[opensuse] Is there a way to read data from a hdd, with a worm eaten bootsector?
Hi, Unfortunately my networkdrive became unaccessible, due to some worm, that has eaten parts of the bootsector. This drive contains my whole movie and music DB, all my photoos and apps that i wanted to keep. I know that the real data is unaffected, but do not know how to get it off that drive, and onto some other media, like DL-DVD's.. Does anyone have a clue? For information: Yes, it was used in a network, where there are also windows PC's and laptops, it had a samba server, and an ftp server. And no, a virus scanner could not access the drive anymore.. I noticed some strange signs, that have replaced the normal letters, and in a few restarts, no access was possible anymore. iirc, there is a way of reading the disk, passing by the bootsector in some way, but i don't remember the routine.... It cann't be mounted anymore, i used an enclosure directly on the drive: ide to usb, but it cann't be recognised anymore.. If somebody knows a way to get to the data, i would be very pleased to hear it. It is some 210GB, on a 250GB drive. -- Enjoy your time around, Oddball (Now or never...) OS: Linux 2.6.25.4-10-default x86_64 Huidige gebruiker: oddball@AMD64x2-sfn1 Systeem: openSUSE 11.0 (x86_64) KDE: 4.0.4 (KDE 4.0.4 >= 20080505) "release 24.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Sunday 2008-06-29 at 19:35 +0200, Oddball wrote:
Unfortunately my networkdrive became unaccessible, due to some worm, that has eaten parts of the bootsector.
Computer worm, or biological worm? :-?
This drive contains my whole movie and music DB, all my photoos and apps that i wanted to keep. I know that the real data is unaffected, but do not know how to get it off that drive, and onto some other media, like DL-DVD's.. Does anyone have a clue?
For information: Yes, it was used in a network, where there are also windows PC's and laptops, it had a samba server, and an ftp server. And no, a virus scanner could not access the drive anymore.. I noticed some strange signs, that have replaced the normal letters, and in a few restarts, no access was possible anymore.
iirc, there is a way of reading the disk, passing by the bootsector in some way, but i don't remember the routine.... It cann't be mounted anymore, i used an enclosure directly on the drive: ide to usb, but it cann't be recognised anymore..
If somebody knows a way to get to the data, i would be very pleased to hear it. It is some 210GB, on a 250GB drive.
Get the drive out of the usb box, connect it directly (internally) to a linux computer. Run checks on it. I assume that if it is not mountable it is because the partition table is broken and need to be reconstructed: us gpart. Do a "file -s /dev/device" to get some info. Then try to load the table with fdisk. At some time run smart tests on it, before returning it to the usb box. At worst, the data can be copied out with dd or dd_rescue, but you need another 210 GB straight. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) iD8DBQFIZ89atTMYHG2NR9URArnSAJwN8E2Y02FvG7qiyYAI72imyqMOgACfWA/e F4V50EFzUnXrCSvZ2aTdGPg= =iBBI -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Carlos E. R. schreef:
The Sunday 2008-06-29 at 19:35 +0200, Oddball wrote:
Unfortunately my networkdrive became unaccessible, due to some worm, that has eaten parts of the bootsector.
Computer worm, or biological worm? :-?
a worm inside a trojan.. :(
Get the drive out of the usb box, connect it directly (internally) to a linux computer. Run checks on it. I assume that if it is not mountable it is because the partition table is broken and need to be reconstructed: us gpart.
Do a "file -s /dev/device" to get some info. Then try to load the table with fdisk.
At some time run smart tests on it, before returning it to the usb box.
At worst, the data can be copied out with dd or dd_rescue, but you need another 210 GB straight.
-- Cheers, Carlos E. R.
This sounds sane enough to try, so i will do this first, as i have these ingredients at hand.. ;) Thnx Carlos ... -- Enjoy your time around, Oddball (Now or never...) OS: Linux 2.6.25.4-10-default x86_64 Huidige gebruiker: oddball@AMD64x2-sfn1 Systeem: openSUSE 11.0 (x86_64) KDE: 4.0.4 (KDE 4.0.4 >= 20080505) "release 24.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Oddball wrote:
Unfortunately my networkdrive became unaccessible, due to some worm, that has eaten parts of the bootsector. This drive contains my whole movie and music DB, all my photoos and apps that i wanted to keep. I know that the real data is unaffected, but do not know how to get it off that drive, and onto some other media, like DL-DVD's.. Does anyone have a clue?
If I were in that situation, the first thing I'd do is stick the drive in an external enclosure and try to mount it as a drive that doesn't need to boot. Seems like you've already done that, though. Te second thing I'd do is try to run Spinrite against it, and see if the drive can be recovered. Although my experience with it is inconclusive (the problem I tried to "fix" using Spinrite actually turned out to be a damaged SATA cable), friends have universally praised it for being able to restore data that was once throught to be lost. Spinrite isn't free. But by all reports, it's certainly worth its small cost, especially if it saves all your data. Besides emergency data recovery, it's also said to be excellent for periodic maintenance, to keep drives working well. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Jerry Houston schreef:
If I were in that situation, the first thing I'd do is stick the drive in an external enclosure and try to mount it as a drive that doesn't need to boot. Seems like you've already done that, though. Te second thing I'd do is try to run Spinrite against it, and see if the drive can be recovered. Although my experience with it is inconclusive (the problem I tried to "fix" using Spinrite actually turned out to be a damaged SATA cable), friends have universally praised it for being able to restore data that was once throught to be lost.
Spinrite isn't free. But by all reports, it's certainly worth its small cost, especially if it saves all your data. Besides emergency data recovery, it's also said to be excellent for periodic maintenance, to keep drives working well.
Thnx, Jerry, for this info ;) I will try to find the app. -- Enjoy your time around, Oddball (Now or never...) OS: Linux 2.6.25.4-10-default x86_64 Huidige gebruiker: oddball@AMD64x2-sfn1 Systeem: openSUSE 11.0 (x86_64) KDE: 4.0.4 (KDE 4.0.4 >= 20080505) "release 24.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Jerry Houston wrote:
Oddball wrote:
Unfortunately my networkdrive became unaccessible, due to some worm, that has eaten parts of the bootsector. This drive contains my whole movie and music DB, all my photoos and apps that i wanted to keep. I know that the real data is unaffected, but do not know how to get it off that drive, and onto some other media, like DL-DVD's.. Does anyone have a clue?
If I were in that situation, the first thing I'd do is stick the drive in an external enclosure and try to mount it as a drive that doesn't need to boot. Seems like you've already done that, though. Te second thing I'd do is try to run Spinrite against it, and see if the drive can be recovered. Although my experience with it is inconclusive (the problem I tried to "fix" using Spinrite actually turned out to be a damaged SATA cable), friends have universally praised it for being able to restore data that was once throught to be lost.
Spinrite isn't free. But by all reports, it's certainly worth its small cost, especially if it saves all your data. Besides emergency data recovery, it's also said to be excellent for periodic maintenance, to keep drives working well.
The problem with Spinrite is that it attempts to repair the drive, rather than copy the data to another drive. This means if it messes up, you've lost everything. It's far safer to copy the drive contents to another drive and work on recovery there. -- Use OpenOffice.org http://www.openoffice.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
James Knott schreef:
The problem with Spinrite is that it attempts to repair the drive, rather than copy the data to another drive. This means if it messes up, you've lost everything. It's far safer to copy the drive contents to another drive and work on recovery there.
That would mean that i could access the drive, to copy the data.... -- Enjoy your time around, Oddball (Now or never...) OS: Linux 2.6.25.4-10-default x86_64 Huidige gebruiker: oddball@AMD64x2-sfn1 Systeem: openSUSE 11.0 (x86_64) KDE: 4.0.4 (KDE 4.0.4 >= 20080505) "release 24.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Oddball wrote:
James Knott schreef:
The problem with Spinrite is that it attempts to repair the drive, rather than copy the data to another drive. This means if it messes up, you've lost everything. It's far safer to copy the drive contents to another drive and work on recovery there.
That would mean that i could access the drive, to copy the data....
And how is it possible to be able to access a drive well enough to repair, but not be able to copy the sectors to another drive? A few years ago, there was a presentation on disk recovery, at the Toronto Linux Users Group, by someone who does that professionally. He said utilities such as Spinright can often cause more problems than they fix. He also said the standard procedure in his work is to copy as much as possible from the old drive and then work with the copy, rather than attempt to fix the original. -- Use OpenOffice.org http://www.openoffice.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Monday 2008-06-30 at 08:23 -0400, James Knott wrote:
The problem with Spinrite is that it attempts to repair the drive, rather than copy the data to another drive. This means if it messes up, you've lost everything. It's far safer to copy the drive contents to another drive and work on recovery there.
That would mean that i could access the drive, to copy the data....
And how is it possible to be able to access a drive well enough to repair, but not be able to copy the sectors to another drive? A few years ago, there was a presentation on disk recovery, at the Toronto Linux Users Group, by someone who does that professionally. He said utilities such as Spinright can often cause more problems than they fix. He also said the standard procedure in his work is to copy as much as possible from the old drive and then work with the copy, rather than attempt to fix the original.
Absolutely. It is the safest method. An image of the data can be obtained with dd, if there are no damaged sectors, or dd_rescue if there are. Once the image is obtained, work on it. If there are no damaged sectors, the procedure can later be applied to the disk, too. However, in this case the image is large, and there is the possibility that only the partition table and/or boot sectors were damaged (erased or overwritten), and could be easily recovered. It shouldn't be very difficult to undo that damage. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) iD8DBQFIaNMxtTMYHG2NR9URAuxSAJ9CovQRGmFXekFvGie/W8hDdSRYpACfUcf5 tdHKruKRVOTZPfjMYx79jJo= =yNfq -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
http://wiki.tldp.org/moin.cgi/PartitionRescueHowto ? jdd -- Jean-Daniel Dodin Président du CULTe www.culte.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
jdd sur free schreef:
http://wiki.tldp.org/moin.cgi/PartitionRescueHowto ? jdd You can call this an answer allright ;)
-- Enjoy your time around, Oddball (Now or never...) OS: Linux 2.6.25.4-10-default x86_64 Huidige gebruiker: oddball@AMD64x2-sfn1 Systeem: openSUSE 11.0 (x86_64) KDE: 4.0.4 (KDE 4.0.4 >= 20080505) "release 24.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On June 30, 2008 05:23:41 am James Knott wrote:
Oddball wrote:
James Knott schreef:
The problem with Spinrite is that it attempts to repair the drive, rather than copy the data to another drive. This means if it messes up, you've lost everything. It's far safer to copy the drive contents to another drive and work on recovery there.
While it's certainly prudent to make a copy (if you can) of the damaged drive if you have data on your drive that isn't being read, it's not going to be copied, either. Spinrite does nondestructive repair and if the problem is damaged areas that can't be read it's a good solution. It interacts directly with magnetic storage media at a level below any installed operating system. SpinRite introduced the concept of non-destructive low-level reformatting and sector interleave optimization which means that the software can read, analyze, correct then rewrite every tiny bit of data on a hard drive, re-establishing the formatting, without losing any original data, without screwing up your files or messing up your partitions, or fouling up the factory low-level formatting of any hard drive. So if you're at the point where your hard drive is unable to read data you've just got to get off it, Spinrite is a helluva lot cheaper than sending your drive to a data recovery centre where they disassemble and rebuild the drive with new parts. I've used it to recover an 80GB laptop drive completely. -- bob@rsmits.ca -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Robert Smits wrote:
On June 30, 2008 05:23:41 am James Knott wrote:
Oddball wrote:
James Knott schreef:
The problem with Spinrite is that it attempts to repair the drive, rather than copy the data to another drive. This means if it messes up, you've lost everything. It's far safer to copy the drive contents to another drive and work on recovery there.
While it's certainly prudent to make a copy (if you can) of the damaged drive if you have data on your drive that isn't being read, it's not going to be copied, either.
Please explain how it's possible to repair a drive, but not copy with appropriate tools. If a sector is repairable, it's copyable. Once you have copied all the readable sectors, you can fix any damaged ones and also the file system etc. -- Use OpenOffice.org http://www.openoffice.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Monday 30 June 2008 11:28:38 am James Knott wrote:
Please explain how it's possible to repair a drive, but not copy with appropriate tools. If a sector is repairable, it's copyable. Once you have copied all the readable sectors, you can fix any damaged ones and also the file system etc.
Guys: I have a question. If the drive is unuseable as it sits, how can you screw up anything by running Spinrite? A friend who has used Spinrite on many bad drives says it cant hurt the drive but may take hours to diagnose and fix. He wouldnt hesitate to use it to recover your disk. He says using the CD you let the cd boot and at the prompt you type spinrite then find something else to do until it finishes. Also he's had 100% success with the program and that the MBR is a piece of cake. And if your drive is SMART capable, leave smart enabled will help do the job. Richard -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Richard wrote:
On Monday 30 June 2008 11:28:38 am James Knott wrote:
Please explain how it's possible to repair a drive, but not copy with appropriate tools. If a sector is repairable, it's copyable. Once you have copied all the readable sectors, you can fix any damaged ones and also the file system etc.
Guys:
I have a question. If the drive is unuseable as it sits, how can you screw up anything by running Spinrite?
A friend who has used Spinrite on many bad drives says it cant hurt the drive but may take hours to diagnose and fix. He wouldnt hesitate to use it to recover your disk.
He says using the CD you let the cd boot and at the prompt you type spinrite then find something else to do until it finishes.
Also he's had 100% success with the program and that the MBR is a piece of cake. And if your drive is SMART capable, leave smart enabled will help do the job.
Richard
By copying the sectors to another drive, you may be able to fix defective sectors by using a sector editor. If you mess up, you just start again on a copy, without having to go back to the original drive. By fixing the defective sectors, you may now be able to recover the data. If you operate directly on the defective drive, a mistake may make data recovery impossible. Again, if you can read enough for Spinright to work, you can read enough to copy the sectors and working on a copy is always safer than on the original. Also, in order to copy the original sectors from a defective drive, you need the appropriate tools that will make multiple attempts to read a sector etc., instead of just passing over the error. Any decent sector repair tool should be able to do that. Someone else mentioned "dd_rescue". Here's a link to it: http://www.garloff.de/kurt/linux/ddrescue -- Use OpenOffice.org http://www.openoffice.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Monday 2008-06-30 at 13:59 -0400, James Knott wrote:
By copying the sectors to another drive, you may be able to fix defective sectors by using a sector editor. If you mess up, you just start again on a copy, without having to go back to the original drive. By fixing the defective sectors, you may now be able to recover the data. If you operate directly on the defective drive, a mistake may make data recovery impossible. Again, if you can read enough for Spinright to work, you can read enough to copy the sectors and working on a copy is always safer than on the original. Also, in order to copy the original sectors from a defective drive, you need the appropriate tools that will make multiple attempts to read a sector etc., instead of just passing over the error. Any decent sector repair tool should be able to do that.
Someone else mentioned "dd_rescue". Here's a link to it: http://www.garloff.de/kurt/linux/ddrescue
There is a case when certain type of programs, like probably that spinrite can help: when the magnetization is marginal or incorrect. It supposedly looks at the raw data, including sync marks, crcs, etc, on the surface of the disk, and tries to guess what the "payload" data should be. This can not be done even by dd_rescue: what this one does is read several times and average the result. The disk firmware and the operating system hides the raw data of the disk, dd doesn't see it. They probably need manufacturer specs to decode that. If spinrite can really read this, then it is very different from linux tools. However, if what they say they do is babletalk and they are really doing something similar to dd_rescue, that's another thing. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) iD8DBQFIaTfZtTMYHG2NR9URArwQAJ9kdCkxb0xYf6vwDRElmRZVvuXJlgCbBW0y XQK50SIS+u8k+eFqP8acGSo= =lbF9 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Carlos E. R. wrote:
The Monday 2008-06-30 at 13:59 -0400, James Knott wrote:
By copying the sectors to another drive, you may be able to fix defective sectors by using a sector editor. If you mess up, you just start again on a copy, without having to go back to the original drive. By fixing the defective sectors, you may now be able to recover the data. If you operate directly on the defective drive, a mistake may make data recovery impossible. Again, if you can read enough for Spinright to work, you can read enough to copy the sectors and working on a copy is always safer than on the original. Also, in order to copy the original sectors from a defective drive, you need the appropriate tools that will make multiple attempts to read a sector etc., instead of just passing over the error. Any decent sector repair tool should be able to do that.
Someone else mentioned "dd_rescue". Here's a link to it: http://www.garloff.de/kurt/linux/ddrescue
There is a case when certain type of programs, like probably that spinrite can help: when the magnetization is marginal or incorrect. It supposedly looks at the raw data, including sync marks, crcs, etc, on the surface of the disk, and tries to guess what the "payload" data should be.
Is that "raw data" available to the computer side of the disk interface (IDE, SATA etc.)? Back in the days when I used to repair disk drives (disk pack drives for mini-computers 20+ years ago) it certainly wasn't. You'd have to get right into the disk interface hardware with an oscilloscope to see that sort of thing.
This can not be done even by dd_rescue: what this one does is read several times and average the result. The disk firmware and the operating system hides the raw data of the disk, dd doesn't see it. They probably need manufacturer specs to decode that. If spinrite can really read this, then it is very different from linux tools. However, if what they say they do is babletalk and they are really doing something similar to dd_rescue, that's another thing.
-- Cheers, Carlos E. R.
-- Use OpenOffice.org http://www.openoffice.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Monday 2008-06-30 at 16:08 -0400, James Knott wrote:
There is a case when certain type of programs, like probably that spinrite can help: when the magnetization is marginal or incorrect. It supposedly looks at the raw data, including sync marks, crcs, etc, on the surface of the disk, and tries to guess what the "payload" data should be.
Is that "raw data" available to the computer side of the disk interface (IDE, SATA etc.)? Back in the days when I used to repair disk drives (disk pack drives for mini-computers 20+ years ago) it certainly wasn't. You'd have to get right into the disk interface hardware with an oscilloscope to see that sort of thing.
With HD I don't remember. With floppies, yes. I know it is/was possible because I read an article from a chap that modified the low level format, reducing the size of the sync and crc codes and whatever to get formatted data sizes well over 2 megs per standard floppy of 1.44. He had to play with timings and lots of complicated stuff. I didn't try it though. With a hard disk... I really don't know, I don't know the interface at that level of detail. But there may be a function to get the interface read all that raw data. I should think the contents depends on the HD make. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) iD8DBQFIaWRbtTMYHG2NR9URAkEtAJ0SEQkCaP1UuJCFjD6ofyi2gvJfwwCfRaUj 76q3P4KnZDyewfoy1HeU08Y= =UCc6 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On June 30, 2008 10:59:16 am James Knott wrote:
By copying the sectors to another drive, you may be able to fix defective sectors by using a sector editor. If you mess up, you just start again on a copy, without having to go back to the original drive. By fixing the defective sectors, you may now be able to recover the data. If you operate directly on the defective drive, a mistake may make data recovery impossible. Again, if you can read enough for Spinright to work, you can read enough to copy the sectors and working on a copy is always safer than on the original. Also, in order to copy the original sectors from a defective drive, you need the appropriate tools that will make multiple attempts to read a sector etc., instead of just passing over the error. Any decent sector repair tool should be able to do that.
I don't think you understand what Spinrite (not Spinright) actually does, James. Spinrite is a stand-alone DOS program designed to refurbish hard drives, floppy disks and recover data from marginally or completely unreadable hard drives and floppy disks and from partitions and folders which have become unreadable. When it encounters a sector with errors that cannot be corrected by the disk drives' error correcting code it tries to read the sector up to 2000 times, and tries to determine the most probable value of each bit by comparing the results. The data is then saved onto a new block of the same disk; it cannot be saved elsewhere. It's not a file undelete or defrag utility. -- bob@rsmits.ca -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Robert Smits wrote:
I don't think you understand what Spinrite (not Spinright) actually does, James.
Spinrite is a stand-alone DOS program designed to refurbish hard drives, floppy disks and recover data from marginally or completely unreadable hard drives and floppy disks and from partitions and folders which have become unreadable. When it encounters a sector with errors that cannot be corrected by the disk drives' error correcting code it tries to read the sector up to 2000 times, and tries to determine the most probable value of each bit by comparing the results. The data is then saved onto a new block of the same disk; it cannot be saved elsewhere.
It's not a file undelete or defrag utility.
dd_rhelp from the ddrescue package does that as well and not only is it free but it also recovers cd roms and dvds. Regards Dave P -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Robert Smits a écrit :
Spinrite is a stand-alone DOS program designed to refurbish hard drives,
the question is wheter it is possible or not to work with hard drives at a lower level than the OS usually do. I think it's possible, but probably only with maker specific software (on the factory). There are probably hidden api/entry points in the firmware. It's possible also with special firmware loaded by a hardware interface plugged in place of the original one, but this is probably far out of the scope of any userspace sofware (even under dos)
by the disk drives' error correcting code it tries to read the sector up to 2000 times,
this is where it can easily kill a used disk... and tries to determine the most probable value of each bit by
comparing the results. The data is then saved onto a new block of the same disk; it cannot be saved elsewhere.
this is plain stupid, saving on a dying disk! dd_rescue do the same but it's extremely suggested to write the data on an other disk and dd_rescue is *extremely slow* jdd -- Jean-Daniel Dodin Président du CULTe www.culte.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Wednesday 2008-07-02 at 12:24 +0200, jdd sur free wrote:
Robert Smits a écrit :
Spinrite is a stand-alone DOS program designed to refurbish hard drives,
the question is wheter it is possible or not to work with hard drives at a lower level than the OS usually do. I think it's possible, but probably only with maker specific software (on the factory). There are probably hidden api/entry points in the firmware.
It's possible also with special firmware loaded by a hardware interface plugged in place of the original one, but this is probably far out of the scope of any userspace sofware (even under dos)
by the disk drives' error correcting code it tries to read the sector up to 2000 times,
this is where it can easily kill a used disk...
Absolutely!
and tries to determine the most probable value of each bit by
comparing the results. The data is then saved onto a new block of the same disk; it cannot be saved elsewhere.
this is plain stupid, saving on a dying disk! dd_rescue do the same but it's extremely suggested to write the data on an other disk
and dd_rescue is *extremely slow*
Yes, because each failed sector read is tried 10 or 20 times, with a reset each time. The head moves to the track and to the beginning 10 or 20 times for each failed sector, I think (my ear thinks). - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) iD8DBQFIa1uXtTMYHG2NR9URArAEAJ4g9EkDHyp0Lc94D1jpPNfKhSYiCACfasga VqMnua9/17F6un9gIxecE4g= =3tIq -----END PGP SIGNATURE-----
On Monday 30 June 2008 11:28:38 am James Knott wrote:
� Please explain how it's possible to repair a drive, but not copy with appropriate tools. �If a sector is repairable, it's copyable. �Once you have copied all the readable sectors, you can fix any damaged ones and also the file system etc.
Guys:
I have a question. If the drive is unuseable as it sits, how can you screw up anything by running Spinrite?
A friend who has used Spinrite on many bad drives says it cant hurt the drive but may take hours to diagnose and fix. He wouldnt hesitate to use it to recover your disk.
He says using the CD you let the cd boot and at the prompt you type spinrite then find something else to do until it finishes.
Also he's had 100% success with the program and that the MBR is a piece of cake. And if your drive is SMART capable, leave smart enabled will help do the job.
Richard Spinrite is for repairing drives with defects, a worm eaten bootsector requires partition recovery software and for fat
Richard wrote: there is easyrecovery which works very well but costs money, norton disk doctor/diskedit or manual edit the partition table and mbr maybe use dfsee for Linux which is about the best I have found. You must make a backup image of the partition before writing for safety. There are always at least two fats and two mbrs. I the volume has a label you can search for that to find the mbrs and root directory, if the root directory is nuked as well you may be able to search for text files or ones with known headers as long as they are not fragmented. Regards Dave P -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Dave Plater wrote:
On Monday 30 June 2008 11:28:38 am James Knott wrote:
� Please explain how it's possible to repair a drive, but not copy with appropriate tools. �If a sector is repairable, it's copyable. �Once you have copied all the readable sectors, you can fix any damaged ones and also the file system etc.
Guys:
I have a question. If the drive is unuseable as it sits, how can you screw up anything by running Spinrite? A friend who has used Spinrite on many bad drives says it cant hurt the drive but may take hours to diagnose and fix. He wouldnt hesitate to use it to recover your disk.
He says using the CD you let the cd boot and at the prompt you type spinrite then find something else to do until it finishes.
Also he's had 100% success with the program and that the MBR is a piece of cake. And if your drive is SMART capable, leave smart enabled will help do the job.
Richard Spinrite is for repairing drives with defects, a worm eaten bootsector requires partition recovery software and for fat there is easyrecovery which works very well but costs money, norton disk doctor/diskedit or manual edit the partition table and mbr maybe use dfsee for Linux which is about the best I have found. You must make a backup image of
Richard wrote: the partition before writing for safety. There are always at least two fats and two mbrs. I the volume has a label you can search for that to find the mbrs and root directory, if the root directory is nuked as well you may be able to search for text files or ones with known headers as long as they are not fragmented. Regards Dave P
For a fat partition with no bootsector, I would recommend make a backup with dd, an after that, you can perform a quick format and try to recover data I would recommend you to use Recuva or PC Inspector File Recovery both free... but you will need windoh's to run them... Regards, -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On June 30, 2008 09:28:38 am James Knott wrote:
Robert Smits wrote:
On June 30, 2008 05:23:41 am James Knott wrote:
Oddball wrote:
James Knott schreef:
The problem with Spinrite is that it attempts to repair the drive, rather than copy the data to another drive. This means if it messes up, you've lost everything. It's far safer to copy the drive contents to another drive and work on recovery there.
While it's certainly prudent to make a copy (if you can) of the damaged drive if you have data on your drive that isn't being read, it's not going to be copied, either.
Please explain how it's possible to repair a drive, but not copy with appropriate tools. If a sector is repairable, it's copyable.
No, it's not. You can have areas with low magnetization that simply are not being read. Spinrite has a whole bag of tricks to recover files that are unreadable with your disk copying program.
Once you have copied all the readable sectors, you can fix any damaged ones and also the file system etc.
That's the point. It fixes previously unreadable sectors. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Hi, did you try dd_rescue ? it can be found in oss repository. I never used it but it seem it could do something usefull to you: http://www.garloff.de/kurt/linux/ddrescue/ Le Lun 30 juin 2008 19:58, Jerry Houston a écrit :
Oddball wrote:
Unfortunately my networkdrive became unaccessible, due to some worm, that has eaten parts of the bootsector. This drive contains my whole movie and music DB, all my photoos and apps that i wanted to keep. I know that the real data is unaffected, but do not know how to get it off that drive, and onto some other media, like DL-DVD's.. Does anyone have a clue?
If I were in that situation, the first thing I'd do is stick the drive in an external enclosure and try to mount it as a drive that doesn't need to boot. Seems like you've already done that, though.
Te second thing I'd do is try to run Spinrite against it, and see if the drive can be recovered. Although my experience with it is inconclusive (the problem I tried to "fix" using Spinrite actually turned out to be a damaged SATA cable), friends have universally praised it for being able to restore data that was once throught to be lost.
Spinrite isn't free. But by all reports, it's certainly worth its small cost, especially if it saves all your data. Besides emergency data recovery, it's also said to be excellent for periodic maintenance, to keep drives working well.
-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-- Laurent HENRY Administrateur Systèmes & Réseaux/RSSI Centre de Ressources Informatiques EHESS 54 Boulevard Raspail 75006 Paris 01.49.54.23.61 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Laurent HENRY (EHESS/CRI) schreef:
Hi, did you try dd_rescue ? it can be found in oss repository. I never used it but it seem it could do something usefull to you:
Thnx for the tip... I will first have to try to get access to the drive.. ;)
-- Enjoy your time around, Oddball (Now or never...) OS: Linux 2.6.25.4-10-default x86_64 Huidige gebruiker: oddball@AMD64x2-sfn1 Systeem: openSUSE 11.0 (x86_64) KDE: 4.0.4 (KDE 4.0.4 >= 20080505) "release 24.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Jerry Houston wrote:
Oddball wrote:
Unfortunately my networkdrive became unaccessible, due to some worm, that has eaten parts of the bootsector. This drive contains my whole movie and music DB, all my photoos and apps that i wanted to keep. I know that the real data is unaffected, but do not know how to get it off that drive, and onto some other media, like DL-DVD's.. Does anyone have a clue?
If I were in that situation, the first thing I'd do is stick the drive in an external enclosure and try to mount it as a drive that doesn't need to boot. Seems like you've already done that, though. Te second thing I'd do is try to run Spinrite against it, and see if the drive can be recovered. Although my experience with it is inconclusive (the problem I tried to "fix" using Spinrite actually turned out to be a damaged SATA cable), friends have universally praised it for being able to restore data that was once throught to be lost.
Spinrite isn't free. But by all reports, it's certainly worth its small cost, especially if it saves all your data. Besides emergency data recovery, it's also said to be excellent for periodic maintenance, to keep drives working well.
Hi! I've found a program called R-Linux, the bad news is that must be run under windoh's, but you can recover almost all your data. Give it a try and let me know... you can find it in http://www.data-recovery-software.net/Linux_Recovery.shtml -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Fernando Costa schreef:
Hi!
I've found a program called R-Linux, the bad news is that must be run under windoh's, but you can recover almost all your data. Give it a try and let me know... you can find it in http://www.data-recovery-software.net/Linux_Recovery.shtml
This also looks as a very nice tool, if it does what it says.. Unfortunately it is meanth for ext2fs, but the disk infected, is fat32, because it has to be accessible by all os.. Thnx for the involvement anyway :) -- Enjoy your time around, Oddball (Now or never...) OS: Linux 2.6.25.4-10-default x86_64 Huidige gebruiker: oddball@AMD64x2-sfn1 Systeem: openSUSE 11.0 (x86_64) KDE: 4.0.4 (KDE 4.0.4 >= 20080505) "release 24.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
participants (10)
-
Carlos E. R. -
Dave Plater -
Fernando Costa -
James Knott -
jdd sur free -
Jerry Houston -
Laurent HENRY (EHESS/CRI) -
Oddball -
Richard -
Robert Smits