Testdisk - Is there order in this chaos?

robin_listas · March 6, 2013, 5:04pm

On 2013-03-06 16:06, dmera wrote:
> Thank you Carlos for reply. Well dev has an entry for all the devices
> in a machine and many other things. How would I identify which is the
> new device added?I assume it should be under sdb sdc entry. or there is
> another way to identify it. or under /device/disk/by-*? no luck this way
> so hopefully is just the enclosure. I will added as internal drive to
> see if that would help(i don’t have another enclosure).

You watch syslog as you plug in the device. In a terminal, after doing
su to root, you run “tailf /var/log/messages”, and then, connect the
disk. You see something like this:


> <0.6> 2013-03-06 16:54:35 minas-tirith kernel - - - [18282.654066] usb 1-4: new high speed USB device using ehci_hcd and address 2
> <0.6> 2013-03-06 16:54:35 minas-tirith kernel - - - [18282.770881] usb 1-4: New USB device found, idVendor=0951, idProduct=1624
> <0.6> 2013-03-06 16:54:35 minas-tirith kernel - - - [18282.770885] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
> <0.6> 2013-03-06 16:54:35 minas-tirith kernel - - - [18282.770888] usb 1-4: Product: DataTraveler G2
> <0.6> 2013-03-06 16:54:35 minas-tirith kernel - - - [18282.770890] usb 1-4: Manufacturer: Kingston
> <0.6> 2013-03-06 16:54:35 minas-tirith kernel - - - [18282.770891] usb 1-4: SerialNumber: 001372982D3DA94026330075
> <0.6> 2013-03-06 16:54:35 minas-tirith kernel - - - [18282.771742] scsi6 : usb-storage 1-4:1.0
> <0.5> 2013-03-06 16:54:36 minas-tirith kernel - - - [18283.771928] scsi 6:0:0:0: Direct-Access     Kingston DataTraveler G2  1.00 PQ: 0 ANSI: 2
> <0.5> 2013-03-06 16:54:36 minas-tirith kernel - - - [18283.772296] sd 6:0:0:0: Attached scsi generic sg2 type 0
> <0.5> 2013-03-06 16:54:36 minas-tirith kernel - - - [18283.776195] sd 6:0:0:0: [sdb] 3919872 512-byte logical blocks: (2.00 GB/1.86 GiB)

Notice the “sdb” word in there? Then I know that the usb stick I just
plugged in is seen as /dev/sdb. Otherwise, whatever text appears will
tell you if there is a problem.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

dmera · March 6, 2013, 7:59pm

Thank you Carlos. I checked /var/log/messages but nothing was in there so I thought that something else would log it. I tried again now according to your advice in “real time” to monitor the activity but there is nothing reported to the log. No errors and no connection. The harddisk is making some quiet noises as probably a request is coming to it, for like 10 seconds and then is quiet. I assume that that’s it and I need to call a “funeral service” for it. Any other place where the system would could post the error, other log file?

oldcpu · March 6, 2013, 8:29pm

dmera, with the broken external driver NOT connected, send the command (with root permissions)


fdisk -l

(note that is a lower case ‘L’ ) . Make note of the output of that command (maybe copy it somewhere as you need that output in the next step).

then plug in the external drive and send the same command :


fdisk -l

Take a look at the output and compare it to the output when the external drive is not plugged in. If there is a difference in listed drives, that is possibly the external drive. What do you see for a difference ?

robin_listas · March 6, 2013, 8:44pm

On 2013-03-06 20:06, dmera wrote:
>
> Thank you Carlos. I checked /var/log/messages but nothing was in there
> so I thought that something else would log it. I tried again now
> according to your advice in “real time” to monitor the activity but
> there is nothing reported to the log. No errors and no connection. The
> harddisk is making some quiet noises as probably a request is coming to
> it, for like 10 seconds and then is quiet. I assume that that’s it and I
> need to call a “funeral service” for it. Any other place where the
> system would could post the error, other log file?

No.
Maybe the output of command “dmesg”.
You can increase the verbosity of the kernel log (in
/etc/sysconfig/syslog)), but not much hope there.

However, I would try a different enclosure. I would expect at least the
usb chipset to report its presence, but if it doesn’t, the enclosure is
probably dead (suspect cable connection first). As I said, it is
possible that the HD survived, so you must try another one.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

dmera · March 7, 2013, 1:30am

robin_listas:

On 2013-03-06 20:06, dmera wrote:
>
> Thank you Carlos. I checked /var/log/messages but nothing was in there
> so I thought that something else would log it. I tried again now
> according to your advice in “real time” to monitor the activity but
> there is nothing reported to the log. No errors and no connection. The
> harddisk is making some quiet noises as probably a request is coming to
> it, for like 10 seconds and then is quiet. I assume that that’s it and I
> need to call a “funeral service” for it. Any other place where the
> system would could post the error, other log file?

No.
Maybe the output of command “dmesg”.
You can increase the verbosity of the kernel log (in
/etc/sysconfig/syslog)), but not much hope there.

However, I would try a different enclosure. I would expect at least the
usb chipset to report its presence, but if it doesn’t, the enclosure is
probably dead (suspect cable connection first). As I said, it is
possible that the HD survived, so you must try another one.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

I tried oldcpu suggestion, but no luck. Then I tried to check if dmesg gives anything, nope. I took out the harddisk from enclosure and connected directly inside the desktop, using the DVD cables(SATA and power), to be sure that the cables are good, and no luck, BIOS couldn’t detect it, OS didn’t detect it. I guess is ‘dead’. Thank you for your help.

robin_listas · March 7, 2013, 11:54am

On 2013-03-07 01:36, dmera wrote:
> I tried oldcpu suggestion, but no luck. Then I tried to check if dmesg
> gives anything, nope. I took out the harddisk from enclosure and
> connected directly inside the desktop, using the DVD cables(SATA and
> power), to be sure that the cables are good, and no luck, BIOS couldn’t
> detect it, OS didn’t detect it. I guess is ‘dead’. Thank you for your
> help.

Oh

Then the only method I know is, if the data is very important, a
business that specializes in data recovery, and they charge an awful
lot. Some people have succeed, when having an identical unit, by
swapping the entire electronics from one to the other.

It is an interesting lesson for the many of us that keep backups in
external hard disks… but what else can we do?

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

oldcpu · March 9, 2013, 11:36pm

The same day as typing the above, I ordered over the Internet two new external hard drives (USB-3.0 and 1.5 TB each). They arrived this morning. I copied the backed up ~500 GB on to one of the new external drives, did some more backups and some clean up. I have some more copying to do before I have all my offline data duplicated (ie I am almost there but not quite) … still with this new 3TB to replace the one broken 1TB, I have excess capacity now for storage, and its nice for once to have excess storage capacity.

I’m now trying to figure out what to do with the broken drive. I figure (before discarding) I could either:

try to repair it with TestDisk (as opposed to just reading the data - which works with TestDisk), or
see if I can completely reformat the drive and make it useable again.

If neither of the above succeed, then I’ll throw out the broken drive. None of the data on it is confidential, so there is no need to clobber it with a sludge hammer.

robin_listas · March 10, 2013, 3:48am

On 2013-03-09 23:46, oldcpu wrote:
> I’m now trying to figure out what to do with the broken drive. I
> figure (before discarding) I could either:

If it is a seagate use seatools on it.

Otherwise, do the smartctl long test on it, then do a dd write of the
entire disk with zeros (and I say zero, not random), then run the long
test again. Look then at the bad sector count, has it increased?

If not, and there is no other bad health indicator, you can use the disk
again - but keep it on probation for some time.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

user · March 16, 2013, 5:32am

On Sat, 09 Mar 2013 22:46:01 GMT, oldcpu
<oldcpu@no-mx.forums.opensuse.org> wrote:

>
>oldcpu;2532388 Wrote:
>>
>> Recovery is now complete (I let it run over night) and I think I
>> recovered all ~500 GB on that 1TB broken external drive. But I have NO
>> more spare external drive space left on my other drives. Everything is
>> partially disorganized on my exisiting external drives as I ‘stoll’
>> space from external drives intended for different backup content. I
>> think I may go out this weekend and purchase a couple of new 1.5 TB
>> external drives so I can reorganize better.
>>
>The same day as typing the above, I ordered over the Internet two new
>external hard drives (USB-3.0 and 1.5 TB each). They arrived this
>morning. I copied the backed up ~500 GB on to one of the new external
>drives, did some more backups and some clean up. I have some more
>copying to do before I have all my offline data duplicated (ie I am
>almost there but not quite) … still with this new 3TB to replace the
>one broken 1TB, I have excess capacity now for storage, and its nice for
>once to have excess storage capacity.
>
>I’m now trying to figure out what to do with the broken drive. I
>figure (before discarding) I could either:
>
>
>- try to repair it with TestDisk (as opposed to just reading the data
>- which works with TestDisk), or
>- see if I can completely reformat the drive and make it useable
> again.
>
>
>If neither of the above succeed, then I’ll throw out the broken drive.
>None of the data on it is confidential, so there is no need to clobber
>it with a sludge hammer.

I find it can be more fun to disassemble it to get the platters, they are
good optically flat mirrors.

?-)

oldcpu · May 26, 2013, 11:43am

Just to finish my disk recovery experience relevant to this thread, I did nothing for sometime on this, as other priorities in my life took precident.

This weekend I decided to look at this again. So I pulled out the ‘broken’ external drive, and I tried to repair the external drive with TestDisk, with it recognizing the disk content, and per the TestDisk instructions having what TestDisk recognized written to the disk. After that was complete, I again tried to mount that external drive and read it but it failed. The disk still would not mount.

So I then went to my laptop, booted it to a pmagic liveCD (where I like the pmagic front end for partitioning) and I plugged in the external drive. Pmagic could see there was an external drive, but had a symbol indicating a problem with the drive content container (?) . Seeing this, and using the pmagic partitioning tool, I next in essence created the drive partitioning and re-formatted it as NTFS. That wiped out all data on that drive, but that was no worry as I had ready recovered and backed up that data.

With the drive reformatted, I then plugged it in to my desktop PC and I was able to read/write from that external drive. So it appears functional again, although I am not so sure how reliable it is now. I think I will try writing a terabyte to it, and see how it survives that test.

But if all is well, I now have that external drive back, and functioning.

robin_listas · May 26, 2013, 12:08pm

On 2013-05-26 11:46, oldcpu wrote:
> With the drive reformatted, I then plugged it in to my desktop PC and I
> was able to read/write from that external drive. So it appears
> functional again, although I am not so sure how reliable it is now. I
> think I will try writing a terabyte to it, and see how it survives that
> test.

As there is suspicion that the disk could be damaged (it fell down,
didn’t it?), then I would at least run the long smartctl test.

–
Cheers / Saludos,

Carlos E. R.
(from 12.1 x86_64 “Asparagus” at Telcontar)

leevio · May 27, 2013, 2:55pm

Hello Carlos,

this might be a little off-topic, but judging by your replies you might be able to help me out
instead of me opening a new thread:

I want to try to retrieve data from my dysfunctional (broken) external 640GB hard drive with PhotoRec.

Right now I have two external HDDs connected via USB to my Ubuntu-Netbook:
on the one string the malfunctioning 640GB hard drive,
on the other a 1TB back-up HDD onto which I want to copy files, assuming PhotoRec can find any.

My only concern now is:

how do I even select the FUNCTIONING 1TB hard drive from the PhotoRec menu (see Screensots attached)?
I don’t want to accidently select the broken 640GB hard disk as the directory onto which found data shall be saved
(as otherwise retrieveable data might be overwritten).

Can you quickly advise under which heading / identification
the functioning hard disk can be found in Ubuntu/PhotoRec ?

A quick reply is very much appreciated.

https://imageshack.us/scaled/medium/607/kopiertam27mai2013029.jpg

https://imageshack.us/scaled/medium/43/photorec2.jpg

https://imageshack.us/scaled/medium/221/photorec3.jpg

robin_listas · May 27, 2013, 3:33pm

On 2013-05-27 14:56, leevio wrote:
> Hello Carlos,
>
> this might be a little off-topic, but judging by your replies you might
> be able to help me out instead of me opening a new thread:

Welcome, but it is preferable to start a new thread

> My only concern now is:

Ok, a trick is to plug in only the new disk, and assuming it mounted
automatically (I do not know how Ubuntu does that), create a single file
on it with an editor or touch command, so that you recognize it. Or even
create an empty folder. That way you can recognize the disk from
photorec menu.

The output of the “mount” command will tell you if it is mounted and
where. In openSUSE it would be under /media.

–
Cheers / Saludos,

Carlos E. R.
(from 12.1 x86_64 “Asparagus” at Telcontar)