Disk recovery

From Finninday
Revision as of 02:28, 10 January 2010 by Rday (Talk | contribs)

Jump to: navigation, search

My father-in-law came to me with a failed hard disk from a Windows system. It is probably NTFS, but that isn't known for sure. I have a few Linux machines and will try to recover what I can from the drive.

gather data and verify it is broken

  • It is a SATA drive, 250GB
  • It spins up when power is applied
  • Linux recognizes the drive and assigns it /dev/sdf
  • I try to mount it as NTFS:
mount -t ntfs /dev/sdf /mnt/bob
Error reading bootsector: Input/output error
Failed to mount '/dev/sdf': Input/output error
NTFS is either inconsistent or there is a hardware fault... 
  • I try to mount it as msdos:
mount -t msdos /dev/sdf /mnt/bob
mount: /dev/sdf: can't read superblock
  • I try to mount it as vfat:
mount -t vfat /dev/sdf /mnt/bob
mount: /dev/sdf: can't read superblock

After verifying that the disk is really bad, I wrapped it in plastic, then in paper towels, then in a ziplock bag and put it in the freezer while I look for better tools to tell me what is going on.

new tools

I added a few packages that were not installed on my system.

disktype

Detect format on a disk or partition. http://disktype.sourceforge.net

testdisk

Data recovery tool.

GSmartControl

Graphical tool to get information from disks with smart monitoring.

mount frozen drive

Plugged the drive in after freezing it. Linux was unable to identify it. Lots of messages about hard resetting link. Link is slow to respond, please be patient. SRST failed (errno=-16)

Freezing it seems to have made it worse.

It comes up to speed on both tries.

Leaving it on until it comes up to temperature.

After connecting the drive, it seems to try about five times to establish a SATA link. When it gives up after five tries, it says

ata2: EH complete

Here are the syslog entries on the first try (at room temperature):

Jan  9 15:05:03 localhost kernel: [24068.600048] ata2: SRST failed (errno=-16)
Jan  9 15:05:03 localhost kernel: [24068.600062] ata2: hard resetting link
Jan  9 15:05:09 localhost kernel: [24074.550037] ata2: link is slow to respond, please be patient (ready=0)
Jan  9 15:05:10 localhost kernel: [24076.172557] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan  9 15:05:14 localhost kernel: [24079.578666] ata2.00: failed to read native max address (err_mask=0x1)
Jan  9 15:05:14 localhost kernel: [24079.578675] ata2.00: HPA support seems broken, skipping HPA handling
Jan  9 15:05:14 localhost kernel: [24079.578689] ata2.00: ATA-7: WDC ROM MODEL-HAWK-----, 20.06C03, max UDMA/133
Jan  9 15:05:14 localhost kernel: [24079.578696] ata2.00: 15646177 sectors, multi 0: LBA48 NCQ (depth 0/32)
Jan  9 15:05:14 localhost kernel: [24079.592685] ata2.00: configured for UDMA/133
Jan  9 15:05:14 localhost kernel: [24079.592714] ata2: EH complete

Here are the syslog entries after coming out of the freezer:

Jan  9 18:14:29 localhost kernel: [35434.634417] ata2: exception Emask 0x10 SAct 0x0 SErr 0x50000 action 0xe frozen
Jan  9 18:14:29 localhost kernel: [35434.634432] ata2: SError: { PHYRdyChg CommWake }
Jan  9 18:14:29 localhost kernel: [35434.634450] ata2: hard resetting link
Jan  9 18:14:35 localhost kernel: [35440.580036] ata2: link is slow to respond, please be patient (ready=0)
Jan  9 18:14:39 localhost kernel: [35444.660046] ata2: SRST failed (errno=-16)
Jan  9 18:14:39 localhost kernel: [35444.660060] ata2: hard resetting link
Jan  9 18:14:45 localhost kernel: [35450.612565] ata2: link is slow to respond, please be patient (ready=0)
Jan  9 18:14:45 localhost kernel: [35450.670050] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan  9 18:14:45 localhost kernel: [35450.692629] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan  9 18:14:50 localhost kernel: [35455.670047] ata2: hard resetting link
Jan  9 18:14:55 localhost kernel: [35460.840073] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
Jan  9 18:14:55 localhost kernel: [35460.862635] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan  9 18:14:55 localhost kernel: [35460.862644] ata2: limiting SATA link speed to 1.5 Gbps
Jan  9 18:15:00 localhost kernel: [35465.840050] ata2: hard resetting link
Jan  9 18:15:05 localhost kernel: [35470.662556] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
Jan  9 18:15:05 localhost kernel: [35470.682631] ata2.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
Jan  9 18:15:10 localhost kernel: [35475.660046] ata2: hard resetting link
Jan  9 18:15:15 localhost kernel: [35480.310097] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
Jan  9 18:15:15 localhost kernel: [35480.310128] ata2: EH complete

These are the syslog entries corresponding to removing power on the drive:

Jan  9 18:23:49 localhost kernel: [35994.946224] ata2: exception Emask 0x10 SAct 0x0 SErr 0x1910000 action 0xe frozen
Jan  9 18:23:49 localhost kernel: [35994.946239] ata2: SError: { PHYRdyChg Dispar LinkSeq TrStaTrns }
Jan  9 18:23:49 localhost kernel: [35994.946258] ata2: hard resetting link
Jan  9 18:23:50 localhost kernel: [35995.692544] ata2: SATA link down (SStatus 0 SControl 300)
Jan  9 18:23:50 localhost kernel: [35995.692582] ata2: EH complete

After the drive came up to room temperature, tried again and got it to appear as /dev/sdf. Ran gsmartctl and got the result that overall health self-assessment test PASSED.