How to get data from “dead” hard disk drive?

8,085

Solution 1

How dead is dead?

Is it a ex-hard drive or is its file system merely pining for the fjords? Is your drive only in its case cause its been held in place by screws? (Excellent!)

Lets start with the basics. That's a 3.5 inch external drive. That makes life a little easier. Very often external drive electronics fail, but the drive itself may be fine. A quick internet search suggests its an older IDE drive. Slightly less positive since you'll need to dig up an IDE cable and power supply. If its sata its easier.

So, you'd want to start by shucking the drive from its case. Examine it, get the appropriate torx and security bits, and crack the drive enclosure open. Unplug and examine the drive connectors.

Identify what sort of ports it uses, make sure you can connect power and data and set it aside to start preparing your tools.

While most professional forensics tools seem to be windows based, there's an excellent selection of them on linux. Start by preparing a xubuntu liveusb. You can find the OS here, and something like unetbootin to create the liveusb. You'll also want a hdd with at least 2x the space of the drive you're trying to recover, either USB based or internal to the PC you're using. You could use an existing install of linux, but I tend to feel happier having an environment that's clean, and has only what I need on it.

I did mention you cables and power right? You want to mount this disk internally into a PC and connect it directly. That allows you to rule out that its the controller at fault.

At this point I'll mention at various steps where the prudent thing is to give up. I've had far too many people attempt to revive a properly dead hard disk.

If the drive's detected, from what I saw in the the updated question, looks like you'd have luck simply plugging it in, seeing if the drive works and copying from there.

Test your liveusb to make sure you can boot off of it. Shutdown, install your shucked hdd, and boot up. Go into the bios. If the drive isn't detected on the bios stop there. Its a waste of time, and you should enjoy your new door stop.

If its detected, boot into xubuntu.

Check to see that the second drive you're saving stuff to is mounted, and if the first drive is mounted, you can copy data off. If you can, grab what you can.

Open up a terminal and run 'apt-get install testdisk gddrescue'

Identify the disk (this is tricky - I'd use a combination of lsblk to list block devices, and compare it with fstab).

run gddrescue with the invocation sudo ddrescue -r 3 /dev/sdX /media/usbdrive/image /media/usbdrive/logfile where sdX is the 'root' device for that drive (so if your drive is sdx and has sdx1 sdx2 and so on... you want sdx).

If this works you have an image of your drive. Make a copy never ever work on the only copy

You can then run forensics tools on the drive. I typically end up only going as far as the very excellent testdisk - which fixes partitions. It'll run directly on an image and I'd suggest the excellent step by step guide

At this point, if you have a mountable disk image, and there's something there, I'd start working my way through ubuntu's excellent recovery guide. scapel is useful if you want specific files, and autopsy/sluthkit seems like an excellent way to work on the images. However, if you want to mount a multi-partition image, go with kpartex over using the offset.

Solution 2

I've had good results using EaseUS Disk Copy (free), even when the disk was not recognised by Windows or Linux (it made Windows crash).

It makes a sector-by-sector copy, so you will probably get a few corrupted files where the disk is damaged.

Don't connect the disk until you use this software. The longer it runs, the more likely it will completely fail.

8,085

Radek

Updated on September 18, 2022

Comments

Radek almost 2 years
I went through few questions (see the list below) but haven’t found the answer to my question...
The question is what software can I use to analyze to find out if I can get any data from my Seagate ST300003U2 External USB hard disk drive.

It was lying in a drawer for few months unused and few weeks later I wanted to access my backed up pictures there and Windows now will not recognize it properly after plugging it in and Ubuntu will not detect it at all.

I went to the professionals and they quickly tried by connecting to a Win machine and told me that if I left the drive with them there they “might” recover something. I asked how they would do it and the I was told that they got some tool to run it against. I want to try them by myself if there is any free version. Of course they did not tell me name of the tools.

Any idea what free/opensource software on Windows or Linux or self bootable solution I can use to analyze such a hard disk drive?

UPDATE

I get this message on Win7. So there is no issue with cables or so in my eyes. I wonder why Ubuntu gives me no message.

I got this from Device Manager: Windows has stopped this device because it has reported problems. (Code 43)
Giacomo1968 over 8 years

The only issue I see here is there is no sign the drive itself can even mount from what the original poster describes. So if it can’t even mount, it could simply be a physical issue with the USB enclosure at best or—sadly—the drive itself is 100% dead.
Radek over 8 years

EaseUS TODO Backup did not see the disk either.
Naidim over 8 years

@JakeGould Well it has worked for me on disks that are not recognised by Windows or Linux. It's a boot disc, probably based on Linux.
Radek over 8 years

oh, I tried the windows version. I'll try the other one too.
Naidim over 8 years

@Radek It's a boot disc. Use the link I gave you.
Ecnerwal over 8 years

Uh, careful with "appropriate torx and security bits, and crack the drive open." You want the drive out of its USB case, but someone could misread this as open up the drive itself and see the shiny platters (at which point, unless you happen to be in a clean room, your odds of recovery plummet.) I usually open up dead ones to get the magnets - I need special bits for that, but hardly ever to just get the mechanism out of an external case.
Thalys over 8 years

Ugh, you are entirely correct and I should have worded it better. Fixed.
Giacomo1968 over 8 years

Yeah, it’s fairly shocking how many people will assuming “opening up an external hard drive” equates to “open up the metal drive case itself.”
Radek over 8 years

well I did not think that way :-D
Giacomo1968 over 8 years

@paradroid The added info clears up the physical versus logical issue here. Clearly it's a logical issue so this advice is solid.
Thalys over 8 years

Latest edit seems promising. I'd just try mounting the drive internally from what I can see