Recover data from failing hard drives with ddrescue

In some cases when a hard drive starts to fail you can still access most of the hard drive and browse files, etc.  The computer might start up and you might experience system instability or it might start locking up repeatedly.  If any of those symptoms start showing up you should copy your files off of the computer and onto other media and then replace the hard drive.

We had an instance recently on a Windows 7 Pro workstation where a drive started to fail on us but the problem was that there was a 16GB Outlook PST for someone’s archives on it that we needed to salvage.  This was the only file we couldn’t copy off of it.  We decided that we would need to copy as much of the file as we could and then repair it with ScanPST or something similar.  We used DDRESCUE with a Slax 7 Boot USB image to image the failing hard drive (or what could still be read of it) over to another hard drive and at that point we were able to run ScanPST from connecting that drive to another Windows computer.

1. First, you’ll either need to download the Slax 7 .iso and burn to CD or use the instructions to create a bootable USB device.  We used the USB option.  Here’s the download link:

http://www.slax.org/download.php

2. Connect another blank hard drive along with the failing hard drive to a host computer.  This is where the copy process will happen so it needs to be left along for a while while this processes.  This doesn’t necessarily have to be the same computer from where you pulled the failing drive.

3. Boot the computer you’re using as the host for the recovery into the Slax operating system from the CD/USB drive.

4. Open up a terminal window.  These are the commands with a screenshot below: (comments are in parentheses on the right and are not part of the command)

  • su (enter admin mode)
  • fdisk – l (that’s a lowercase L and is used to determine which drive is which.  In my example you can see the 1.5TB drive as not having any partitions on it in contrast to the 1.0TB drive).
  • hdparm -I /dev/sda (this will show you the serial numbers of the drive at /dev/sda so you can verify for sure which drive is your target. This is especially critical if both drives are the same size)
  • ddrescue -r 1 /dev/sda /dev/sdb –force (this will copy as much of the drive as possible from my 1.0TB drive to my 1.5TB drive, retrying errors that it finds only 1 time)

5. Pull the drive out and attach it as a secondary drive to another Windows system and try to pull as many files off of it as possible.

ddrescue drive copy commands

ddrescue drive copy commands

In our case, we were then able to run ScanPST on the 16GB file and recover most of the email that was included in the file and it no longer crashes the computer when working with that email archive.

Hope that helps someone somewhere with this idea.

 

About Jeremiah

Windows operating system advocate in Houston, TX.
This entry was posted in Data Recovery, Uncategorized and tagged , . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *