Re: Hard drive error

Discussion in 'Computer Information' started by Paul, May 19, 2011.

  1. Paul

    Paul Guest

    Edwin Sineath wrote:
    > Is there any hope for this hard drive? Here is the message I get when I
    > try to mount it:
    >
    > Error mounting: mount exited with exit code 13: Inode is corrupt (5):
    > Input/output error
    > Failed to mount '/dev/sdb1': Input/output error


    A matching error message here, suggests there is more to the error message.

    http://forums.linuxmint.com/viewtopic.php?f=46&t=72604&p=421683

    Is the partition NTFS ?

    Perhaps there is some way to run CHKDSK in Windows on it. The thing
    is, there is at least one commercial package, with tools to work on
    NTFS (from Linux, perhaps $100 or so), but in general, Linux itself
    is not well armed to work with it. There may be a utility in Linux that
    claims to check an NTFS partition, but it's my understanding all it does
    is set the "dirty" bit, so that on the next boot in Windows, Windows
    will run CHKDSK (chkntfs) on it.

    If you wanted a free Windows utility, to try and recover it, there
    is always this. This runs in Windows. Of course, this isn't going to
    help, if the NTFS partition in question, is the actual Windows C: boot
    partition and you don't have a working OS to use. One poster years
    ago, managed to revive a broken NTFS data partition with this. And there
    are any number of $39.95 data recovery programs that will offer
    to do the same for you. The author of this free program, eventually
    sold it to a commercial software company, which is why you have to
    scrounge around to find a copy of the free version.

    http://www.pricelesswarehome.org/WoundedMoon/win32/driverescue19d.html

    My generic advice, is to start with a sector by sector backup of the
    device, to another disk. You can do that with "dd". If the usage of
    any "in-place" recovery tools, including CHKDSK, makes matters worse,
    you can always go back to Linux and restore sector by sector and try
    again. As long as you have a backup image, you can make multiple attempts
    at recovery. If the disk is physically damaged and dies during the
    repair attempts, that backup will be a nice copy of any data. Then,
    using yet another drive, you can copy the image over there and try
    another crack at CHKDSK or whatever.

    Now, maybe I got it wrong, and that partition is EXT2/EXT3/EXT4 or whatever.
    To help posters here, you might mention the partition type, as then
    they'll be better able to help you.

    To evaluate the health of the drive, you can either use SMART in Linux,
    or go to the disk manufacturer's site and get their diagnostic software.
    For example, I have "Seatools for DOS" on a floppy, but unfortunately
    it doesn't work on my current motherboard. I think it runs on my
    other modern motherboard though, so I have to take the drive over
    to the other machine to run it. It can check the disk and tell you
    if it is sick and ready to die. You can also use the free version
    of HDTune and do a surface scan, but that's in Windows again. It
    has a nice map feature, with colored blocks indicating whether
    CRC errors are present. If the disk is showing errors, there isn't
    much point in trying in-place repairs. The in-place repair might
    mark bad clusters so they can't be used, but then your repair
    would be an uphill struggle. It's much better to work on the data,
    on a drive which is known good and not contributing to the problems.

    To copy data off a flaky drive, a tool is mentioned here. This
    is a faster way to make a sector by sector copy, when the drive
    has actual bad sectors on it. Any unreadable sectors are filled
    with zeros as far as I know. I've had disks that are so bad,
    you can come back the next day, and the transfer attempt isn't
    even half done. I haven't used this yet, but I understand
    it's another approach to getting the job done.

    http://www.cgsecurity.org/wiki/Damaged_Hard_Disk

    cd ddrescue-1.8

    # first, grab most of the error-free areas in a hurry:
    ./ddrescue -n /dev/old_disk /dev/new_disk rescued.log

    # then try to recover as much of the dicy areas as possible:
    ./ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log

    HTH,
    Paul
    Paul, May 19, 2011
    #1
    1. Advertising

  2. Paul

    Paul Guest

    Edwin Sineath wrote:
    > Thanks much! It is an NTFS partition. I put it in an external case and
    > plugged it into a Windows computer but it was never recognized. I can't
    > use any linux tool because I can't get this hard drive to mount.
    >


    The first step, when connecting a disk to the computer, is seeing whether
    the disk is returning an identity. In the case of a USB connected
    drive, I guess you'd check Device Manager, and see if anything shows up
    in there. If the drive isn't being recognized at all, then there is no
    sense looking at file system level stuff. So first the disk has to
    respond.

    If it doesn't respond in there, you could install the drive inside
    the computer, using an available SATA or IDE port.

    A simple check that the disk is still running, is to enter the BIOS and
    look at a drive table. Alternately, when you turn on the PC power
    and the computer starts to POST, at least my computers here, put
    a list of disk drives up on the screen during the POST, as they're
    discovered. If I push the "Pause" key on my keyboard, I can stop
    the sequence, and inspect the text on the screen at my leisure.
    Pressing some other key, may cause the boot sequence to continue.

    Since we're in Windows, diskmgmt.msc will bring up Disk Management.
    In there, you should have one line per disk drive in the graphical
    section. For example, I have two hard drives and a CDROM and see this.

    +---------+----------------------------+
    | Disk 0 | |
    +---------+----------------------------+
    | Disk 1 | |
    +---------+----------------------------+
    | CDROM | |
    +---------+----------------------------+

    If you see the drive there, but the details in the right hand
    side aren't what you expect, it's a start. At least the drive
    is responding. To draw that picture, I expect the operating
    system has to be able to read the MBR (sector 0).

    The next test is also pretty easy. Say, disk 1 is installed
    internally, and it's the sick one. Now, we can close Disk Management
    for a moment, and use PTEDIT32 to display the partition table
    for the sick drive. If you run this in Windows 7, you need to
    elevate this to the administrator account, or you'll get a
    bogus "error 5". With other OSes I wouldn't expect a problem.

    ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip

    This is a disk with three partitions (from a Dell), where the
    second partition is a bootable NTFS. Double clicking the "07" field
    in that window, should bring up a pop up menu of partition types. You
    can also get a list of partition types from a web site. Since you've got
    Linux, you also have the option of doing "sudo fdisk /dev/sda" and
    the partition type command in there also has an option to list all the
    partition type values.

    http://www.vistax64.com/attachments...n-partiton-recovery-dell-xps-420-dell-tbl.gif

    OK, that leaves the hard part. What is actually in that partition ?

    This is a ridiculously small executable, but a nuisance to get a hold
    of. As far as I know, there is no port to Windows yet. If you're in
    Linux, open the Package Manager, and some recent distros have added
    it as a package. You might have to tick "universe" or "multiverse"
    or the like, and reload the package list (takes a minute or two
    to download), before the fool thing shows up in the list of packages.
    You end up downloading megabytes of package manager cruft, just so
    you can get a hold of a KB-sized executable. Doing it through
    package manage, means not having to compile it.

    http://disktype.sourceforge.net/

    In Linux, you'd try something like

    sudo disktype /dev/sdb2

    to discover the file system type of the second partition of disk sdb.
    The program apparently checks several criteria, and if not all
    criteria are met, it may say "NTFS based on 3 out of 5 criteria"
    or the like. So when the partition is damaged, it may report
    less than 5 out of 5 or whatever.

    OK, so now what can we do.

    If disktype can't see anything, or if you really don't want to bother
    using disktype, the next tool is TestDisk. It scans a disk for
    partitions, and creates a new primary partition table based on
    the results. Earlier, you used PTEDIT32 to capture a picture
    of the current MBR. TestDisk will try to make a new one, but
    won't write it unless you tell it to. Pressing "control-C" at
    any time, should cause the program to exit without damaging
    anything. TestDisk is available for Linux and Windows, and
    is even included on some distros of Linux.

    http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    Now, if the MBR was damaged, then programs like disktype will
    be sent to the wrong starting address on the disk. To use
    TestDisk, you the operator have to look at the computed
    result, and see whether it makes sense or not.

    To give an example, I had a disk with four partitions. Using
    Disk Management, I deleted the last partition. Now, there were
    three partitions, verified in PTEDIT32. I ran TestDisk, and
    after scanning for ten minutes, it found all four partitions.
    Now, I as the operator, know the fourth partition is not valid,
    and would be considered a "phantom". So TestDisk is doing
    "too good a job" in this case. But occasionally, TestDisk
    computes a new result, you apply it, and magically your
    partition is there again. You would compare the numeric
    values of the original MBR, versus the new values, to try
    and determine whether something has changed and how it
    changed.

    I hardly ever write out the new MBR to the disk, when using
    TestDisk, so it is mainly a forensic tool for me. If I seriously
    thought using the new MBR was the right answer, I'd back up the
    MBR first, and if I was wrong, I could put the MBR back later.
    Something like this, will save the 512 byte MBR in a file for you.

    sudo dd if=/dev/sdb of=mybackup_mbr bs=512 count=1

    Well, now I don't know what to do next. If disktype reports
    a strong showing, I'd probably want to run CHKDSK, but the
    problem is, how to tell CHKDSK where to look. CHKDSK has
    two ways to point to disks. I can use a drive letter, like this

    chkdsk e:

    or it can use a mount point. But right now, the partition won't
    mount, so how the hell do we get it to repair the partition ?

    http://technet.microsoft.com/en-us/library/bb457122.aspx

    chkdsk \\?\Volume{2d9bd2a8-5df8-11d2-bdaa-000000000000}

    You can determine a symbolic link name for a volume by
    using the mountvol command.

    I didn't find that to be particular easy to deal with, and if
    it isn't mounted, then I don't see how we can get that
    fancy GUID value. The GUID option is useful, if you forgot
    to assign a drive letter to the partition.

    So that means using some data recovery tool, like some of the
    file scroungers

    http://www.cgsecurity.org/wiki/PhotoRec

    or that one I mentioned in my other post.

    I don't know of a tool that can attack the damaged
    partition, and fix it up enough so it'll mount. I
    expect there are commercial tools to do that, but I
    don't own any of them. If I was in your situation,
    I'd probably have to use a file scrounger.

    Paul
    Paul, May 19, 2011
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Nate
    Replies:
    1
    Views:
    1,094
    Ed Mullen
    Feb 21, 2004
  2. Anthropy
    Replies:
    4
    Views:
    981
    Anthropy
    Feb 24, 2004
  3. Replies:
    0
    Views:
    1,234
  4. Spin
    Replies:
    7
    Views:
    730
    Bill in Co.
    Apr 9, 2008
  5. Spin
    Replies:
    10
    Views:
    2,791
    Bill in Co.
    Apr 9, 2008
Loading...

Share This Page