As mentioned in a previous posting, we recently encountered a huge data loss due to the failure of our NAS drive. Though a lot of the data could be reconstructed, we decided that we want to try and recover as much data from the failed drive as we could whether it be through a drive recovery service or through open source tools. Because drive recovery services offered by third party vendors are so expensive (usually >$500) I first opted to try myself.
Upon taking the drive out of the original manufacturer housing, I attempted to connect it via SATA cables to various machines with varying degrees of luck. On one of the machines that was able to detect the drive, we ran a multitude of drive tests, all indicating failure. SeaTools for DOS, a popular drive testing program, can actually repair bad sectors. However, after several passes through the drive, SeaTools reported that there were no more repairs it could do.
Some operating systems detected the drive but couldn’t read any data from it, including information from the partition table. Some Windows machines could see the drive , but since it was partitioned by the manufacturer with 4 EXT3 RAID partitions, a popular Linux file system for NAS drives, Windows was unable to go so far as to even mount it. The only operating system that would consistently detect the drive was Ubuntu 16.04, but reported bad sectors and also refused to mount.
It became clear relatively quickly that I would have to use some sort of tool that was designed to read data from failed hardware. Since Ubuntu 16.04 was the only OS that consistently read the drive, I decided to use the variety of open source tools that are offered in its libraries. Because we’re going to eventually be using a tool that will look through the corrupted file system, we don’t want to keep reading and writing to the drive, potentially causing more damage. The first program I installed was gddrescue. This tool is designed to make image files of your drive in order to copy the data from the failed drive to a new drive, limiting the risk of further damaging the failed HDD. Opening up a Terminal window in Ubuntu, I ran
sudo apt-get install gddrescue
to install the utility. After checking a few of the command line options, I ran the program using
sudo ddrescue -r 2 /dev/sda2 ‘/media/dan/image’ ‘/media/dan/logfile’
This tells gddrescue to perform two passes of the drive and store the image file in the directory ‘media/dan/image’ and the log file in the directory ‘media/dan/logfile’. This ran at a speed of about 40 MB/s. At this rate, to image all 2 TB, it was going to take around 14 hours, so I just let it sit idle for a few hours.
After around 2 hours, I noticed that the entire OS had frozen up, something I have rarely experienced with Ubuntu. I powered down the machine, backed up the partial image file created by gddrescue, and connected the drive to another machine running Ubuntu and ran the same commands. Sure enough after two hours the machine hung again. I made the executive decision to stop trying to image the drive in fear of the read head causing more internal damage and to leave it up to the third party recovery professionals to do this work for me.
But just for grins, I wanted to see how much data I could actually recover from the ~50 GB partial image I backed up. I installed the tool foremost, a command-line tool which can recover files from a number of file systems. To install foremost, I ran
sudo apt-get install foremost
and
sudo mkdir /recovery/foremost
sudo foremost -i /media/dan/image -o /recovery/foremost
which simply creates a directory for the recovered files and reads the image file created using gddrescue. The tool ran for 30 minutes before completing and from the ~50 GB image file it was able to recover 2 files totaling an outstanding 3.76 MB. The first of which was a .PDF about proper interview techniques and the second was this picture. Enjoy.
