Rescuing data

[Bill]

I'm struggling with son in law's Windows 10 laptop, which has been
brought here for urgent repair.
Running W10, it gets to the repair startup within W10, then stops. It's
a UEFI machine.
I tried to copy the HD contents (4 partitions) using a Linux boot, but
it couldn't read from the main partition.
Removed HD and started to copy contents to a 2TB usb drive using a W7
machine , but it stalls saying "items remaining 0 (14.4 GB)". The file
where it stops is qtnetwork4.dll, if that matters.

I suspect the HD has died, but don't want to do anything drastic before
I copy everything possible off.

Is my best hope to try to learn how to use ddrescue asap?
--
Bill

[David]

Sounds like a plan.

You have my sympathy; I have SSD problems at the moment waiting to come to
the top of the queue.


Cheers

Dave R


--
AMD FX-6300 Windows 7 Pro x64

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

[Mike Tomlinson]

En el artículo <yF8yECqj...@end.of.the.universe>, Bill
<Billa...@gmail.com> escribió:

>Is my best hope to try to learn how to use ddrescue asap?

Yes. Boot off a Linux live CD or DVD, and instead of copying the contents of
the dodgy disk, make an image of it to the external 2TB USB drive you have.
Work with the image.

I would be better if you interact with the failing disk as little as
possible. Laptop/2.5" disks have a habit of dying suddenly once problems
develop.

dd if=/dev/sdX of=/mnt/2TB_USB_disk/b0rked_laptop_disk.img bs=512

or whatever syntax ddrescue wants.

lsscsi will how you which disk is which sdX.

[root@nas1 ~]# lsscsi
[0:0:0:0] disk SanDisk Extreme 0001 /dev/sda
[3:0:0:0] disk ATA SAMSUNG HD204UI 0001 /dev/sdb
[4:0:0:0] disk ATA SAMSUNG HD204UI 0001 /dev/sdc
[5:0:0:0] disk ATA ST2000DL004 HD20 0001 /dev/sdd
[6:0:0:0] disk ATA ST2000DL004 HD20 0001 /dev/sde
[root@nas1 ~]#

There's two versions: ddrescue, and dd_rescue, one is better than t'other. I
can't remember which, sorry. Someone else here may know.

--
(\_/)
(='.'=) systemd: the Linux version of Windows 10
(")_(")

[Johnny B Good]

ddrescue is the one to use. dd_rescue, afair, was basically a script
which manipulated dd. ddrescue is everything (and more) of dd_rescue
compiled into a self contained data rescue program. It's been around for
quite a few years now and is often included on most Live CD versions of
Linux, including the eponymous Knoppix 5.xx Live DVD (and possibly the CD
versions around the same vintage) as well as on the last free version of
Parted Magic.

The only important thing you *must* keep in mind is that you correctly
identify which is the failing drive that needs rescuing and which is the
target drive or folder you want to clone or image to.

The nice thing about the Knoppix Live DVD way of using ddrescue is that
the desktop GUI shows icons for each HDD partition mounted (read only by
default) which clearly indicate the device root path (eg /dev/sda1 for
say a winXP HDD "C drive") otherwise you land up using gparted or another
partitioning tool to display this information (or even a SMART reporting
tool).

--
Johnny B Good

[Bill]

In message <%ei%z.108612$kM7....@fx44.am4>, Johnny B Good
<johnny...@invalid.ntlworld.com> writes

> The nice thing about the Knoppix Live DVD way of using ddrescue is
>that the desktop GUI shows icons for each HDD partition mounted (read
>only by default) which clearly indicate the device root path (eg
>/dev/sda1 for say a winXP HDD "C drive") otherwise you land up using
>gparted or another partitioning tool to display this information (or
>even a SMART reporting tool).

Got a new HD in and copied a load of data across, and that all appears
fine, except that he will have to re-install the programs himself.

I've made a Knoppix thumb drive, run ddrescue on the old drive and it
looks as though something is happening. It appears to be 290megs into
the 750gig drive. It is saying "Scraping failed blocks", but perhaps
it's best not to understand the messages.

There was a long delay when I started Knoppix and got "ifcpu64.c32 not a
com32r image". Eventually, after a Google and guesswork, I hit tab and
typed "Knoppix" and it all started.
--
Bill

[Bill]

In message <UVX7wI4M...@end.of.the.universe>, Bill
<Billa...@gmail.com> writes

>Got a new HD in and copied a load of data across, and that all appears
>fine, except that he will have to re-install the programs himself.
>
>I've made a Knoppix thumb drive, run ddrescue on the old drive and it
>looks as though something is happening. It appears to be 290megs into
>the 750gig drive. It is saying "Scraping failed blocks", but perhaps
>it's best not to understand the messages.
>
>There was a long delay when I started Knoppix and got "ifcpu64.c32 not
>a com32r image". Eventually, after a Google and guesswork, I hit tab
>and typed "Knoppix" and it all started.

Well, that didn't seem to go well. I followed the instructions at
https://www.technibble.com/guide-using-ddrescue-recover-data/
and ddrescue gave the impression of working for about 4 hours. It had 3
passes of trying to recover bad blocks, then said Finished.

The directory on the destination disk had an img and log file The img
file gave its size as 0bytes, the log file, 1KB and reads

# Rescue Logfile. Created by GNU ddrescue version 1.19
# Command line: ddrescue -d -r3 /dev/sdc test.img test.logfile
# Start time: 2016-11-30 15:52:34
# Current time: 2016-11-30 20:00:51
# Finished
# current_pos current_status
0xAEA8CDDE00 +
# pos size status
0x00000000 0xAEA8CDE000 -

If I now put the problem drive into a W7 machine via usb, it says the
device is malfunctioning, but I can still see data in the partitions.

Any advice before I talk this through with the son in law? He is a
teacher under major ofsted stress at the moment.

--
Bill

[Mike Tomlinson]

En el artículo <MoctPy8i...@end.of.the.universe>, Bill
<Billa...@gmail.com> escribió:

>Any advice before I talk this through with the son in law?

Why did you use the -d (direct access) parameter? it's not needed here.
Try again without.

If that fails, try telling ddrescue to go in the other direction -
working backwards from the end of the disk. If the fault is near the
start of the disk and the rest of the disk is okay, that may get you all
the data back intact if the usual silly M$ reserved partition is present
and the fault is within that.

ddrescue -R -v -r 3 /dev/sdc test.img test.logfile

Personally, I wouldn't bother wit the log file and would just watch
ddrescue as it goes. You can add a second v ('-vv') for more detail.


[root@nas1 ~]# ddrescue -vv -R -r 3 /dev/sda /bigdisk/test.img

GNU ddrescue 1.16
About to copy 15693 MBytes from /dev/sda to /bigdisk/test.img
Starting positions: infile = 0 B, outfile = 0 B
Copy block size: 128 sectors Initial skip size: 128 sectors
Sector size: 512 Bytes
Max retries: 3
Direct: no Sparse: no Split: yes Truncate: no
Reverse mode

Press Ctrl-C to interrupt
rescued: 649285 kB, errsize: 0 B, current rate: 8126 kB/s
ipos: 15044 MB, errors: 0, average rate: 18035 kB/s
opos: 15044 MB, time since last successful read: 0 s
^Cpying non-tried blocks...
Interrupted by user

[root@nas1 ~]#

[Mike Tomlinson]

En el artículo <%ei%z.108612$kM7....@fx44.am4>, Johnny B Good <johnny-
b-g...@invalid.ntlworld.com> escribió:

> ddrescue is the one to use

Thanks Johnny.

[Vir Campestris]

On 30/11/2016 16:21, Bill wrote:
> It is saying "Scraping failed blocks", but perhaps it's best not to
> understand the messages.

Post the messages here. Someone may understand them. Possibly even me...

Andy

[Bill]

In message <suednV0W7MrhD93F...@brightview.co.uk>, Vir
Campestris <vir.cam...@invalid.invalid> writes

Where I'm at now is that I am following Mike Tomlinson's guidance and
attempting another run of ddrescue with a command line from the
receiving directory of:

ddrescue -R -v -r 3 /dev/sdd test.img test.logfile

It appears to be working this time, but extrapolating the run time (now
reading 1 d) implies the full image of the 750GB disk will take 195
hours. The Current Rate seems to be dropping from about 1000kB/s to
under 500kB/s, with the average rate dropping similarly.
On this attempt, the only message I've seen reads:
"Copying non-tried blocks... Pass 1 (backwards)"

Meanwhile, another friend has just rung to say that he has told his
daughter to get the train back from her University, bringing with her
the W7 Home machine with all her work on it and that now won't start.
--
Bill

[Jaimie Vandenbergh]

On Fri, 2 Dec 2016 12:44:17 +0000, Bill <Billa...@gmail.com> wrote:

>In message <suednV0W7MrhD93F...@brightview.co.uk>, Vir
>Campestris <vir.cam...@invalid.invalid> writes
>>On 30/11/2016 16:21, Bill wrote:
>>> It is saying "Scraping failed blocks", but perhaps it's best not to
>>> understand the messages.
>>
>>Post the messages here. Someone may understand them. Possibly even me...
>>
>>Andy
>
>Where I'm at now is that I am following Mike Tomlinson's guidance and
>attempting another run of ddrescue with a command line from the
>receiving directory of:
>
>ddrescue -R -v -r 3 /dev/sdd test.img test.logfile
>
> It appears to be working this time, but extrapolating the run time (now
>reading 1 d) implies the full image of the 750GB disk will take 195
>hours. The Current Rate seems to be dropping from about 1000kB/s to
>under 500kB/s, with the average rate dropping similarly.

Slowing read speed is probably a sign that you've got physical bad
blocks on the disk, once it gets past those it'll be back up to full
tilt again.

>Meanwhile, another friend has just rung to say that he has told his
>daughter to get the train back from her University, bringing with her
>the W7 Home machine with all her work on it and that now won't start.

Hopefully it's a drive that can be removed and read externally.

Cheers - Jaimie
--
BE PURE
BE VIGILANT
BEHAVE

[Mike Tomlinson]

En el artículo <NyDN5tBh...@end.of.the.universe>, Bill
<Billa...@gmail.com> escribió:

> It appears to be working this time, but extrapolating the run time (now
>reading 1 d) implies the full image of the 750GB disk will take 195
>hours

It won't, unless the disk is truly fucked (technical term). Crack open
the whisky and leave it overnight then see what's what in the morning.

[Bill]

In message <6KpdGZCN...@jasper.org.uk>, Mike Tomlinson
<mi...@jasper.org.uk> writes

>En el artículo <NyDN5tBh...@end.of.the.universe>, Bill
><Billa...@gmail.com> escribió:
>
>> It appears to be working this time, but extrapolating the run time (now
>>reading 1 d) implies the full image of the 750GB disk will take 195
>>hours
>
>It won't, unless the disk is truly fucked (technical term). Crack open
>the whisky and leave it overnight then see what's what in the morning.
>

Current rate is now down to 318B/s, and the "Rescued" figure is pretty
well stationary. It sounds as though both HD's source and destination
are doing something, so overnight it is.

In the early light tomorrow, I'm off to see the other friend and
daughter with her dud W7 machine. She was given a 1TB drive for backup
last Christmas, but it was at home, she was at Uni. She has arrived back
at home with machine, he has got the drive out and in a caddy, but
reports it is seen on his Windows 7 machine as drive F and then says CRC
error.

I've made a second Knoppix boot drive, but I wish I had time to try
ddrescue on a known good HD here before poking about in other people's
machines.

He is one of those I gave an old X200 to some time ago, so if we can
rescue any data she can be taken back to Uni tomorrow afternoon with
that.


--
Bill

[Bill]

In message <cJY5HbAO...@end.of.the.universe>, Bill
<Billa...@gmail.com> writes

>I've made a second Knoppix boot drive, but I wish I had time to try
>ddrescue on a known good HD here before poking about in other people's
>machines.
>
>He is one of those I gave an old X200 to some time ago, so if we can
>rescue any data she can be taken back to Uni tomorrow afternoon with
>that.

On the second machine, we got the important files off, and onto the old
X200 and it's on its way back to Uni. Her dad has the job of lecturing
about backups and sorting out another HD.
We gave up on ddrescue because of the time factor and just copied the
crucial files via Knoppix. Windows couldn't see the main partition,
Knoppix could. Our first pass at this failed when we copied files in
bulk and they appeared with the right name and file sizes listed on the
Windows machine, but we had a bunch of files apparently full of #'s. It
also stopped, with a bunch of errors. Copying individually worked OK.

Now back to original (son in law's) machine here. It remained slowed
right down to 319 bytes/sec, and I've just abandoned it after 2.23 days.

$ ddrescue -R -vv -r 3 /dev/sdd test.img test.logfile
GNU ddrescue 1.19
About to copy 750156 MBytes from /dev/sdd [750156374016] to test.img
[0].

Starting positions: infile = 0 B, outfile = 0 B
Copy block size: 128 sectors Initial skip size: 128 sectors
Sector size: 512 Bytes

Max retry passes: 3
Direct: no Sparse: no Trim: yes Scrape: yes Truncate: no

Reverse mode

Press Ctrl-C to interrupt

rescued: 91751 MB, errsize: 0 B, current rate: 319 B/s
ipos: 658405 MB, errors: 0, average rate: 474 kB/s
opos: 658405 MB, run time: 2.23 d, successful read: 0 s
ago

Copying non-tried blocks... Pass 1 (backwards)

I have just started it again for another try. It started at about 9
MB/s, but after 17 minutes is running at about 5 MB/s.

I assume the advice would be to find the nearest dustbin?

--
Bill

[Mike Tomlinson]

En el artículo <wnVScQF6...@end.of.the.universe>, Bill
<Billa...@gmail.com> escribió:

>I assume the advice would be to find the nearest dustbin?

It doesn't look good, for sure.

You could try using -r 1 to speed things up. If you can identify the
main Windows partition containing the OS and user data, try copying just
that one partition, e.g.

ddrescue -vv -r 1 /dev/sda2 /bigdisk/test.img

note /dev/sda2 above = second partition

to help you identify partitions:

[root@nas1 scratch]# parted /dev/sda print
Model: SanDisk Extreme (scsi)
Disk /dev/sda: 15.7GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number Start End Size Type File system Flags
1 1049kB 15.7GB 15.7GB primary ext4 boot

[root@nas1 scratch]#

(I've only got single-partition disks, it makes life simpler)

[Bill]

In message <LFxhF7Dv...@jasper.org.uk>, Mike Tomlinson
<mi...@jasper.org.uk> writes

Here's where I'm up to.

Son-in-law's HP machine:
Still waiting for time with him to try to set it up with reclaimed files
on its new drive.
I've been using lsblk to identify partitions, and on the last aborted
attempt had aimed ddrescue at the main Windows partition. I hadn't tried
reducing the number of retries. I did copy as much as I could find onto
my external drive.
At this point I decided to try the Windows recovery methods, so started
up a machine in Windows 10 (!) and aimed "Check Disk", the gui version,
at the drive. After many hours it said the drive was repaired, so put it
back in the original HP machine, where it again said the disk needed to
be repaired.
9 hours later it has just finished and says that Windows won't start,
the only option being to do a fresh, destructive install. I've tried a
few more non-destructive restarts with a W10 dvd in the optical drive
and it eventually got to his login screen, where it said it wanted to
update Office 2010. I don't know if it has a Windows password, but after
a few minutes, it closed down to restart, and now gives an HP message
that no boot media can be found. It has now done the memory part of the
HP Start-up Test, and says there is no HD. Close down and restart and it
eventually reaches the login screen again. I think the drive isn't worth
much more time.

Meanwhile, I have found an old drive to practise ddrescue on, set to 1
pass. As far as I know this drive is OK. It seems to be progressing
well, but after 2 hours the "current rate" has dropped from about
9000kB/s to about 1500kB/s


Friend's daughter's Lenovo machine:

She is back at uni with her coursework, and a few other things,
recovered.

He has her Lenovo with no hard drive and his wife's similar Lenovo. Both
W7. Overnight this latter has recurred the fault it has had in the past
where it suddenly goes completely dead, so he has taken the drive from
it and put it in daughter's machine, which now boots as his wife's
machine!

He has ordered a new HD, and I've said I'll leave a Knoppix usb with
him. He wants me to leave instructions as well. :-( I've also suggested
he looks for loose connectors in his wife's machine and looks out for an
ex-business laptop to put the HD in.

I'm also watching Mr Wibble here, as I still have a presumed dead SSD of
my own.
--
Bill

[David]

Rimmer: They've been very bad, Mr. Wibble. What we going to do with them?

Rimmer: [Mr.Wibble whispers something in Rimmers ear and he looks at the
NG, shocked] We couldn't possibly do that. Who'd clean up the mess?

Hopefully more to report today. I am being very careful not to work on the
original SSD, but only on copies.

--
AMD FX-6300 in GA-990X-Gaming SLI-CF running Windows 7 Pro x64

[Bill]

Today's "progress" is that I had decided to take an older, but good, HD
and try a practise session with ddrescue (set to 1 pass).

On this disk, the main Windows partition was approx 120GB, so I ran
ddrescue against that partition. It appears to have produced an image
with no errors, taking 2.90 days to do it. From the screen messages, it,
like the problem drives, slowed drastically as time passed, but dropping
from 9000kB to about 220kB/s, rather than the drop to about 200B/s of
the problem drives.
It's now obvious why the 750GB partition took more time than available
to produce an answer.

After a number of abortive attempts, where I got in a mess with how su
works, I've now managed to mount the image and see the files, so that's
good.
I tried right clicking for the mount option in the file manager, but it
said the image file was too big.

I am hoping we can get the brother in law's machine usable this
weekend, using what I have already copied. The main Windows partition on
his old 750G drive is about 680GB, so really don't think ddrescue is
practical given the way the speed drops to just a few hundred bytes/sec.
--
Bill

[David]

Not sure why it is going so slowly; it normally slows to a crawl if it
finds some seriously dodgy bocks but is otherwise O.K.

Possibly worth checking that you aren't using an inappropriate block size.

Cheers

Dave R

[David]

On Thu, 08 Dec 2016 17:29:00 +0000, Bill wrote:

Just to add that I have rescued a well dodgy 3TB drive in a lot less time
than that.

Possibly worth posting the options you are using with ddrescue.

I am using ddrescue GUI which makes life easier.

[Bill]

In message <eatr1kF...@mid.individual.net>, David
<wib...@btinternet.com> writes

>Just to add that I have rescued a well dodgy 3TB drive in a lot less
>time than that.
>
>Possibly worth posting the options you are using with ddrescue.
>
>I am using ddrescue GUI which makes life easier.

For the 120GB drive, I used, where sdd3 is the Windows C: partition

ddrescue -R -v -r1 /dev/sdd3 test1.img test1.logfile

from the folder on the 2TB backup drive where I want the image to go.

From the screen, I see it's

GNU ddrescue 1.19

Copy block size: 128 sectors Initial skip size: 128 sectors
Sector size: 512Bytes

The source disk has a sector size of 512bytes, the destination disk says
logical sector size 512, physical sector size 4096 bytes.

I might look at ddrescue gui. I'm a bit bogged down at the moment with
various things and really want these two people to take their machines
and run..

--
Bill

[David]

Only other thing is that you are saving to an image file. Could the target
file store be fragmented, so that as you copy more blocks the contiguous
free space is all used up and you start thrashing the target disc? This
would tie in with the copy getting slower and slower.

I am doing partition to partition so this won't happen.

Best way to test this is to shrink the current partition on your 2TB
backup drive to free off some space to create a new partition slightly
larger than your source partition (for safety) and do a partition to
partition copy.

Cheers


Dave R

[Johnny B Good]

Just to add my tuppence worth, I managed to completely clone a failing
4TB Hitachi Deskstar to a 4TB WD RED in a mere 56 hours just over three
years ago. After almost 56 hours run time, with 11GB remaining and the
transfer rate right down on the floor at a few hundred KB/s, I turned my
back on it for just ten minutes (expecting to have to CTRL C the job)
only to find it had completed the rescue operation (including dealing
with the 150KB count of 'bad sectors' it had been reporting for over half
of that 56 hour run time) when I next turned round to check progress.

>
> Possibly worth posting the options you are using with ddrescue.

When I ran that 56 hour ddrescue 'Marathon', I was using a test system,
as I usually do for this sort of job, so I used the simplest invocation
possible since the job was going to run to completion come hell or high
water, trusting to ddrescue's much vaunted 'intelligent' stepping around
the really bad regions of a failing HDD to prevent it burning up
thousands of hours of bad sector time outs that an ordinary cloning tool
would attempt, pointlessly trying to recover irretrievable sectors.

After some 40 hours or so run time (with the transfer rate right down
below the 10MB/s mark) I was beginning to question ddrescue's ability to
intelligently skip over the rotten areas in order to concentrate on the
still readily retrievable sectors elsewhere before going back to try and
dig more data out of the bad areas (hence my considering the CTRL C
option at the 56 hour mark).

TBH, I wouldn't have expected the last 11GB to be processed in a mere 10
minutes if ddrescue had been using such a data recovery algorithm (If 11
GB of good sectors had existed towards the back end of the drive's LBA
range, surely they'd have already been processed?)

>
> I am using ddrescue GUI which makes life easier.

That's an interesting concept, a GUI for ddrescue! Yet another search
phrase for me to submit to google. :-)

--
Johnny B Good