Recover data from HDD

Date: August 30, 2018

Sometimes it happens, that HDD, containing important data, stops working. Everybody knows about necessity of making backups, but for various reasons people often don’t make them… Therefore it’s quite a common story, when files need to be recovered from broken hard drive.

In my case the hard drive wasn’t spinning at all (although the HDD motor tried to spin on startup). It gave rise to suspicion, that HDD head stuck on the platter. After the hard drive was opened up, the suspicion appeared to be true.

Sometimes the head gets damaged after getting stuck on the platter, and there is no way to read data except to replace the head. Hopefully, in my case it was enough to park the head on its place, and the HDD started to spin up and read data.

After the hard drive started spinning, OS Linux detected it - but the attempt to mount data partition resulted with an error.

The first thing to do was to make a snapshot of broken partition in order to get as max data as possible. I used a ddrescue command for that. There are ddrescue programs of different authors, and the difference is described here.

At first, I just read the partition without stopping on errors. Full description of used options can be found here.

There are various ways to read broken sectors. I turned on “direct disk access” (-d option) and removed options of skipping error blocks.

It resulted with reading most of HDD partition, with a small data loss. As a mean of recovering data, I may have used testdisk. But it has one big disadvantage - it can’t restore folder structure, which was a key necessity for me (since NTFS partition table wasn’t completely lost). That’s why I used R-STUDIO for my purpose.

R-STUDIO scanned an image of hard drive and found several partitions there. Since I knew that partition had NTFS filesystem, I chose the 1st one for data recovery.

Data recovery was completed successfully.