Drive is failing, can't access through windows or ubuntu

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
idonaldson
Posts: 4
Joined: 29 Jul 2019, 22:24

Drive is failing, can't access through windows or ubuntu

#1 Post by idonaldson »

Hello,

Trying to recover what I can from an old 500GB WD green drive that I've had from college. No mechanical clicks, clunks or other noises coming from the drive, it's recognized as RAW when windows is booted. Ubuntu recognizes the disk as well, but says it's like to fail soon.

Smartmontools was ran and these are the results:

smartctl 6.6 2016-05-31 r4324 [x86_64-linux-4.18.0-15-generic] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family: Western Digital Caviar Green
Device Model: WDC WD5000AAVS-00ZTB0
Serial Number: WD-WCASU1427087
LU WWN Device Id: 5 0014ee 200fefb71
Firmware Version: 01.01B01
User Capacity: 500,107,862,016 bytes [500 GB]
Sector Size: 512 bytes logical/physical
Device is: In smartctl database [for details use: -P show]
ATA Version is: ATA8-ACS (minor revision not indicated)
SATA Version is: SATA 2.5, 3.0 Gb/s
Local Time is: Mon Jul 29 21:52:52 2019 UTC
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: FAILED!
Drive failure expected in less than 24 hours. SAVE ALL DATA.
See vendor-specific Attribute list for failed Attributes.

General SMART Values:
Offline data collection status: (0x85) Offline data collection activity
was aborted by an interrupting command from host.
Auto Offline Data Collection: Enabled.
Self-test execution status: ( 73) The previous self-test completed having
a test element that failed and the test
element that failed is not known.
Total time to complete Offline
data collection: (13980) seconds.
Offline data collection
capabilities: (0x7b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 2) minutes.
Extended self-test routine
recommended polling time: ( 163) minutes.
Conveyance self-test routine
recommended polling time: ( 5) minutes.
SCT capabilities: (0x303f) SCT Status supported.
SCT Error Recovery Control supported.
SCT Feature Control supported.
SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x000f 200 200 051 Pre-fail Always - 0
3 Spin_Up_Time 0x0003 161 135 021 Pre-fail Always - 4916
4 Start_Stop_Count 0x0032 097 097 000 Old_age Always - 3999
5 Reallocated_Sector_Ct 0x0033 041 041 140 Pre-fail Always FAILING_NOW 1265
7 Seek_Error_Rate 0x000e 001 001 051 Old_age Always FAILING_NOW 20532
9 Power_On_Hours 0x0032 080 080 000 Old_age Always - 15135
10 Spin_Retry_Count 0x0012 100 100 051 Old_age Always - 0
11 Calibration_Retry_Count 0x0012 100 100 051 Old_age Always - 0
12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 147
192 Power-Off_Retract_Count 0x0032 001 001 000 Old_age Always - 2221760
193 Load_Cycle_Count 0x0032 001 001 000 Old_age Always - 2294652
194 Temperature_Celsius 0x0022 110 083 000 Old_age Always - 37
196 Reallocated_Event_Count 0x0032 001 001 000 Old_age Always - 1265
197 Current_Pending_Sector 0x0012 200 197 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0010 200 197 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x003e 200 200 000 Old_age Always - 0
200 Multi_Zone_Error_Rate 0x0008 200 198 051 Old_age Offline - 0

SMART Error Log Version: 1
Warning: ATA error count 12107 inconsistent with error log pointer 3

ATA Error Count: 12107 (device log contains only the most recent five errors)
CR = Command Register [HEX]
FR = Features Register [HEX]
SC = Sector Count Register [HEX]
SN = Sector Number Register [HEX]
CL = Cylinder Low Register [HEX]
CH = Cylinder High Register [HEX]
DH = Device/Head Register [HEX]
DC = Device Command Register [HEX]
ER = Error register [HEX]
ST = Status register [HEX]
Powered_Up_Time is measured from power on, and printed as
DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes,
SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 12107 occurred at disk power-on lifetime: 15129 hours (630 days + 9 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 01 21 5d ed e0 Error: UNC 1 sectors at LBA = 0x00ed5d21 = 15555873

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 01 21 5d ed 1d 00 6d+00:17:20.266 READ DMA EXT
25 00 10 21 5d ed 1d 00 6d+00:17:14.449 READ DMA EXT
25 00 01 20 5d ed 1d 00 6d+00:17:14.449 READ DMA EXT
25 00 01 3f 00 00 00 00 6d+00:17:14.447 READ DMA EXT
25 00 10 20 5d ed 1d 00 6d+00:17:08.635 READ DMA EXT

Error 12106 occurred at disk power-on lifetime: 15129 hours (630 days + 9 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 10 21 5d ed e0 Error: UNC 16 sectors at LBA = 0x00ed5d21 = 15555873

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 10 21 5d ed 1d 00 6d+00:17:14.449 READ DMA EXT
25 00 01 20 5d ed 1d 00 6d+00:17:14.449 READ DMA EXT
25 00 01 3f 00 00 00 00 6d+00:17:14.447 READ DMA EXT
25 00 10 20 5d ed 1d 00 6d+00:17:08.635 READ DMA EXT
ec 00 00 00 00 00 00 00 6d+00:17:07.056 IDENTIFY DEVICE

Error 12105 occurred at disk power-on lifetime: 15129 hours (630 days + 9 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 10 20 5d ed e0 Error: UNC 16 sectors at LBA = 0x00ed5d20 = 15555872

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 10 20 5d ed 1d 00 6d+00:17:08.635 READ DMA EXT
ec 00 00 00 00 00 00 00 6d+00:17:07.056 IDENTIFY DEVICE
25 00 01 1f 5d ed 1d 00 6d+00:17:07.056 READ DMA EXT
25 00 04 7f 00 00 00 00 6d+00:17:07.054 READ DMA EXT
25 00 10 1f 5d ed 1d 00 6d+00:17:02.924 READ DMA EXT

Error 12104 occurred at disk power-on lifetime: 15129 hours (630 days + 9 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 10 1f 5d ed e0 Error: UNC 16 sectors at LBA = 0x00ed5d1f = 15555871

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 10 1f 5d ed 1d 00 6d+00:17:02.924 READ DMA EXT
25 00 01 3f 00 00 00 00 6d+00:17:02.924 READ DMA EXT
25 00 01 1e 5d ed 1d 00 6d+00:17:02.924 READ DMA EXT
25 00 01 3f 00 00 00 00 6d+00:17:01.336 READ DMA EXT
25 00 10 1e 5d ed 1d 00 6d+00:16:55.749 READ DMA EXT

Error 12103 occurred at disk power-on lifetime: 15129 hours (630 days + 9 hours)
When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 51 10 1e 5d ed e0 Error: UNC 16 sectors at LBA = 0x00ed5d1e = 15555870

Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
25 00 10 1e 5d ed 1d 00 6d+00:16:55.749 READ DMA EXT
25 00 01 1d 5d ed 1d 00 6d+00:16:55.747 READ DMA EXT
25 00 10 1d 5d ed 1d 00 6d+00:16:49.678 READ DMA EXT
25 00 01 1c 5d ed 1d 00 6d+00:16:49.676 READ DMA EXT
25 00 10 1c 5d ed 1d 00 6d+00:16:43.856 READ DMA EXT

SMART Self-test log structure revision number 1
Num Test_Description Status Remaining LifeTime(hours) LBA_of_first_error
# 1 Extended offline Completed: unknown failure 90% 15135 -

SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
Selective self-test flags (0x0):
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

Testdisk was ran in quick search mode and here is the log:
[https://drive.google.com/file/d/1igrj8d ... sp=sharing]

Is there any chance of recovering data from this drive?

Thanks

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Drive is failing, can't access through windows or ubuntu

#2 Post by cgrenier »

You shoudl try to clone the disk using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Once it's done, remove the original disk and run TestDisk, Advanced, Boot, RebuildBS, List.
If you can see your files, choose Write, confirm, Quit and restart your computer.

idonaldson
Posts: 4
Joined: 29 Jul 2019, 22:24

Re: Drive is failing, can't access through windows or ubuntu

#3 Post by idonaldson »

Alright so I created an image of the disk using ddrescue which I should have done initially. I have a 1TB drive with 700GB of space available but no spare drives large enough so I couldn't clone the disk, but I could make an image.

Ran Testdisk on the image and made it to the List command and it couldn't list any of the files.

So then I ran Parted on the image

Code: Select all

WARNING: You are not superuser.  Watch out for permissions.
GNU Parted 3.2
Using /media/ian/Data/wd.img
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) unit                                                             
Unit?  [compact]? B                                                       
(parted) print                                                            
Model:  (file)
Disk /media/ian/Data/wd.img: 500107862016B
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags: 

Number  Start   End            Size           Type     File system  Flags
 1      32256B  500105249279B  500105217024B  primary  ntfs         boot
Ran

Code: Select all

sudo mount -o loop,offset=32256 wd.img mountpoint
Which returned back the error

Code: Select all

mount: /media/ian/Data/mountpoint: wrong fs type, bad option, bad superblock on /dev/loop16, missing codepage or helper program, or other error.
I then checked the disk image with e2fsck

Code: Select all

e2fsck 1.44.1 (24-Mar-2018)
ext2fs_open2: Bad magic number in super-block
e2fsck: Superblock invalid, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open wd.img

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem.  If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>
 or
    e2fsck -b 32768 <device>

Found a dos partition table in wd.img
I tried both of the alternate e2fsck -b 8193 and e2fsck -b 32768 and neither would work.

Not sure where to go from here.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Drive is failing, can't access through windows or ubuntu

#4 Post by recuperation »

Your testdisk.log found a NTFS partition. PARTED stated that as well. I am not too familiar with Linux, but you should try to mount it as NTFS - preferably using the readonly parameter.
E2fsck won't repair NTFS partitions. The best tool would be the Windows-based CHKDSK.

There are windows tools similar to the linux mount command but I don't know if the chkdsk command would run through.
The best would be to get a drive sufficiently big and clone your "clone file" onto that new drive.
Connect that drive to a windows machine and run chkdsk there.

As the testdisk.log did not complain anything with the partition found at 0 0 1 I have difficulties in believing that you could not see any files. Show pictures.

idonaldson
Posts: 4
Joined: 29 Jul 2019, 22:24

Re: Drive is failing, can't access through windows or ubuntu

#5 Post by idonaldson »

I saw that the NTFS partition was found, but that's as far as I can make it with this drive.

I couldn't get Ubuntu to mount the drive or the drive image, so I re-attached the physical drive to my Windows machine to see if it would mount.

Tried the list files option from TestDisk, no luck.
Image
Image
Image
Image

Tried to run chkdsk from Windows.
Image

Are there any other options at this point other than buying a new larger drive, cloning this dying one to it and hopefully recovering whatever I can?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Drive is failing, can't access through windows or ubuntu

#6 Post by recuperation »

Yes, you can contact recovery professionals like Kroll-Ontrack and Convar.

Running chkdsk without having cloned the failing drive before is a bad idea, unfortunately, and will most likely diminish your chances of recovery.

idonaldson
Posts: 4
Joined: 29 Jul 2019, 22:24

Re: Drive is failing, can't access through windows or ubuntu

#7 Post by idonaldson »

I have a full image of the drive saved, so running tools on the physical drive doesn't scare me as much as it would without having it backed up.

Locked