Thursday, January 06, 2005

Rescue contents of a sick hard drive

How to rescue the contents of a sick hard drive without spending any money. Or why you need a copy of Knoppix laying around. Knoppix is a bootable linux CD that runs completely off the CD.
Rob's daughter's laptop would only boot part way into Windows XP and then halt. Windows recovery couldn't fix the problem and it looked like the hard drive was dieing (chkdsk was failing, etc.) So the next thing we tried was booting Linux using Knoppix. Once Knoppix booted up we did the following:

1. Attempted to mount the drive... that failed with something about bad drive type.

2. Attempted to use partimage to backup the drive... that failed with similar error.

3. Ran badblocks on the drive and got intermittent indications of bad blocks.
(Then Jonathan stepped in and did the following.)
4. He used raw dd to copy the contents of the drive over the network to another machine running Knoppix.
   for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18; do

dd if=/dev/hda of=/mnt/other/rob_dd.img.$i skip=`echo $i * 2097152 bc` count=2097152;
done


(2097152 is 1GB divided by 512bytes - the sector size)

5. He then concatenated the files together.
   for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18; do

cat /mnt/other/rob_dd.img.$i >> /mnt/other/rob_dd.img;
rm /mnt/other/rob_dd.img.$i;
done


6. Next, mount the file as a drive using Linux's loopback device. The gory details of using Linux's loopback device are explained by this link. Since the drive only had one partition which started at sector 63, the offset was 63 * 512 bytes => 32256 bytes.
   mount -o loop,offset=32256 -t ntfs  rob_dd.img /mnt/rob_dd


7. cd /mnt/rob_dd

8. Copy all the data you want from the "drive".

1 comment:

Heifner said...

Here is a nice related link:
http://www.shockfamily.net/cedric/knoppix/