Recovering Data from a Dying Hard Drive
I spent a week trying to recover photos and documents from a friend's dying hard drive ( whilst coding TellDJ of course ;) ). Most of that time was simply spent waiting for various tools to do their jobs, but ultimately I managed to get the stuff off for a grand total of £10 (or free if you don't need the enclosure, but it's still significantly less than a quoted £600). This post cuts out all the various things I tried (which tooks days sometimes) and gets to the thing that worked for me. I figured I'd write a blog post about how I did it in the hope that it helps save someone else's time and data.
Disclaimer: I take no responsibility for what happens to your drive, data, or anything related. I'm just explaining the steps I took to perform the task and the things that worked for me. Use the information below at your own risk and if the data is important enough, then you should consider paying for a professional data recovery service to get the data back. Basically, YMMV :)
The Situation
My friend's hard drive was from a Macbook Pro (MBP 500gb). I have a Macbook (320gb) to connect and mount the drive to and I also have a Windows 7 PC with a bigger hard drive (1 TB). The information below should also work with a FAT32/NTFS formatted drive, but since the MBP hard drive is HFS+ formatted in this case, I needed a MBP to be able to read the files off it. Both MBPs (damaged hard drive one and my working one) were running Snow Leopard.
Setup
My first idea was to put the HDD into an enclosure and hope that my working MBP could read the data off it after booting into OSX. I purchased a 2.5" SATA External HDD enclosure and installed the dying HDD into it. I connected the enclosure via USB to my MBP. However, the MBP couldn't mount the device (nothing appeared in Finder) and Disk Utility couldn't repair it (although it could see that it was a 500gb hard drive). I wasn't sure how much of the 500gb was actually used and so, to be on the safe side, I needed to ensure that I had 500gb free. This is where my desktop comes in and I managed to transfer some files to an external drive so that I could have 500gb free (in the end, it turned out I only needed 60gb since that's how much was in use on the broken hard drive).
Software I Used
- ddrescue (This is different from dd_rescue and will be used to 'clone' the harddrive)
- PhotoRec (will be used to recover documents)
I did try the trial for Data Rescue II and left it running for a few days, but I didn't get any data back and just quit the process since it was still running. Of course, that's not to say it won't work for you, but it depends on how far gone your hard drive is.
ddrescue is used to copy and recover blocks from the HDD into an image. Now, there are various ways you can approach this and I suggest you read the manual for all the options. You can directly save the contents to another hard drive, or you can save it into a DMG file which is what I did.
Both, ddrescue and PhotoRec can be used on Windows and Linux so even if all the steps in this article are not relevant to you, the key parts may well be.
Connecting the Mac to the PC
If your Mac has a bigger hard drive than the damaged one, then you don't need to save to a PC and can skip this step. I initially just connected via the wireless network but a short drop in connectivity caused ddrescue to throw an error (because it couldn't find the destination address to save to). For reliablity, a crossover cable connected my Mac to my PC. I have a shared folder on my PC and accessed it via Terminal on my Mac:
mount_smbfs //pcusername:pcpassword@localip/KP /Users/keyboardP/Recovery/
pcusername = username of the account on the PC
pcpassword = password of the account you're trying to log in with (if there is one)
localip = local ip of the machine (this doesn't necessarily start with 192.168...) You can find your PC's local ip address by pressing 'start' and typing 'cmd', followed by enter. Then type in 'ipconfig' in the command prompt and you'll see the ip address of the network adapter you're using. Note that the 'KP' at the end refers to the directory being shared on the machine.
/Users/keyboardP/Recovery is the folder on your MBP that links to the shared directory on the PC. So, for example, if you create a new text document within that folder, it's saved on the desktop PC because that folder is simply an alias for the shared directory and isn't actually storing that data on your MBP.
After you've entered the above, press enter and if all went well, there shouldn't be any messages. You can now test this connection by opening Finder and navigating to /Users/keyboardP/Recovery (or whatever you typed). You should see the PC's shared stuff in this directory.
I've heard about this many times, but the performance of copying data between Mac and Windows 7 is terrible and I experience the same thing. However, I followed this trick and it did improve the performance slightly. That 'slightly' shouldn't be underestimated in this project as it adds up to save quite a bit of time.
Running ddrescue
Now that the PC is connected, I'm guaranteed to have enough space to copy the entire contents of the damaged HDD. I plugged in my hard drive (which doesn't mount) but appeared when I typed diskutil list in Terminal. I could tell which one it was by looking at the hard drive space (500gb as opposed to the MBP I was using which had 320gb). I then downloaded, installed and ran ddrescue via terminal modifying the commands mentioned here.
At the time I peformed this, 1.16-rc1.tar.gz was the latest stable version. You can see all the versions here.
First we need to install ddrescue, so extract the downloaded file and navigate to in Terminal. Once in the directory, type ./configure and press return. Assuming no erorrs, type make and ddrescue should now be built and installed.
Whilst still in the ddrescue directory, you can now perform the command to copy the blocks of the HDD to your working machine.
Now, the -n parameter version is optional (as opposed to the -r version I'll be explaining) and is used if you want to quickly copy across any error-free sections. This will be quicker since it ignores any damaged areas. I did perform this step, but I've heard other people skip this step and just attempt the full recovery which attempts to fix and copy the corrupt areas as well. You can read about all the command line switches here. /dev/disk1 is the name of the damaged HDD when I connected it via the USB enclosure. If you've forgotten the name from above, you can see it by typing diskutil list. nImage.dmg is the name of the file we're going to copy the across to. Note that the directory is local to the MBP but is actually the alias for the desktop which we created above. Therefore, the dmg file is actually being saved on the desktop since it has a bigger hard drive space than the broken HDD. nLog is the name of the log I want to save to. The log is very important if you're interested in being able to stop and start the process as it allowed ddrescue to start from where it left off. If you don't have a log and you stop ddrescue, then ddrescue will have to start from the beginning (which can result in potentially days of effort). Basically, you should keep a log IMO.
sudo ./ddrescue -n -v /dev/disk1 /Users/keyboardP/Recovery/nImage.dmg /Users/keyboardP/Recovery/nLog.log
sudo ./ddrescue -r3 /dev/disk1 /Users/keyboardP/Recovery/rImage.dmg /Users/keyboardP/Recovery/rLog.log
In my case, ddrescue got to around 60gb at which point it was barely increasing. I pressed CTRL+C to interrupt and created a copy of the dmg file (just in case I messed it up somehow). Also, make sure you don't delete the log file by accident otherwise you'll have to do it all again (and hope that your hard drive is still physically readable).
Now that we have the dmg, we can try and get the MBP to read it as a disk device (even if it still can't mount it). I copied the copied version of the DMG file to the Mac so that the recovery process ran faster since it didn't have to perform it over a network.
sudo hdiutil attach -imagekey -diskimage-class=CRawDiskImage -nomount /Users/keyboardP/rImagecopy.dmg
(notice I'm using rImageCopy which is the copied version, just in case I broke something :D)
Press enter and hopefully it will return /dev/disk2 (or something like that, instead of an error).
Open up (or install if you haven't done so), PhotoRec. Follow the great guide explained on the official PhotoRec's page. You can select what file types you want to recover and then let it do its thing. This stage didn't take too long, relatively speaking (maybe around 8 hours), but I now had the all-important photos and word documents my friend wanted.
On a slight tangent, if you're running Windows and your hard drive is fine, but you want to recover deleted files, I've successfully used PC Inspector File Recovery. The key thing with deleted files is to try and recover them ASAP. The more you use your machine, the higher the chance of the deleted file data being overwritten thus making it ever harder to recover the files. PhotoRec should do the job as well, but less technical users may prefer the visual based aspect of PC Inspector File Recovery.
That's pretty much it! I hope this helps save your data and your time (some tools took days to just read the hard drive, so I ended up quitting them). This is all from memory and my Terminal history, but having re-read it, there doesn't seem to be anything missing. Of course, the key thing with data recovery is speed so avoid using your HDD when you don't need it (which is why a clone is better than trying to recover directly form the HDD). If you're not sure of what you're doing and the data is very important, then a data recovery service may be a better approach than a DIY thing. You can also try other tools such as Data Rescue II or DiskWarrior. Good luck!
