How to rescue data from a crashed disk on a Debian GNU/Linux system

From NewbieDOC

Contents

1 Summary

Here are some suggestions from the Debian-User list (August 2007 and September 2007) for recovering data from a crashed hard disc or floppy disc. They were used successfully by the original poster.

2 Outline procedure

The most important thing is to avoid using the disk as much as possible (do not apply power, do not 'spin up' the disk).

Then you need a set up to 'rescue' the data. If you have a second computer with Linux then you're off to a good start. You will need to:

2.1 Create an image of the failed disc

Determine how large a disk you need to create an image of the partitions on your failed drive. Of course you probably need to go out and buy some storage...

Copy all readable blocks from the failed drive.

The tools for this allow you to power up the bad drive and copy whatever is possible with the minimum use of the disk. It is not unusual for a disk to be permanently destroyed during this process or shortly afterwards - no fault of the tools, that's just the general way a disk fails.

I would suggest 'ddrescue' which acts like 'dd' but skips bad blocks and simply moves on to the next block. This is the behavior you want - you don't want to attempt a retry at this stage because that can make matters worse. After your image recovery operation then you may consider a second image using something like gddrescue to try to get even more data.

It is very important that you don't try to hurry things - remember you will be lucky to have 1 shot at recovering data from a bad disk; you need to make absolutely sure that first try goes without a flaw. After setting up, practise using these tools on another disk - maybe a faulty floppy, or even just a good disk. You really don't want to make any mistakes when you get to the real job; especially not with a 'dd'-like tool.

Once you have recovered an image with ddrescue (and maybe a second image with gddrescue) then you can take your time finding other recovery tools to extract even more data. Remember to mark these images 'read only' - you don't want to accidentally write to them.


2.2 Examine the image for the data you want

I would suggest the 'testdisk' package. It is generally used when people accidentally wipe the partition table, but it has good tools for recovering photos.

You can try to repair your partition table with TestDisk and/or to recover your photos with PhotoRec; both these tools are available in package "testdisk".

The "scalpel" package is another option for trying to extract the files if you cannot restore the partition table.

Content is available under GNU Free Documentation License 1.2, unless otherwise stated.