[mdlug] Some odd experience recovering NTFS drive

[Aaron Kulkis]

David McMillan wrote:
> 	My little sister has a laptop running XP Home (I know, I know, but she 
> *had* to have it for software her classes required), and the hard drive 
> started making odd noises (rattling noise, like the heads never stopped 
> seeking) a while back, accompanied by BSODs and eventually "No Boot OS 
> found" from the BIOS.
> 
> 	So, figure, no problem, I'll just boot it from a LiveCD, run some 
> utils, clone the drive to a new drive I picked up, done.
> 
> 	Except... Ubuntu couldn't even see that the drive existed.  Uh oh.
> 
> 	Step 2:  remove drive, place in external USB enclosure, plug into my 
> regular Linux desktop.  Parted says that /dev/sdc has one NTFS partition 
> on it taking up the full drive, but mount says that /dev/sdc1 doesn't 
> exist.  Huh?
> 
> 	Step 3:  Run testdisk on it.  Testdisk says the drive is fine, the MBR 
> is fine, the backup MBR is fine, and rebuilding the MBR creates an MBR 
> identical to what's already there.  But I still can't mount the 
> partition and get anything off of it.  WTF?
> 
> 	Step 4:  make sure all my NTFS utils are up to date.  They are.  Heck.
> 	Step 5:  consider buying a goat and some black candles.
> 
> 	Step 6:  decide to try dd instead, copy the drive entire to an image. 
> dd stalls at around 20% of the drive -- doesn't fail, just... stops 
> progressing.
> 
> 	Step 7:  use ddrescue.  This is where things get REALLY odd.  At this 
> point, despite the fact that the drive is making noises like a pinball 
> machine rolling down a hill, ddrescue is still chuntering along.  After 
> 72hrs, it's retrieved about 14GB out of the 40GB drive, and is still 
> chewing away.  There's only been about 4kb worth of errors (let's hear 
> it for -v).
> 
> 	So... anyone ever see anything like this before?  In my past 
> experience, a drive this noisy just dies and can't be recovered.  Short 
> of that, I've never been unable to at least recover whatever's on the 
> good sectors with dd and/or testdisk.  And I've never seen dd or 
> ddrescue behave this way before.  The symptoms just don't add up into a 
> pattern that makes any sense to me.

NOISES from a hard drive = mechanical breakdown.

Mechanical breakdown = head/disk misalignment and/or head/disk contact,
BOTH of which are contrary to data recovery.

When drives start to make noise...you replace them IMMEDIATELY,
because the noise is either the bearings wearing out (which
means extra play in the disk position relative to the read/write
head) or even the disk-heads contacting the platters (which
means data media being scraped off.


How much is the data worth?  The cheapest way to recover the
raw data at this point is to get the platters removed, and put
into a new disk drive assembly -- this is not cheap, as it
must be done in an electronics industry-standard clean room,
or else even a particle of cigarette smoke can cram in
between.