Recover files from NTFS drive with bad sectors

Question

A few nights ago I have created a backup of my data on an external 500 GB NTFS USB hard drive. I have then formatted my computer, reinstalled Ubuntu and started transferring back the data from the external HDD.

Unfortunately some files have became corrupted and Ubuntu is unable to copy them over. The same issue happens if I login using Windows 7.

Disk Utility detects with SMART that there are "a few bad sectors".

Some of files are perfectly intact, but other files cannot be accessed (nor read, copied...) although they are displayed within nautilus and show the correct file size.

Is there anything I can do to recover this data? I have thought of using TestDisk but this utility seems more useful for repairing lost partitions or deleted files.

I have also thought of using ddrescue so I could at least have a low level copy of the disk but I am not sure what use to make of it in order to recover the data!!!

Solution 1

Problem solved! I know this is not related to Ubuntu but I think this could be useful for other people.

I have found out that Window's chkdsk could solve the problem, this is because Ubuntu doesn't support NTFS as well as Windows does. It has taken several hours/days to run the tasks (just Windows scandisk with all options activated) but in the end I have managed to recover 99.98% of the data.

Solution 2

If a drive has unreadable sectors one of the choices you have is to make an image of it with dd forcing it to ignore the damaged sectors and then mount that image to read the useful data.

Create a image of the drive

Use the command sudo fdisk -l to identify your USB disk, note his device path, it should look something like /dev/sd[*], where [*] is a letter representing your USB drive.

When you are sure about the path to the drive you want to copy you can use dd to make a image of it and use the options to keep on reading after failing to read data

dd if=/dev/hd[*] of=/foo_path/foo_image conv=noerror,sync

This will read the device /dev/sd[*], output it to /foo_path/foo_image and ignore read errors. /foo_path/foo_image should not be on the same disk you are reading.

So, lets say you used sudo fdisk -l and you found that your USB drive is /dev/sdb, you can then use any of those commands to make an image just by replacing /dev/hd[*] with /dev/sdb.

Mouting the image file to read the data

You need to create a mount point, lets call it /mnt/ddimage

sudo mkdir /mnt/ddimage

Now mount the image you just created to it

mount /foo_path/foo_image /mnt/ddimage -o loop

You should now be able to read any useful data from the cloned drive image.

Comments

[Martin]

Thank you very much, I would love to try that straight away but I have got another problem. The external damaged drive is 500GB and the maximum space I got on my PC is 500GB. What I will do now is to first resize the damaged drive partition because the data contained is "only" 100GB and then I should be able to create an image of this smaller partition. I will keep you posted with the events (hopefully good)

[Bruno Pereira]

That is going to be a problem, is the USB disk space divided in any way? Do you have any partitions on it, or just a big one?

[Martin]

it's a one entire partition, I could maybe try to resize the partition

[Bruno Pereira]

I am scared about any bad sectors messing up the resize :/

[Martin]

thanks Bruno, bought a 1TB hard drive to do the job. DD image process has started but I am getting loads of errors e.g. dd: reading `/dev/sdd1': Input/output error 682660416+318 records in 682660734+0 records out 349522295808 bytes (350 GB) copied, 12623.1 s, 27.7 MB/s I am curious to see what comes out once I will be able to mount the image file

[Bruno Pereira]

Let me know what the result is, anyways a dd image is the way to go on a damaged drive.

[Martin]

the first 350 GB have been processed really fast! however since that error came up it has processed 200-300 Kb in the last 2-3 hours :( Still 150 GB to go!

[Bruno Pereira]

Nice man. Lost data always sucks. Good job.

[marc-andre benoit]

you did the ntfschk c: /r i suppose ? yeah it takes forever but it is known to remap bad data clusters well..

[endolith]

You should use GNU ddrescue on a drive with bad sectors, not dd. It also has a --sparse option so that the output file is smaller than the input drive (since drives typically have chunks of all zeros)