How can I repair my hard drive without losing files?

Question

In short. I have problems with accessing files on my hard drive. I also assume that it is not a hardware problem (it is more on the "software level"). I would like to know if there are ways (Linux commands, Linux tools) that can help to monitor the hard drive and to detect the problem. Here is a more detailed description of what happened.

I have a Verbatim hard drive with a lot of files. Today I have tried to use it under Ubuntu. In the file browser I saw the Verbatim folder and tried to open it. As a result I saw a clock indicating that the process runs and needs more time. I weighted for one minutes or so, saw the same picture (still running, the folder is not opened) and tried to do the same in terminal. I used cd to enter the Verbatim folder, then being in the folder I execute ls -ltr. As a result I got nothing. I tried to cancel the command by Ctrl C, it did not work, so I just closed the terminal. Then on the panel I tried to eject or unmount the device (I do not remember how it is called) and the Ubuntu wrote me that device is busy executing ls (or something like that) command. I disconnected the device anyway.

Then I tried to access the files on the hard drive using another computer that runs under Windows. The windows recognized the device but told me that an error is detected and it is recommended to make a scan (however, there was still an option to show the files without a scan). I have chosen to make a scan. It took too long without showing any progress and I have canceled the scan.

Then I have disconnected the device and inserted again. There was still the option to scan. The scan could be performed with two options: (1) detect errors and correct it automatically and (2) detect missing files and try to restore them. The first option was checked by default (the previous (canceled) scan I run in this way). This time I checked also the second option (so the both options have been checked) and started the scan again. Again it was too slow without showing any progress so I canceled it again.

Then I started the scan with the first option checked (find errors and correct them automatically) and gave it enough time. After about 20-30 minutes it was ready. As a result I got a message that some of the folders could not be reached and have been removed permanently. After that I was able to use the devise (enter folders and sub-folders and see the files).

Then I tried the device under Ubuntu again. It took about one minute for Ubuntu to recognize the device (it is too long). Then I had the same problem (I could not see the folders located on the hard drive). It means that I see the hard drive folder, I can go into this folder but I was unable to see what files are there.

Then I have connected the device to the Windows machine and it was unable to recognize the device (it does not see it at all). I suppose that on the Ubuntu I made unmount (or something like that) and in this was I have blocked the hard drive (so that it is not seen by the Windows machine). However, I am not sure about this assumption. Probably the device is somehow broken.

Could somebody please help me with that because on the device I have all my family photos for the last 7 years.

Answer 1

Firstly you should ascertain the type of filesystem used on that drive. It is most likely FAT32. You can do this by using the fdisk command:

fdisk -l

This will return a list of devices and in each line there will be a "Type" which will reveal the filesystem:

Device     Boot     Start       End   Sectors   Size Id Type
/dev/sda1  *         2048 219353087 219351040 104.6G 83 Linux
/dev/sda2       219355134 234440703  15085570   7.2G  5 Extended
/dev/sda5       219355136 234440703  15085568   7.2G 82 Linux swap / Solaris

If you have another drive available that is equal to or larger than the failing drive the easiest way to attempt a recover in my experience is to use a tool called dd-rescue. More information can be found here: dd-rescue

You can also manually use dd to make an image of the entire drive into a file. If the hard drive is large this may take a very long time. You would also need to be sure that you had enough disc space on whichever disc you plan to create the backup image and also be sure that the filesytem in use supports files large enough to contain the size of the entire drive.

Here is an example of how you might accomplish this manually:

dd bs=4k if=/dev/sda of=/path/to/backup.img conv=noerror,sync 

In the above command /dev/sda is the damaged disc and backup.img is the file that will contain the contents of the entire disc as a backup. More information on this command can be found here:

recover-data-from-a-dead-hard-drive-using-dd

It may be better to use a smaller block-size argument so that you risk losing less data when errors are encountered. e.g. "bs=1024" however this will cause the operation to take even longer.

It is very difficult to determine if a hard drive is actually failing unless your hard drive has features like SMART enabled. It is possible that your disc is not failing and that your problem is due to file-system corruption.

Unfortunately I do not know of a good way to realistically determine how damaged a hard disc is other than features like SMART which is usually controlled by the BIOS.

Once you have determined the type of filesystem you are using on that disc you can attempt to repair the filesystem as you did before on Windows in Linux using the fsck command: (make sure you are using the fsck that matches your specific filesystem type.

fsck.vfat /dev/sdb1

It should be noted that Linux is not always good at repairing ntfs or fat partitions and so this should not be attempted until you have verified your backup. In fact I would recommend that you perform the attempted repair on the backup image instead. Instructions for performing an fsck on a backup file can be found here: mounting-a-raw-partition-file-made-with-dd

Depending on how the filesystem was mounted the ls command could indeed corrupt the filesystem if it is changing file, or directory meta-data; specifically by updating access time. Unplugging the drive while it is writing anything will cause errors in the filesystem, especially in filesystems that do not have good journaling features (such as FAT32) These errors can normally be corrected with fsck.

I am very sorry that you are in such a precarious position and I hope that you are able to recover these files.

Answer 2

Go back to your Linux system.

Open a root terminal, and type tail -f /var/log/kern.log, maximize this window.

Connect your hard drive.

If you have a hardware issue with the drive, it will show up here. If it's a problem with the USB connection, you'll get messages saying "Unable to enumerate device" or similar. If there is a media problem with the drive, you'll get messages about bad blocks.

If you have a USB connection error, there may be an issue with the USB cable, connector, or USB-to-SATA adapter that's in the hard drive enclosure (broken pins, connector falling off board, etc.)

Assuming your model of external hard drive does not have encryption features on the USB board, you can remove the drive from the enclosure, directly attach it to a PC, and work with it as any internal drive. If it does have encryption - you really need to get that board working, and should try to get with someone good with electronics/soldering to replace the USB connector or solder a cable directly to the pads on the board (which hopefully are not ripped off). The hard drive will still work on another system, but you won't be able to get your data.

Example of the USB board that would be inside of the enclosure:

Once you have eliminated any hardware issue, you can try to run Testdisk to see what it can recover. You can install this from apt-get on a root terminal under Ubuntu, or download and run the Windows version. Have another drive ready to copy files, and backup your data next time.

Good luck.

Answer 3

There is no way to repair a failing hard drive without the risk of losing files. Depending on how much the data on the drive is worth to you a professional data recovery service may be your best option. I believe that these services start at around $500 and go up, sometimes dramatically depending on how much effort it takes to recover data. Even the best data recovery service may not be able to recover all of your data but they have a much better chance at it than anything you could do on your own.

I would recommend you explore Seagate Recovery Services for more information.

I am sure this is not what you want to hear, but professional data recovery can open up the drive and preform other procedures that simply are not possible to do on your own. Data recovery takes expertise, specialized software and tools, hard drive parts and must be done in a clean room. It is not possible to do at home.

Answer 4

Have you tried to do a full disk check with Windows manually?

If you open a cmd and enter chkdsk /?, it comes up with all possible options.

For an NTFS partition, you can do chkdsk /F /R /B /X, which does the most complete checking. For FAT32, leave out /B.

Be aware that this takes a lot of time depending on your hard drive. But it could be a possibility to rescue some data.