HACKER Q&A
📣 ofalkaed

Hard Drive Recovery


I just came across an old HD that I am curious to play with data recovery on. Years ago I thought it had corrupted or died and ran standard linux repair utilities on it, but it turned out that the USB cable I was using was likely the actual culprit and I fixed the drive with the faulty cable which screwed up the drive that was not actually faulty (I think). I did some searches for HD recovery but I just keep getting the generic help of run fsck and if that does not work hire it out, which is not very useful, I am not concerned about the data just want to play with trying to recover some or all of it, I don't even remember much of what is on the drive. So looking for any good resources on the topic.

From what I remember, it is an XFS filesystem, when it supposedly failed I attempted to repair it with xfs.fsck which made things worse and I strongly suspect it was actually the cable at fault which I did confirm was bad. Hindsight is great like that.

I also would be interested in ways to confirm the drives health, confirm that it was the cable that caused the issue, the drive was just a backup drive and had very low read/writes and I would not be bothered by giving up on recovering it and just formatting and bringing it back into use for backup.

  👤 viraptor Accepted Answer ✓
Assuming that the drive is actually working now and you don't worry too much about losing the data: step 0 - Make a copy of the drive at block level. Do not mount it, do not try to fsck. Basically copy /dev/that-drive to some file, then work on a copy of that instead of the original.

Also check what SMART attributes on the drive say - it will help confirm that the drive isn't broken in other ways.

I don't know of a good resource documenting what to follow from there, but make sure you don't touch the original in any way so you can always go back.

Otherwise, look at bits separately - those are documented in various blogs - how to analyse the partitions, how to recover the filesystem, how to find binary files without the filesystem structure. Projects for reverse engineering like binwalk may also be useful here.

👤 k310
You might look into one of these: TestDisk and other applications described here: https://www.digitalocean.com/community/tutorials/top-best-li...

And there are (CD or USB stick) bootable distros for recovering disks in bricked computers or just copying the data off the main HD to make a recovery disk. https://www.techradar.com/best/best-linux-repair-and-rescue-...

I recall using TestDisk above and SystemRescueCD.

👤 night-rider
https://www.cgsecurity.org/wiki/TestDisk_Download

https://www.cgsecurity.org/wiki/PhotoRec

👤 garyfirestorm
Look into bootable partition recovery OS like gparted