ddrescue failure to close NTFS

FascistNation

New member
Jared recently wrote a user guide to ddrescue that I found while looking for a solution to my problem.

I recently had a friend with a new Hitachi 2TB 32MB 7200RPM 3.5" SATA 6.0Gb/s Internal Desktop Hard Drive with Win7 Pro OS that was reported by Windows as failing. He asked me to recover it and replace the drive. This was not a boot drive. It still had a few days to return it to the vendor.

I was unable to access it with anything in a new PC (with different known working SATA controller and SATA data and power cables).

Interestingly, Hitachi's DFT reported everything was fine:
SMART Status : Healthy

Test Log

ReadErrStat : Done
Result : Pass


SMART QT : Done
Result : Pass


Despite 3 Windows Events indicating the same SMART failure.
Description:
The driver has detected that device \Device\Harddisk3\DR3 has predicted that it will fail. Immediately back up your data and replace your hard disk drive. A failure may be imminent.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

I used ddrescue 1.18.1 on System Rescue CD.

Because the HDD was new I expected all the data/files would be in the first quarter of the drive. ddrescue took about 25 hours to burrow its way through the 2TB drive and write to a new 2TB drive (I suspect some now know what my issue will be). I didn't have any bigger drives.

ddrescue -n -f /dev/sdb /dev/sdc resq.log

ddrescue recovered all but 347 files (about 0.5%), but reported it could not properly finish because it ran out of drive space on the destination drive. The slow transfer rate as well as the rising count of non-recovered files ended about one quarter into the recovery process indicating it was past where the--or at least most--data files were present and was literally now recovering virgin territory.

These were both NTFS formatted, single partition of the entire drive drives (new one was a new Toshiba 2TB HDD).

On Linux, I cannot mount the recovered drive to copy it, nor view it. Keep getting NTFS format error.

I do not want to see if anything is visible on a Window OS due to the propensity of such to offer to fix things, which I do not want it to attempt.

To make matters worse, I bought and GPT formatted a 4TB drive and started to repeat the ddrescue and the failing HDD completely failed less than 10% of the way in.

I have been reading the ddrescue manual as well as several forums and cannot find for certain instructions on how to repair the "full" destination drive so it is accessible. I do not want to make any mistakes that could corrupt data further. Anyone have any ideas on rescue/repair so I can make a copy and then see what was recovered and where things stand?
 

jol

Member
ddrescue can not handle physical problems, maybe it's bad/falling heads and or media damage
what i don't understand is if it's a new drive
FascistNation":3dbxvrb4 said:
Because the HDD was new I expected all the data/files would be in the first quarter of the drive
where is the data coming from into this HDD ?
take it from there
 

Jared

Administrator
Staff member
I find it odd you mention the number of files ddrescue failed to recover. If you were in fact following my tutorial and using ddrescue it reads at a block level, not a file level. So where are you getting this number from?
 

FascistNation

New member
Jared":2oxubkeq said:
I find it odd you mention the number of files ddrescue failed to recover. If you were in fact following my tutorial and using ddrescue it reads at a block level, not a file level. So where are you getting this number from?
Yes, you are correct. With most recovery apps it is files recovered. Blocks on a HDD is a different way of thinking for me and this is the first time ddrescue "worked" when other recovery apps did not even see the partition. Usually if they failed ddrescue could not access the drive either.

I should have said 347 errors reported.
 

Jared

Administrator
Staff member
OK, that makes more sense. Sounds like the vast majority of the data was recovered. What you should do now is connect the clone drive to another computer and run data recovery software (such as R-Studio) against it and see what it finds. Possibly the partition table or beginning of the filesystem is damaged which is why the OS can't natively recognize it.
 
Top