Disk recovery
My father-in-law came to me with a failed hard disk from a Windows system. It is probably NTFS, but that isn't known for sure. I have a few Linux machines and will try to recover what I can from the drive.
Contents
gather data and verify it is broken
- It is a SATA drive, 250GB
- It spins up when power is applied
- Linux recognizes the drive and assigns it /dev/sdf
- I try to mount it as NTFS:
mount -t ntfs /dev/sdf /mnt/bob Error reading bootsector: Input/output error Failed to mount '/dev/sdf': Input/output error NTFS is either inconsistent or there is a hardware fault...
- I try to mount it as msdos:
mount -t msdos /dev/sdf /mnt/bob mount: /dev/sdf: can't read superblock
- I try to mount it as vfat:
mount -t vfat /dev/sdf /mnt/bob mount: /dev/sdf: can't read superblock
Having verified that the disk is really bad, I wrapped it in plastic, then in paper towels, then in a ziplock bag and put it in the freezer while I look for better tools to tell me what is going on. I've heard that freezing a drive can cause it to shrink enough to bring components back into working tolerance after they have worn out of tolerance. Shouldn't hurt.
new tools
I added a few packages that were not installed on my system.
disktype
Detect format on a disk or partition. http://disktype.sourceforge.net
testdisk
Data recovery tool.
GSmartControl
Graphical tool to get information from disks with smart monitoring.
mount frozen drive
Plugged the drive in after freezing it. Linux was unable to identify it. Lots of messages about hard resetting link. Link is slow to respond, please be patient. SRST failed (errno=-16)
Freezing it seems to have made it worse.
It comes up to speed on both tries.
Leaving it on until it comes up to temperature.
After connecting the drive, it seems to try about five times to establish a SATA link. When it gives up after five tries, it says
ata2: EH complete
Here are the syslog entries on the first try (at room temperature):
Jan 9 15:05:03 localhost kernel: [24068.600048] ata2: SRST failed (errno=-16) Jan 9 15:05:03 localhost kernel: [24068.600062] ata2: hard resetting link Jan 9 15:05:09 localhost kernel: [24074.550037] ata2: link is slow to respond, please be patient (ready=0) Jan 9 15:05:10 localhost kernel: [24076.172557] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300) Jan 9 15:05:14 localhost kernel: [24079.578666] ata2.00: failed to read native max address (err_mask=0x1) Jan 9 15:05:14 localhost kernel: [24079.578675] ata2.00: HPA support seems broken, skipping HPA handling Jan 9 15:05:14 localhost kernel: [24079.578689] ata2.00: ATA-7: WDC ROM MODEL-HAWK-----, 20.06C03, max UDMA/133 Jan 9 15:05:14 localhost kernel: [24079.578696] ata2.00: 15646177 sectors, multi 0: LBA48 NCQ (depth 0/32) Jan 9 15:05:14 localhost kernel: [24079.592685] ata2.00: configured for UDMA/133 Jan 9 15:05:14 localhost kernel: [24079.592714] ata2: EH complete
Here are the syslog entries after coming out of the freezer:
Jan 9 18:14:29 localhost kernel: [35434.634417] ata2: exception Emask 0x10 SAct 0x0 SErr 0x50000 action 0xe frozen
Jan 9 18:14:29 localhost kernel: [35434.634432] ata2: SError: { PHYRdyChg CommWake }
Jan 9 18:14:29 localhost kernel: [35434.634450] ata2: hard resetting link
Jan 9 18:14:35 localhost kernel: [35440.580036] ata2: link is slow to respond, please be patient (ready=0)
Jan 9 18:14:39 localhost kernel: [35444.660046] ata2: SRST failed (errno=-16)
Jan 9 18:14:39 localhost kernel: [35444.660060] ata2: hard resetting link
Jan 9 18:14:45 localhost kernel: [35450.612565] ata2: link is slow to respond, please be patient (ready=0)
Jan 9 18:14:45 localhost kernel: [35450.670050] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan 9 18:14:45 localhost kernel: [35450.692629] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan 9 18:14:50 localhost kernel: [35455.670047] ata2: hard resetting link
Jan 9 18:14:55 localhost kernel: [35460.840073] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan 9 18:14:55 localhost kernel: [35460.862635] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan 9 18:14:55 localhost kernel: [35460.862644] ata2: limiting SATA link speed to 1.5 Gbps
Jan 9 18:15:00 localhost kernel: [35465.840050] ata2: hard resetting link
Jan 9 18:15:05 localhost kernel: [35470.662556] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
Jan 9 18:15:05 localhost kernel: [35470.682631] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan 9 18:15:10 localhost kernel: [35475.660046] ata2: hard resetting link
Jan 9 18:15:15 localhost kernel: [35480.310097] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
Jan 9 18:15:15 localhost kernel: [35480.310128] ata2: EH complete
These are the syslog entries corresponding to removing power on the drive:
Jan 9 18:23:49 localhost kernel: [35994.946224] ata2: exception Emask 0x10 SAct 0x0 SErr 0x1910000 action 0xe frozen
Jan 9 18:23:49 localhost kernel: [35994.946239] ata2: SError: { PHYRdyChg Dispar LinkSeq TrStaTrns }
Jan 9 18:23:49 localhost kernel: [35994.946258] ata2: hard resetting link
Jan 9 18:23:50 localhost kernel: [35995.692544] ata2: SATA link down (SStatus 0 SControl 300)
Jan 9 18:23:50 localhost kernel: [35995.692582] ata2: EH complete
mounting the warm drive
After the drive came up to room temperature, tried again and got it to appear as /dev/sdf. Ran gsmartctl and got the result that overall health self-assessment test PASSED.
root@weasel:~/Desktop/disktype-9# ./disktype /dev/sdf --- /dev/sdf Block device, size 7.461 GiB (8010842624 bytes) disktype: Data read failed at position 0: Input/output error
That's not good.
Proceeded with disktest. It detected the drive's capacity to be 8GB. I told it to look for Intel partitions and it returned a partition read error.
mounting the warm drive at slower speed
I looked at the label of the drive and saw that it had two jumper settings:
- enable spread spectrum clocking
- enable 150Mb/sec bandwidth limit
No jumpers were present, so both options were disabled. But slowing down the drive from the default of 1.5Gb/sec sounds like a good thing to test. Powered down drive, added a jumper to pins 5 and 6 to limit disk speed to 150MB/s. Connected and it was immediately recognized.
Jan 9 18:44:35 localhost kernel: [37240.782532] ata2: link is slow to respond, please be patient (ready=0) Jan 9 18:44:38 localhost kernel: [37243.540054] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300) Jan 9 18:44:38 localhost kernel: [37243.581231] ata2.00: ATA-7: WDC WD2500JS-00SGB0, 20.06C03, max UDMA/133 Jan 9 18:44:38 localhost kernel: [37243.581240] ata2.00: 488397168 sectors, multi 0: LBA48 NCQ (depth 0/32) Jan 9 18:44:38 localhost kernel: [37243.613760] ata2.00: configured for UDMA/133 Jan 9 18:44:38 localhost kernel: [37243.613801] ata2: EH complete Jan 9 18:44:38 localhost kernel: [37243.614031] scsi 1:0:0:0: Direct-Access ATA WDC WD2500JS-00S 20.0 PQ: 0 ANSI: 5 Jan 9 18:44:38 localhost kernel: [37243.614402] sd 1:0:0:0: Attached scsi generic sg6 type 0 Jan 9 18:44:38 localhost kernel: [37243.614714] sd 1:0:0:0: [sdf] 488397168 512-byte logical blocks: (250 GB/232 GiB) Jan 9 18:44:38 localhost kernel: [37243.614806] sd 1:0:0:0: [sdf] Write Protect is off Jan 9 18:44:38 localhost kernel: [37243.614812] sd 1:0:0:0: [sdf] Mode Sense: 00 3a 00 00 Jan 9 18:44:38 localhost kernel: [37243.614859] sd 1:0:0:0: [sdf] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA Jan 9 18:44:38 localhost kernel: [37243.615193] sdf: sdf1 Jan 9 18:44:38 localhost kernel: [37243.623806] sd 1:0:0:0: [sdf] Attached SCSI disk
disktype saw an NTFS filesystem.
root@weasel:~/Desktop/disktype-9# ./disktype /dev/sdf
--- /dev/sdf
Block device, size 232.9 GiB (250059350016 bytes)
DOS/MBR partition map
Partition 1: 232.9 GiB (250048479744 bytes, 488375937 sectors from 63, bootable)
Type 0x07 (HPFS/NTFS)
Windows NTLDR boot loader
NTFS file system
Volume size 232.9 GiB (250048479232 bytes, 488375936 sectors)
Tried to mount, but failed:
root@weasel:/mnt# mount -t ntfs /dev/sdf /mnt/bob NTFS signature is missing. Failed to mount '/dev/sdf': Invalid argument The device '/dev/sdf' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
Started testdisk and the full capacity of the drive was detected properly. Selected the device (/dev/sdf) and scanned for Intel partitions. Found the bootable NTFS partition and scanned for files. Made sure I was in a Linux device with more than 250GB free space and copied all files in the root and all subdirectories. Testdisk was able to copy all files. It took about 40 minutes to copy 8GB.
