Retrieving files from crashed disk

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
chriskross
Posts: 4
Joined: 07 Sep 2016, 11:13

Retrieving files from crashed disk

#1 Post by chriskross »

I wanted to tidy up my HDD in preparation for a new machine. My /home was almost full, so used Parted to rearrange partitions. First attempt went fine, then I thought I'd expand it to include another unused partition. Then disaster: it said 'an error has occurred' and on the system wouldn't boot. /home had gone and most of the disk shows Unallocated. I've since used various utilities on Live USB/DVDs and they indicated the drive had almost died. I've now put the HDD into a new machine, and TestDisk ran overnight. The HDD activity LED was still on, and the only screen option was a 'Stop' button. I pressed this and I could then see a list of various directories, but they are showing red. However, I could descend into them and see my files (not red).

First question: is this normal to see this? Should I leave it running until 'Stop' disappears?
Second question: what is the best way to save the files? How can i save them to another disk?

I'm taking this very slowly as I don't want to cause any more harm, but if they HDD is likely to degrade then I want to work quickly!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Retrieving files from crashed disk

#2 Post by cgrenier »

Without the testdisk.log file content it's hard to give you good advice.
I will do my best:
- Press 'h' to hide deleted files, deleted files appears in red.
- Copy your files to another disk, the most important first.

chriskross
Posts: 4
Joined: 07 Sep 2016, 11:13

Re: Retrieving files from crashed disk

#3 Post by chriskross »

I'm running TestDisk again, this time from within Mageia to give me plenty of disk space (I got a 'out of space' message when running from the Live USB Kali).

Again, it seems stuck at 92%. I'm guessing this is because it's seeing lots of bad blocks:


TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.7.2-desktop-1.mga6 (#1 SMP Sun Aug 21 23:29:07 UTC 2016) x86_64
Compiler: GCC 5.3
Compilation date: 2016-03-21T19:13:30
ext2fs lib: 1.43.3, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1953525168 sectors
/dev/sda: user_max 1953525168 sectors
/dev/sda: native_max 1953525168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 488397168 sectors
/dev/sdb: user_max 488397168 sectors
/dev/sdb: native_max 488397168 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size 500118192 sectors
/dev/sdc: user_max 500118192 sectors
/dev/sdc: native_max 500118192 sectors
/dev/sdd: LBA, HPA, LBA48, DCO support
/dev/sdd: size 625142448 sectors
/dev/sdd: user_max 625142448 sectors
/dev/sdd: native_max 625142448 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - WDC WD10EZRZ-00HTKB0, S/N:WD-WCC4J2DP0KL1, FW:01.01A01
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 850 EVO 250GB, S/N:S2R6NXAH348618H, FW:EMT02B6Q
Disk /dev/sdc - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - SAMSUNG SSD 830 Series, S/N:S0Z4NEAC842267, FW:CXM03B1Q
Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Hitachi HDS721032CLA362, S/N:JPF421HA3P5S4V, FW:JPFOA3EA
Disk /dev/sde - 7759 MB / 7400 MiB - CHS 1022 239 62, sector size=512 - TOSHIBA TransMemory, FW:1.00

Partition table type (auto): Intel
Disk /dev/sdd - 320 GB / 298 GiB - Hitachi HDS721032CLA362
Partition table type: Intel

Analyse Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
1 * Linux 0 1 1 42 254 63 690732
2 P Linux 1127 1 1 7846 254 63 107956737
3 P Linux 31877 1 1 35774 254 63 62621307

search_part()
Disk /dev/sdd - 320 GB / 298 GiB - CHS 38913 255 63

recover_EXT2: s_block_group_nr=0/42, s_mnt_count=0/4294967295, s_blocks_per_group=8192, s_inodes_per_group=2008
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 345364
recover_EXT2: part_size 690728
Linux 0 1 1 42 254 59 690728
ext4 blocksize=1024 Sparse_SB, 353 MB / 337 MiB

recover_EXT2: s_block_group_nr=0/62, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8128
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2046378
recover_EXT2: part_size 16371024
Linux 43 1 1 1062 13 33 16371024
ext4 blocksize=4096 Large_file Sparse_SB, 8381 MB / 7993 MiB

recover_EXT2: s_block_group_nr=0/63, s_mnt_count=0/4294967295, s_blocks_per_group=8192, s_inodes_per_group=2032
recover_EXT2: s_blocksize=1024
recover_EXT2: s_blocks_count 520192
recover_EXT2: part_size 1040384
Linux 1062 46 9 1126 240 10 1040384
ext4 blocksize=1024 Sparse_SB, 532 MB / 508 MiB

recover_EXT2: s_block_group_nr=0/411, s_mnt_count=6/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 13494592
recover_EXT2: part_size 107956736
Linux 1127 1 1 7846 254 62 107956736
ext4 blocksize=4096 Large_file Sparse_SB, 55 GB / 51 GiB

recover_EXT2: s_block_group_nr=0/111, s_mnt_count=274/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 3666513
recover_EXT2: part_size 29332104
Linux 7847 41 3 9672 254 62 29332104 [/backup]
ext4 blocksize=4096 Large_file Sparse_SB, 15 GB / 13 GiB
file_pread(7,16,buffer,155396744(9672/254/63)) read err: Input/output error
file_pread(7,1,buffer,155396744(9672/254/63)) read err: Input/output error
file_pread(7,1,buffer,155396745(9673/0/1)) read err: Input/output error
file_pread(7,14,buffer,155396746(9673/0/2)) read err: Input/output error

recover_EXT2: s_block_group_nr=0/1360, s_mnt_count=2/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 44588399
recover_EXT2: part_size 356707192
Linux 9673 1 1 31876 254 58 356707192
ext4 blocksize=4096 Large_file Sparse_SB, 182 GB / 170 GiB

recover_EXT2: s_block_group_nr=0/238, s_mnt_count=0/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 7827663
recover_EXT2: part_size 62621304
Linux 31877 1 1 35774 254 60 62621304
ext4 blocksize=4096 Large_file Sparse_SB, 32 GB / 29 GiB
file_pread(7,16,buffer,574812160(35780/102/35)) read err: Input/output error
file_pread(7,1,buffer,574812160(35780/102/35)) read err: Input/output error
file_pread(7,1,buffer,574812161(35780/102/36)) read err: Input/output error
file_pread(7,14,buffer,574812162(35780/102/37)) read err: Input/output error
file_pread(7,3,buffer,574812176(35780/102/51)) read err: Input/output error
file_pread(7,3,buffer,574812223(35780/103/35)) read err: Input/output error
.
.

.... this continues for a many errors...

Should I leave it running to see if it reaches 100%? I'd like to try and restore the fs before attempting to use PhotoRec.
:

Locked