1

I have a failing external hard drive (WD Passport). It has an ExFAT formatted partition from which I would like to recover as much data as possible. There are one or two thousand files with sizes around 20-40 MB (raw image files).

I made an Ubuntu 16.04 live USB. What tools does it have available that can help me recover data from the drive?

Ubuntu has already been helpful because a simple cp command does not hang on files which it cannot read. After a few seconds of trying it simply says "Input/output error" and moves on to the next file. In comparison, OS X would not mount the volume at all and Windows 10 would get stuck indefinitely on files that couldn't be read. With Ubuntu I got maybe 2/3 of the files using a single run of cp.

Is there anything I can do using Ubuntu beyond having run cp once on the directory I am interested in? Are there tools that can attempt a more aggressive recovery (and would skip the files which were already copied)? Note: I only have a live USB stick (2 GB). At this moment I don't have access to a computer with Linux installed permanently.

Note: I cannot cd into all directories on the broken volume, but the directories containing the files of interest seem to be fine. I am not looking for tools which are designed to look for files that seem to be lost from the file system.

Szabolcs
  • 556
  • I find it difficult to google for a solution. I found several tools to fix an unbootable system or to recover deleted files from working hard drives. But I need something to deal with a broken hard drive that has not failed completely yet. The ExFAT filesystem is a further difficulty. – Szabolcs Aug 31 '16 at 15:29
  • Have a read of Data Recovery, I've used Photorec with some success in the past on SD cards... – AJefferiss Aug 31 '16 at 15:32
  • @AJefferiss Thanks! Is it correct that photorec ignore the file system structure and just extracts anything that looks like an image file? That may not be the best route as I also have more than 1000 GB of images on the same drive which I don't need (already backed up). It is "only" about 50 GB which are in danger of getting lost. – Szabolcs Aug 31 '16 at 15:49
  • Looking at PhotoRec Step By Step it'll just return everything it finds on the device, so not very suitable for what you need @Szabolcs – AJefferiss Sep 01 '16 at 07:08
  • Oh dear, please guys stop recommending carving tools when the file system is clearly accessible! – Andrea Lazzarotto Sep 02 '16 at 09:47

2 Answers2

5

Use rsync. Something like this should work:

rsync -av --ignore-errors /defective/disk /safe/disk

It will copy all files that can be copied. Errors will be ignored, and the copy continues. If you omit that, the copy will stop upon an error.

Do note you might be interested in making a block by block copy of your disk. This will create a huge file. You can do this with dd.

dd if=/dev/defectiveDisk of=/target/disk/block-by-block.imh bs=1G conv=notrunc,noerror

This gives you an image of all recoverable blocks

This image, you can later mount as a loopback device. That way you can concentrate on saving your files without straining the defective disk.

jawtheshark
  • 2,522
  • I was going to try rsync later today, but I was not sure that it can do anything that cp cannot (for this use case). Is it better than cp for recovery? rsync can ignore the files which were already copies before, right? This way it can retry the bad ones multiple times. – Szabolcs Aug 31 '16 at 15:46
  • 1
    Not exactly sure whether cp can ignore errors. There is the -f option, but with a description like if an existing destination file cannot be opened, remove it and try again I'm a bit concerned what "remove" means in this context. rsync is a good tool for these scenarios. One of the advantages is that you can stop it, and continue where you left off. – jawtheshark Aug 31 '16 at 15:49
  • Yes, cp ignores errors well, at least on Linux. I used cp -rnv yesterday. On OS X cp didn't work so well, then OS X refused to mount the volume afterwards ... Should have went to Linux straight away. – Szabolcs Aug 31 '16 at 15:51
  • Actually, you really should have made a disk image and stop working on the disk as soon as possible. – jawtheshark Aug 31 '16 at 15:55
  • 1
    You should use ddrescue on a failing drive, not dd. The noerror option might skip a lot of good bytes depending on the block size. – Andrea Lazzarotto Sep 02 '16 at 09:48
  • That's why you specify the "conv=noerror". It won't stop on error then. – jawtheshark Sep 02 '16 at 09:52
  • If the bs is 1G, conv=noerror will skip 1 GB worth of data even if there is a single failing sector. This is basic knowledge written in any digital forensics textbook. This is absolutely not what you want and the suggestion of using dd is inadequate to say the least. – Andrea Lazzarotto Oct 23 '16 at 13:32
1

Well I recommend a few softwares you can depend on while you have failing HDD to clone. They are dd_rescue, dd_rhelp and GNU ddrescue. Out of these good tools , I prefer GNU ddrescue to go a head with. You can google how to work on these softwares. The above said softwares are all the different variants of famous dd application. GNU ddrescue is the successor of dd_resuce. Meanwhile all these packages are known in different package name in ubuntu and the info can be viewed over here

Community
  • 1
SAGAR Nair
  • 1,385