Well, a little basic information about bad sectors: as far as I know, those are detected when a checksum stored on the hard disk after each 512 bytes of data does not apparently match the data. So a file that has one bad sector in it may have up to 512 data bytes converted to nonsense. Sometimes that is tolerable, sometimes it's fatal. Opening the file in an application program like OpenOffice, it may only give up; copying the file at operating system level, you may be able to choose to retry reading the sector which this time may match, or to accept whatever data came from the disk, although it is probably wrong data. (However, the checksum could be the part that's wrong.)

But it probably isn't just one bad sector...

If the disk passes Windows CHKDSK or other tests EXCEPT bad sectors, AND if you can run it for a long while without new failures appearing, then Partimage may be appropriate (backup and restore, including disk partitioning information). But I'm not sure what will happen to the bad sectors - you want to know that they're bad. You probably want to - excuse me, you should - install or restore Windows from CD or a reliable backup, instead of using the failing disk, if bad sectors are affecting Windows itself.

But you could copy your sick partition to a new disk and then repair and then shrink the copy, cutting some of the empty space out of the partition, then back that up - then install Windows onto a new disk using less than the whole disk - or install it and then shrink its partition too - and then restore the shrunk copy of the sick disk alongside your new Windows partition.

My Windows has about 15 gigabytes partition for Windows and a few applications - I say "about" because I haven't decided whether to add space for a hibernation file. My idea is to be able to use Partimage to make a backup of Windows itself, initially to another partition, that can be can be stored on one DVD. Files not on the system partition are a lot easier to look after.

I thought Partimage had a "raw data" option that didn't worry about the format of a disk and just copied everything including empty space (but compressed it, so if your empty space is also blank then it squeezes down), and then you could copy the disk and then "repair" the copy - but then you're even more needing to have the sick disk run for a long time successfully. But maybe that's avoidable. Anyway, if you copy the partition table to the new disk then you can probably just copy the whole volume with the dd command, treating it like one big file.

One thing - apparently there is a serious problem with the GParted partition tool 0.4.8 that I think may also affect SystemRescueCD 1.3.2. That's why I signed up here mainly... details, such as they are, at
https://bugzilla.gnome.org/show_bug.cgi?id=601574
(There is a strange message there about an invalid security certificate, in my Opera browser, looks OK but a bit worrying)

So you might want to use disk 1.3.1 instead - if that isn't affected.

I also discovered that while Partimage can restore the backup of partition table itself that is included in Partimage backups by default, it can't do it if you are reading the backup from the disk whose partition table you're trying to replace. Maybe to more expert people that's obvious.

Then again, maybe you should look at commercial data recovery products. It isn't easy to get data out of bad sectors though... but commercial products can do sophisticated things like restoring a partition copy to a different size volume.

Post Reply