Re: Hard drive error
Edwin Sineath wrote:
> Is there any hope for this hard drive? Here is the message I get when I
> try to mount it:
> Error mounting: mount exited with exit code 13: Inode is corrupt (5):
> Input/output error
> Failed to mount '/dev/sdb1': Input/output error
A matching error message here, suggests there is more to the error message.
Is the partition NTFS ?
Perhaps there is some way to run CHKDSK in Windows on it. The thing
is, there is at least one commercial package, with tools to work on
NTFS (from Linux, perhaps $100 or so), but in general, Linux itself
is not well armed to work with it. There may be a utility in Linux that
claims to check an NTFS partition, but it's my understanding all it does
is set the "dirty" bit, so that on the next boot in Windows, Windows
will run CHKDSK (chkntfs) on it.
If you wanted a free Windows utility, to try and recover it, there
is always this. This runs in Windows. Of course, this isn't going to
help, if the NTFS partition in question, is the actual Windows C: boot
partition and you don't have a working OS to use. One poster years
ago, managed to revive a broken NTFS data partition with this. And there
are any number of $39.95 data recovery programs that will offer
to do the same for you. The author of this free program, eventually
sold it to a commercial software company, which is why you have to
scrounge around to find a copy of the free version.
My generic advice, is to start with a sector by sector backup of the
device, to another disk. You can do that with "dd". If the usage of
any "in-place" recovery tools, including CHKDSK, makes matters worse,
you can always go back to Linux and restore sector by sector and try
again. As long as you have a backup image, you can make multiple attempts
at recovery. If the disk is physically damaged and dies during the
repair attempts, that backup will be a nice copy of any data. Then,
using yet another drive, you can copy the image over there and try
another crack at CHKDSK or whatever.
Now, maybe I got it wrong, and that partition is EXT2/EXT3/EXT4 or whatever.
To help posters here, you might mention the partition type, as then
they'll be better able to help you.
To evaluate the health of the drive, you can either use SMART in Linux,
or go to the disk manufacturer's site and get their diagnostic software.
For example, I have "Seatools for DOS" on a floppy, but unfortunately
it doesn't work on my current motherboard. I think it runs on my
other modern motherboard though, so I have to take the drive over
to the other machine to run it. It can check the disk and tell you
if it is sick and ready to die. You can also use the free version
of HDTune and do a surface scan, but that's in Windows again. It
has a nice map feature, with colored blocks indicating whether
CRC errors are present. If the disk is showing errors, there isn't
much point in trying in-place repairs. The in-place repair might
mark bad clusters so they can't be used, but then your repair
would be an uphill struggle. It's much better to work on the data,
on a drive which is known good and not contributing to the problems.
To copy data off a flaky drive, a tool is mentioned here. This
is a faster way to make a sector by sector copy, when the drive
has actual bad sectors on it. Any unreadable sectors are filled
with zeros as far as I know. I've had disks that are so bad,
you can come back the next day, and the transfer attempt isn't
even half done. I haven't used this yet, but I understand
it's another approach to getting the job done.
# first, grab most of the error-free areas in a hurry:
./ddrescue -n /dev/old_disk /dev/new_disk rescued.log
# then try to recover as much of the dicy areas as possible:
./ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log
Re: Hard drive error
Edwin Sineath wrote:
> Thanks much! It is an NTFS partition. I put it in an external case and
> plugged it into a Windows computer but it was never recognized. I can't
> use any linux tool because I can't get this hard drive to mount.
The first step, when connecting a disk to the computer, is seeing whether
the disk is returning an identity. In the case of a USB connected
drive, I guess you'd check Device Manager, and see if anything shows up
in there. If the drive isn't being recognized at all, then there is no
sense looking at file system level stuff. So first the disk has to
If it doesn't respond in there, you could install the drive inside
the computer, using an available SATA or IDE port.
A simple check that the disk is still running, is to enter the BIOS and
look at a drive table. Alternately, when you turn on the PC power
and the computer starts to POST, at least my computers here, put
a list of disk drives up on the screen during the POST, as they're
discovered. If I push the "Pause" key on my keyboard, I can stop
the sequence, and inspect the text on the screen at my leisure.
Pressing some other key, may cause the boot sequence to continue.
Since we're in Windows, diskmgmt.msc will bring up Disk Management.
In there, you should have one line per disk drive in the graphical
section. For example, I have two hard drives and a CDROM and see this.
| Disk 0 | |
| Disk 1 | |
| CDROM | |
If you see the drive there, but the details in the right hand
side aren't what you expect, it's a start. At least the drive
is responding. To draw that picture, I expect the operating
system has to be able to read the MBR (sector 0).
The next test is also pretty easy. Say, disk 1 is installed
internally, and it's the sick one. Now, we can close Disk Management
for a moment, and use PTEDIT32 to display the partition table
for the sick drive. If you run this in Windows 7, you need to
elevate this to the administrator account, or you'll get a
bogus "error 5". With other OSes I wouldn't expect a problem.
This is a disk with three partitions (from a Dell), where the
second partition is a bootable NTFS. Double clicking the "07" field
in that window, should bring up a pop up menu of partition types. You
can also get a list of partition types from a web site. Since you've got
Linux, you also have the option of doing "sudo fdisk /dev/sda" and
the partition type command in there also has an option to list all the
partition type values.
OK, that leaves the hard part. What is actually in that partition ?
This is a ridiculously small executable, but a nuisance to get a hold
of. As far as I know, there is no port to Windows yet. If you're in
Linux, open the Package Manager, and some recent distros have added
it as a package. You might have to tick "universe" or "multiverse"
or the like, and reload the package list (takes a minute or two
to download), before the fool thing shows up in the list of packages.
You end up downloading megabytes of package manager cruft, just so
you can get a hold of a KB-sized executable. Doing it through
package manage, means not having to compile it.
In Linux, you'd try something like
sudo disktype /dev/sdb2
to discover the file system type of the second partition of disk sdb.
The program apparently checks several criteria, and if not all
criteria are met, it may say "NTFS based on 3 out of 5 criteria"
or the like. So when the partition is damaged, it may report
less than 5 out of 5 or whatever.
OK, so now what can we do.
If disktype can't see anything, or if you really don't want to bother
using disktype, the next tool is TestDisk. It scans a disk for
partitions, and creates a new primary partition table based on
the results. Earlier, you used PTEDIT32 to capture a picture
of the current MBR. TestDisk will try to make a new one, but
won't write it unless you tell it to. Pressing "control-C" at
any time, should cause the program to exit without damaging
anything. TestDisk is available for Linux and Windows, and
is even included on some distros of Linux.
Now, if the MBR was damaged, then programs like disktype will
be sent to the wrong starting address on the disk. To use
TestDisk, you the operator have to look at the computed
result, and see whether it makes sense or not.
To give an example, I had a disk with four partitions. Using
Disk Management, I deleted the last partition. Now, there were
three partitions, verified in PTEDIT32. I ran TestDisk, and
after scanning for ten minutes, it found all four partitions.
Now, I as the operator, know the fourth partition is not valid,
and would be considered a "phantom". So TestDisk is doing
"too good a job" in this case. But occasionally, TestDisk
computes a new result, you apply it, and magically your
partition is there again. You would compare the numeric
values of the original MBR, versus the new values, to try
and determine whether something has changed and how it
I hardly ever write out the new MBR to the disk, when using
TestDisk, so it is mainly a forensic tool for me. If I seriously
thought using the new MBR was the right answer, I'd back up the
MBR first, and if I was wrong, I could put the MBR back later.
Something like this, will save the 512 byte MBR in a file for you.
sudo dd if=/dev/sdb of=mybackup_mbr bs=512 count=1
Well, now I don't know what to do next. If disktype reports
a strong showing, I'd probably want to run CHKDSK, but the
problem is, how to tell CHKDSK where to look. CHKDSK has
two ways to point to disks. I can use a drive letter, like this
or it can use a mount point. But right now, the partition won't
mount, so how the hell do we get it to repair the partition ?
You can determine a symbolic link name for a volume by
using the mountvol command.
I didn't find that to be particular easy to deal with, and if
it isn't mounted, then I don't see how we can get that
fancy GUID value. The GUID option is useful, if you forgot
to assign a drive letter to the partition.
So that means using some data recovery tool, like some of the
or that one I mentioned in my other post.
I don't know of a tool that can attack the damaged
partition, and fix it up enough so it'll mount. I
expect there are commercial tools to do that, but I
don't own any of them. If I was in your situation,
I'd probably have to use a file scrounger.
|All times are GMT. The time now is 08:56 AM.|
Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.