[nmglug] Check a disk?

[Nick Frost]

On 03/25/2013 04:56 PM, Ted Pomeroy wrote:

> NMGLug-ers, can you help me check a sata 2.5" drvie at our meeting
> this Thursday? It was in an HP laptop, Intel core i5 processor and
> running Ubuntu 10.04. Alas, it seems un-readable now. The laptop was
> difficult to boot, had a hardware issue of some kind but now does not
> even get to the bios start process. I tried to read the harddrive with
> a 32-bit system and the hdd crashed. Is it possible to salvage this
> user's data? Can we take a look. I have a usb adapter, but no 64 bit
> system. Is that an issue? Or has some other error trashed this hdd?
> Anybody interested? Thanks, Ted P.

if the drive spins up and is not making sounds indicative of mechanical
failure: imho, the first thing to do with a failing drive is to try and
image the drive or the partition with ddrescue.  I usually put SATA
drives in a dock and at this time of year if I feel it's necessary cool
them with a clip fan placed such that it's blowing on the drive when
it's spinning or in use;

http://www.forensicswiki.org/wiki/Ddrescue#Examples

> Is it possible to salvage this user's data?

Likely possible if they (the "user") have a large budget (if all else
fails put it in another system and "present" the drive to Kroll Ontrack
but Kroll's diagnostic fee is $500 and their recovery fees start at
$4,000), uncertain if they do not.  If it's a single drive (no RAID)
that spins up and sounds relatively normal (you can use a stethoscope
instead of the ear pressed against the drive to hear more) then ddrescue
is the best bet and all that costs in terms of pricing is an available
system and your time.

if a successful image is made with ddrescue the image can be loop
mounted on a Linux box and read that way:

mount -o loop /mnt0/rescued-image.img /mnt1

For drives that are failing due to bad sectors, ddrescue often is
successful as it will do as many (or as few) sector retries as you
specify.  Depending on the situation you may or may not want to use
ddrescue with "--direct" (direct disk access) mode.

> I have a usb adapter, but no 64 bit system

As long as you are not booting from the suspect drive it does not
matter. It likely has an ext3 filesystem and ext3 is ext3..the data
should be readable you just can run 64-bit Linux binaries on a 32-bit
system.  Same applies with ext4.

Good luck.

-Nick
-- 
---------------------------------------
Nicholas S. Frost
7 Avenida Vista Grande #325
Santa Fe, NM  87508
nickf at frostitute.com
http://www.datamender.com/
----------------------------------------