How to clone a NTFS partition (WinXP) from a damaged disk to a new one?

Question

I need to clone a NTFS partition from a damaged, near to die hard disk (SCSI, if this matters) to a new one (SATA).

I've installed the last version of Hiren's Boot CD utilities on a USB stick, and tried with GParted, which told me that it can't copy/paste the partition because it's damaged and "flagged" by windows to run CHKDSK. I followed the Warning advice and tried to repair it using CHKDSK /f (it took 9 hours and exited with an error after "phase 3") and a Linux program I can't recall right now, without success.

I tried to clone using Clonezilla, and it failed as well, for the same reasons. In the HBCD there's dd_rescue, but it failed again because it can't find "ntfs.something".

In the end, all that I want is to clone that partition as it is, with his errors and everything. I can repair it on the new drive.

So, what should I do?

Solution 1

You can of course try to repair the NTFS partition on the original drive, but I cannot recommend to do so, as the problems might be caused by hardware failure and repairing could make things worst.

Make a block for block copy with ddrescue to a file first. If there are any block that cannot be copied ddrescue will continue with the rest of the disc.

If ddrescue doesn't find any bad blocks then you can try to use repair software on the file (mounted via loopback). If there are problems with the SCSI drive or you just want to be sure to be able to start over from scratch, make a copy of your file and try to repair the NTFS filesystem on the second copy. As copying a disk with errors can be time consuming process, you might have to interrupt the process (because you need the computer, to let the drive cool down, or to restart the firmware of the drive).

That is why in my experience ddrescue is far superior in problematic cases than is dd with conv=noerror. ddrescue keeps a log about what it has done and restarts based on that information, a feature unavailable to dd. ddrescue is also smarter in reading blocks starting from the end, if it encounters a problem area. It will arrive much quicker at an image copy state that you can use as the basis for a filesystem check (and you can continue to ddrescue the original copy). You can only do something like that with dd if you are willing to spent a lot of time calculating offsets by hand.

You can also copy the file to a NTFS partition of the right size, put the drive in a windows machine and use the native repair tools from there.

Solution 2

Had the same problem: Disk that is about to die,
with NTFS partition that I wanted to rescue first and fix after
(before the disk is totally gone).

Was able to resolve it with ntfsclone:

1. Connect the two disks - old and new
2. Boot with Live-Linux from USB
   (can use Parted Magic for that as well)
3. Create a big-enough partition on the new disk
   (use gparted for that)
4. Note the name of the partitions, as they are named in gparted
   (/dev/sdaX, /dev/sdbX)
5. Open a terminal window and run the following command:
   ntfsclone --force --ignore-fs-check --rescue --overwrite NEW-part OLD-part
   (replace NEW-part and OLD-part with the names from step '4.' - /dev/sd...)
   ntfsclone will complain about you overlooking the inconsistencies
   but should continue with the copy of the partition

-- when done --

6. Turn-off the PC
7. Disconnect the faulty disk
   (you want to use it as little as possible, now)
8. Boot the PC again - either to Windows or Linux,
   and try to fix the partition on the new disk

EDIT:

-- NOTE --
Faulty (unstable) power-supply can cause disk-controllers to go crazy,
and are much more likely to fail than disks, so it is best to check this as well.
You may experience a behavior that everything works fine for a few minutes
(or seconds) and then the systems starts going crazy, as soon as it warms-up, literally.

(fixing the power supply will not restore the lost data, of course, but prevent you from losing more of it)

Solution 3

I would attempt to repair the disk with either HDAT (freeware) or possibly Spinrite (Commercial). I've used both of these tools to recover disks that were failing and they have both worked well in the past.

Until the drive is in a usable state I don't anticipate you getting too far in your recovery efforts. Once the disk has been cleared I'd use Clonezilla to replicate it as quickly as you can to an alternate HDD.

Comments

[Admin]

What was the error message returned by CHKDSK /f after "phase 3"?

[landroni]

Very useful! Could you add an exact command-line example of ddrescue in action, similar to the dd example in the other answer?

[Anthon]

@landroni I could (basically ddrescue /dev/sdX driveimage logfile) but you really should spent the effort on reading ddrescue documentation. If your system is broken, there are a lot of reasons to read the manual before potentially making things worse.

[landroni]

I am now looking at the man page, but some of the options are cryptic. What would be the most conservative ddrescue equivalent of dd if=/dev/olddisk of=/dev/newdisk bs=4k conv=noerror,sync? Keeping in mind that it would be run on a damaged (and dying) disk, and that "trying hard to rescue data in case of read errors" isn't really an option. Thanks!

[Anthon]

@landroni with the options given in my previous comment each sector in a block is only tried once. The only way I know of that you can improve on that is if you know which areas are OK for sure and use -i and -s to recover those.

[landroni]

Well, last time I tried ddrescue /dev/sr0 driveimage.iso (on a scratched CD), the programme tried to read again a lot of bad sectors, a lot of times. I may be wrong, but I would be skittish about running ddrescue with no other limiting options on a dying disk.

[Anthon]

the default argument for -r is 0, did the software tell you it was retrying? Because I think you are mixing things up with the retry the drive hardware itself does when it notices a failed read, that is not ddrescue

[landroni]

Quite possible I'm mixing things up, indeed. Well, I don't quite remember, but it seems to me that it spent ~15% of the time reading the non-scratched sectors of the DVD, and ~85% of the time the scratched sectors. Originally the status was indicating ~200MB read errors, and in the end that was reduced to ~8MB. I assumed that ddrescue was retrying unread sectors. Is the -n option perhaps relevant here? And does ddrescue by default emulate the conv=sync in dd (see comments for other answer)?

[landroni]

I am now reading the gddrescue docs, and it is indeed superior to dd when it comes to trying to rescue as many sectors as possible. As to the "default argument for -r is 0", this is true, but it looks like it means something different: "Each sector is tried at most two times; the first in this [copying] step as part of a large block read, the second in one of the steps below as a single sector read." I think -r governs the number of retries in addition to the one-time retry of a bad sector that happens by default.