Disk recovery

My father-in-law came to me with a failed hard disk from a Windows system. It is probably NTFS, but that isn't known for sure. I have a few Linux machines and will try to recover what I can from the drive.

gather data and verify it is broken

• It is a SATA drive, 250GB
• It spins up when power is applied
• Linux recognizes the drive and assigns it /dev/sdf
• I try to mount it as NTFS:

mount -t ntfs /dev/sdf /mnt/bob
Error reading bootsector: Input/output error
Failed to mount '/dev/sdf': Input/output error
NTFS is either inconsistent or there is a hardware fault... 

• I try to mount it as msdos:

mount -t msdos /dev/sdf /mnt/bob
mount: /dev/sdf: can't read superblock

• I try to mount it as vfat:

mount -t vfat /dev/sdf /mnt/bob
mount: /dev/sdf: can't read superblock

Having verified that the disk is really bad, I wrapped it in plastic, then in paper towels, then in a ziplock bag and put it in the freezer while I look for better tools to tell me what is going on. I've heard that freezing a drive can cause it to shrink enough to bring components back into working tolerance after they have worn out of tolerance. Shouldn't hurt.

new tools

I added a few packages that were not installed on my system.

disktype

Detect format on a disk or partition. http://disktype.sourceforge.net

testdisk

Data recovery tool.

GSmartControl

Graphical tool to get information from disks with smart monitoring.

mount frozen drive

Plugged the drive in after freezing it. Linux was unable to identify it. Lots of messages about hard resetting link. Link is slow to respond, please be patient. SRST failed (errno=-16)

Freezing it seems to have made it worse.

It comes up to speed on both tries.

Leaving it on until it comes up to temperature.

After connecting the drive, it seems to try about five times to establish a SATA link. When it gives up after five tries, it says

ata2: EH complete

Here are the syslog entries on the first try (at room temperature):

Jan  9 15:05:03 localhost kernel: [24068.600048] ata2: SRST failed (errno=-16)
Jan  9 15:05:03 localhost kernel: [24068.600062] ata2: hard resetting link
Jan  9 15:05:09 localhost kernel: [24074.550037] ata2: link is slow to respond, please be patient (ready=0)
Jan  9 15:05:10 localhost kernel: [24076.172557] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan  9 15:05:14 localhost kernel: [24079.578666] ata2.00: failed to read native max address (err_mask=0x1)
Jan  9 15:05:14 localhost kernel: [24079.578675] ata2.00: HPA support seems broken, skipping HPA handling
Jan  9 15:05:14 localhost kernel: [24079.578689] ata2.00: ATA-7: WDC ROM MODEL-HAWK-----, 20.06C03, max UDMA/133
Jan  9 15:05:14 localhost kernel: [24079.578696] ata2.00: 15646177 sectors, multi 0: LBA48 NCQ (depth 0/32)
Jan  9 15:05:14 localhost kernel: [24079.592685] ata2.00: configured for UDMA/133
Jan  9 15:05:14 localhost kernel: [24079.592714] ata2: EH complete

Here are the syslog entries after coming out of the freezer:

Jan  9 18:14:29 localhost kernel: [35434.634417] ata2: exception Emask 0x10 SAct 0x0 SErr 0x50000 action 0xe frozen
Jan  9 18:14:29 localhost kernel: [35434.634432] ata2: SError: { PHYRdyChg CommWake }
Jan  9 18:14:29 localhost kernel: [35434.634450] ata2: hard resetting link
Jan  9 18:14:35 localhost kernel: [35440.580036] ata2: link is slow to respond, please be patient (ready=0)
Jan  9 18:14:39 localhost kernel: [35444.660046] ata2: SRST failed (errno=-16)
Jan  9 18:14:39 localhost kernel: [35444.660060] ata2: hard resetting link
Jan  9 18:14:45 localhost kernel: [35450.612565] ata2: link is slow to respond, please be patient (ready=0)
Jan  9 18:14:45 localhost kernel: [35450.670050] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan  9 18:14:45 localhost kernel: [35450.692629] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan  9 18:14:50 localhost kernel: [35455.670047] ata2: hard resetting link
Jan  9 18:14:55 localhost kernel: [35460.840073] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan  9 18:14:55 localhost kernel: [35460.862635] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan  9 18:14:55 localhost kernel: [35460.862644] ata2: limiting SATA link speed to 1.5 Gbps
Jan  9 18:15:00 localhost kernel: [35465.840050] ata2: hard resetting link
Jan  9 18:15:05 localhost kernel: [35470.662556] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
Jan  9 18:15:05 localhost kernel: [35470.682631] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan  9 18:15:10 localhost kernel: [35475.660046] ata2: hard resetting link
Jan  9 18:15:15 localhost kernel: [35480.310097] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
Jan  9 18:15:15 localhost kernel: [35480.310128] ata2: EH complete

These are the syslog entries corresponding to removing power on the drive:

Jan  9 18:23:49 localhost kernel: [35994.946224] ata2: exception Emask 0x10 SAct 0x0 SErr 0x1910000 action 0xe frozen
Jan  9 18:23:49 localhost kernel: [35994.946239] ata2: SError: { PHYRdyChg Dispar LinkSeq TrStaTrns }
Jan  9 18:23:49 localhost kernel: [35994.946258] ata2: hard resetting link
Jan  9 18:23:50 localhost kernel: [35995.692544] ata2: SATA link down (SStatus 0 SControl 300)
Jan  9 18:23:50 localhost kernel: [35995.692582] ata2: EH complete

mounting the warm drive

After the drive came up to room temperature, tried again and got it to appear as /dev/sdf. Ran gsmartctl and got the result that overall health self-assessment test PASSED.

root@weasel:~/Desktop/disktype-9# ./disktype /dev/sdf

--- /dev/sdf
Block device, size 7.461 GiB (8010842624 bytes)
disktype: Data read failed at position 0: Input/output error

That's not good.

Proceeded with disktest. It detected the drive's capacity to be 8GB. I told it to look for Intel partitions and it returned a partition read error.

mounting the warm drive at slower speed

I looked at the label of the drive and saw that it had two jumper settings:

• enable spread spectrum clocking
• enable 150Mb/sec bandwidth limit

No jumpers were present, so both options were disabled. But slowing down the drive from the default of 1.5Gb/sec sounds like a good thing to test. Powered down drive, added a jumper to pins 5 and 6 to limit disk speed to 150MB/s. Connected and it was immediately recognized.

Jan  9 18:44:35 localhost kernel: [37240.782532] ata2: link is slow to respond, please be patient (ready=0)
Jan  9 18:44:38 localhost kernel: [37243.540054] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan  9 18:44:38 localhost kernel: [37243.581231] ata2.00: ATA-7: WDC WD2500JS-00SGB0, 20.06C03, max UDMA/133
Jan  9 18:44:38 localhost kernel: [37243.581240] ata2.00: 488397168 sectors, multi 0: LBA48 NCQ (depth 0/32)
Jan  9 18:44:38 localhost kernel: [37243.613760] ata2.00: configured for UDMA/133
Jan  9 18:44:38 localhost kernel: [37243.613801] ata2: EH complete
Jan  9 18:44:38 localhost kernel: [37243.614031] scsi 1:0:0:0: Direct-Access     ATA      WDC WD2500JS-00S 20.0 PQ: 0 ANSI: 5
Jan  9 18:44:38 localhost kernel: [37243.614402] sd 1:0:0:0: Attached scsi generic sg6 type 0
Jan  9 18:44:38 localhost kernel: [37243.614714] sd 1:0:0:0: [sdf] 488397168 512-byte logical blocks: (250 GB/232 GiB)
Jan  9 18:44:38 localhost kernel: [37243.614806] sd 1:0:0:0: [sdf] Write Protect is off
Jan  9 18:44:38 localhost kernel: [37243.614812] sd 1:0:0:0: [sdf] Mode Sense: 00 3a 00 00
Jan  9 18:44:38 localhost kernel: [37243.614859] sd 1:0:0:0: [sdf] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
Jan  9 18:44:38 localhost kernel: [37243.615193]  sdf: sdf1
Jan  9 18:44:38 localhost kernel: [37243.623806] sd 1:0:0:0: [sdf] Attached SCSI disk

disktype saw an NTFS filesystem.

root@weasel:~/Desktop/disktype-9# ./disktype /dev/sdf

--- /dev/sdf
Block device, size 232.9 GiB (250059350016 bytes)
DOS/MBR partition map
Partition 1: 232.9 GiB (250048479744 bytes, 488375937 sectors from 63, bootable)
  Type 0x07 (HPFS/NTFS)
  Windows NTLDR boot loader
  NTFS file system
    Volume size 232.9 GiB (250048479232 bytes, 488375936 sectors)

Tried to mount, but failed:

root@weasel:/mnt# mount -t ntfs /dev/sdf /mnt/bob
NTFS signature is missing.
Failed to mount '/dev/sdf': Invalid argument
The device '/dev/sdf' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Started testdisk and the full capacity of the drive was detected properly. Selected the device (/dev/sdf) and scanned for Intel partitions. Found the bootable NTFS partition and scanned for files. Made sure I was in a Linux device with more than 250GB free space and copied all files in the root and all subdirectories. Testdisk was able to copy all files. It took about 40 minutes to copy 8GB.