13/05/2008

Yet another crashed FAT hard drive

Last week my portable brain extension crashed (2.5'' 80GB FAT32 USB drive): Windows didn't recognise it at all (no surprises here), Linux mounted it, but stalled at loading the directory table.
Definitely a case for Dr. daWuzzzz's Crashed Disk First Aid Kit: one Linux desktop with a free ATA plug (unplug a CD drive if necessary), one ATA 2.5''/3.5'' adapter (like this one), one bloody big backup drive (not FAT32 because of file size limit).
Try mounting
Most portable drives can be easily extracted from their cases with a screwdriver. Connect the IDE and power plugs via the adapter to your drive. Remember to keep everything grounded! Boot up.
If you are not sure about the proper device node try
# ls -l /dev/disk/by-id
ata-SAMSUNG_MP0804H_S042J10LB08407 -> ../../sdc
ata-SAMSUNG_MP0804H_S042J10LB08407-part1 -> ../../sdc1
ata-SAMSUNG_MP0804H_S042J10LB08407-part5 -> ../../sdc5

So, the first logical partition is /dev/sdc5.
# mkdir <mountdirectory> e.g./media/backup
# mount /dev/sdc5 <mountdirectory>
If the filesystem is intact, it should be autodetected. Otherwise, try mount -t. In my case, I had now access to the whole directory structure.
Back up what's left
Dump a disk image on your backup drive (quick check free disk space with df -k).
As dd (see daWuzzzz's post) will stop copying at the first error it encounters, dd_rescue is your friend (search for "ddrescue" in YaST btw). Even more friendly is dd_rhelp (included in ddrescue, tip from the O'Reilly SysAdmin blog), which looks for healthy block sections and tries to read the damaged ones at the end of the run. It also logs the dd_rescue output, listing damaged blocks.
# dd_rhelp /dev/sdc5 /<backupdrive>/<imagename>.iso
Using the -B (hard block size, see the shell output of simple ddrescue for explanation) and -b (soft block size) options with dd_rhelp is supposed to speed this up a bit. -b makes use of the available hard disk cache, with newer drives its commonly 8M maximum (better check yours).
It still took my computer ca. 20 hours to back up my drive, so be patient. As the dump simply copies 0's and 1's, the image size is the drive size, regardless of free space.
Create a mountpoint (e.g. # mkdir /media/backup
and mount your image (read-only).
# mount -t vfat <yourimage> /media/Backup -o ro,loop
In cases of mild drive damage one can also try direct copying (even in Konqueror). However, the copy command tends to hang up, and you have to reboot (or umount -l?) quite a lot. In case of serious damage, try testdisk.
Check and repair the file system
Warning: from here you'd better have the dumped image available, possible data loss!
Unmount first. fsck ist the standard Linux disk check utility, for DOS file systems like FAT dosfsck applies (symlinked by fsck.vfat, for more file systems see end of man fsck).
# dosfsck -ar /dev/hdc5
Repairs your file system automatically, asks when in doubt. No optional arguments: check without repairing.
In my case dosfsck put out the message: "There are differences between boot sector and its backup." and listed the differences, e.g. "(offset:original/backup) 71:20/00, 72:20/00...". Writing backup to original and vice versa didn't help. All problems below offset 1BE (=446 hex, executable boot code, see here), so dumping zeros on top of it shouldn't hurt (don't intend to boot from this drive).
# dd if=/dev/null of=/dev/hda bs=446 count=1
In the next fsck run, I copied this MBR to the backup. Still I/O errors, so I decided to live with a few lost files (at least I knew which), re-formatted the drive and copied everything back from the mounted image. Dumping the image back is also possible (cf. daWuzzzz) but I wanted get rid of the corrupted files. Copying is also faster in this case.
Disk health
Format and reuse the drive or buy a new one? smartctl might give you a hint there (cf. daWuzzzz)
My drive (which is definitely f***d up) always passed the health test, so one had better rely on smartctl -a
The same procedure should of course also work with a crashed system partition and any Linux live CD containing ddrescue (e.g. Knoppix).
A great site for data restoration is also CGSecurity. Their TestDisk app reads out data even when the file system is corrupted.

No comments: