Yet more data recovery

Got a hard drive that has confounded ZeroAssumptions. Doh! It has obvious bad sectors.  Time to Clone.

Found another that is the same size and grabbed a copy of HDD Raw Copy Tool from Here.

Cloning the drive to the good one.  Just waiting for that to finish, then I can run ZA on the clone.  Fingers crossed I get it mostly back.

Update:

HDD Raw Copy Tool seems to work... up to a point. It has crashed twice (requiring a complete restart) and gracefully exited once (at 30% complete) claiming that the device was removed.

The interesting thing is that even with a partial image recovered... the destination disk will mount and seems to have a readable partition table and file allocation table.  Shame it will not get all the way through.  Anyway, after wasting 4 days on it... its time to move on.

The interesting thing from HDD Raw Copy was that it consistently hit the same 5 patches of errors.  After which it seems to happily copy at a good pace without missing a beat... until it stopped working.  Would love to be able to re-start the copy at arbitrary offsets.  Which leads me to...

I have been looking at ddrescue and decided it was the next option. It has the ability to stop and restart and lots of other interesting options. Fairly cryptic UI... but thats fairly normal for cmd line tools in linux land.  I also have issue with how vague some of the help files are... but then I'm not really spoilt for choice at this stage.

First attempt, boot a Ubuntu live cd and install gddrescue... failed miserably with various errors. Mostly to do with not being able to find the repository.  Still a bit new at that so I figure its more to do with it being a live CD than a full install.

Second attempt, got a copy of Ubuntu-rescue-remix which already has ddrescue installed.  Boot... to a bit of a weird terminal screen as the shell.  Fair enough. (Not exactly luxury but functional enough)

Introduced the USB drives (the damaged one and the one I want to copy to) one at a time so I could figure out what the device names were.

/dev/sdb1 is my source device
/dev/sdc1 is my destination device

I have to bugger around with mounting and unmounting them until ddrescue seemed happy to proceed. This was a bit of trial and error as the error messages were as usual completely cryptic.

My final setup was to allow the destination device to automount, which sorted it out as read/write with all the usual mounting options.  While the source device automounted when I plugged it in, but I then unmounted which made ddrescue happy.

sudo umount /dev/sdb1

Then its just a case of figuring out how to run ddrescue.

The command I ended up using was straight from the manual example.

sudo ddrescue -f -n /dev/sdb1 /dev/sdc1 logfile

In hindsight (after reading a bit more) it may have been interesting to add the -v flag (for verbose) but I can live with it as it is.  It would also have been better to give the logfile a more meaningful name.

Anyway, its rolling and seems happy at the moment.  Has already foun one error...

Update:

So after about five days copying... (there was a weekend in there, so my estimate is about ~4 days) the clone has finished successfully. Only about 8MB and change that it could not copy.  Not bad for about 8 reported errors. 

Anyway,  now back to Windows and ZeroAssumptions. 

ZA is totally ripping through this scan.  Its done the first two passes in about two hours and is well into the third already.  (For comparison, to get to this stage on the old disk took about 3 days... which was shorter once I tuned the timeout period and the bad sector skip factors... got it down to two days or so)

Feeling quietly confident...

So you formatted your hard drive... oops.

Here is the scenario:

You have a huge external USB hard drive (2T or so) full of who knows what... but generally things you want to play through your TV. 
You see a USB port on the side of the TV.  You plug in the hard drive.
The TV then formats the hard drive to a RAW format for you.  (Yes there may have been some message that might have explained that in cryptic terms or expected you to have read the manual before doing this reasonable act. No one remembers the message or cares...)

Result... lots of crying, then finding your favorite IT guy(non gender specific) and asking them if they can fix it.

Favorite IT guy guesses pretty much what has happened.  (Shit message from TV which clearly did not articulate the consequences. Shit Interface on the TV and generally Shit TV... did I mention I hate TV's? They work... but in their own little fantasy land of propietary unicorns with non standard horns and cryptic software goblins who are clearly not customer focused. The first phrase they learn after Saruman pops them out of the birth goo is "customer lock-in". They can all go and suck my troll. )

Anyway, when confronted with a drive that has been partially or completely formatted as RAW... what does one do?

One gets a copy of Zero Assumptions Data Recovery, One sets aside a couple of days to scan the drive and find all the lost files ( and everything else that has been deleted..ever) then one copies the found data to another drive big enough to hold it all. (670G in this case) which took about another 2 days as it was between two large USB drives. Then format the old drive back to Fat32 using GPartEd.  Then One copies all the found files back to the old drive... again across USB so again taking acouple of days.  One then hands the fixed drive back to the owner... has "the talk" about not doing it again, and returns to what they were previously doing.... a week and a half later.

The owner then spends a few days deleting everything they had previously deleted and trying to figure out the folder names and hierarchy they previously had. 

Job done.

Digital Forensics

https://www.infosecisland.com/blogview/16705-Digital-Evidence-and-Computer-Crime.html

Article on digital forensics.  Interesting overview with some references.

Data Recovery Event...

http://www.datarecovery.com.au/html/Contact.html

Service I'm using in anger.  Bad things happen to people who don't back up... and get distracted by work and stuff....

Yah Fear me. I am geek and know all... who am I kidding? Current generation hard drives are way beyond my capability to recover.... I bow to the professionals and suck up the cost as a learning experience. Long story... don't ask.

Data Recover on a WD Mybook 500gig drive

The drive is partially functional but has a heat based failure fairly soon after warming up. I have dismounted the drive IO board and it shows obvious discoloration around the major SMD's. I have tried using a fan to keep the IO board cool but without any luck. Apparently due to storing the firmware on the actual drive rather than on the IO board its much harder to simply swap the IO board on modern drives. Hence this job is rapidly getting out of my reach. I have recommended that the client pass the job to an external professional who can do the job. The quote is $495 which I thought was very reasonable to recover a few hundred gigs. Anyway its in the clients hands now.

There seems to be a bit of noise on the web about Western Digital drives failing in the MyBook series so I may have to re-think my attitude to Western Digital being a nice stable brand. Go figure.