Join Us!

ddrescue stuck on &...
 
Notifications
Clear all

ddrescue stuck on "splitting error areas"  

  RSS
taurean25
(@taurean25)
Member

All,

We have encountered a drive that has gone on the fritz in house. Our manager mentioned that there is no funds to send the drive to a data recovery specialist, so we decided to give ddrescue a shot to see if data could be acquired from the drive. The procedure was started last Friday and ran over the entire weekend. When I arrive in the office Monday morning, ddrescue was stuck on "splitting error areas", it has likely been like this all weekend possibly.

ddrescue reports it has saved 249566MB of data from the 250gig drive;however, it seems that its stuck on the "splitting error areas" procedure

has anyone seen this behavior before when using this program? I searched via Google and so far no luck on finding any information on this.

Quote
Posted : 24/09/2012 10:30 pm
mjantal
(@mjantal)
Junior Member

Take a look at the man page at http//ss64.com/bash/ddrescue.html, you can use the -n (no-split) switch

ReplyQuote
Posted : 24/09/2012 10:44 pm
taurean25
(@taurean25)
Member

Yes I saw this command as well however I an afraid to stop ddrescue to run it. I am unsure if I stop the current ddrescue process it may cause the recovered data to be corrupt.

ReplyQuote
Posted : 24/09/2012 10:55 pm
mjantal
(@mjantal)
Junior Member

Yes I saw this command as well however I an afraid to stop ddrescue to run it. I am unsure if I stop the current ddrescue process it may cause the recovered data to be corrupt.

have you checked the output file? Sounds like you have most (if not all) of the data. Even if its not ALL there, you should be able to re-start the process and use the -n switch.

ReplyQuote
Posted : 25/09/2012 12:11 am
taurean25
(@taurean25)
Member

I stopped the process, and connected the restored drive to a windows 7 system. When I connected the drive I received the Windows message, "please format the the drive" I tried running chkdsk /r e (E is the recovered drive).

chkdsk seemed to run through the drive and see files in the process of repair;however, when it completed, Windows still saw the drive as having a RAW file system when it should be NTFS.

ReplyQuote
Posted : 25/09/2012 1:22 am
jaclaz
(@jaclaz)
Community Legend

I stopped the process, and connected the restored drive to a windows 7 system. When I connected the drive I received the Windows message, "please format the the drive" I tried running chkdsk /r e (E is the recovered drive).

chkdsk seemed to run through the drive and see files in the process of repair;however, when it completed, Windows still saw the drive as having a RAW file system when it should be NTFS.

Well, you cannot expect to run chkdsk and go (unless you are very, very lucky).
And in any case NEVER run chkdsk /r on first attempt (unless you really know what you are doing).

Since you have the "please format drive" i means that either the MBR or the filesystem (or at least the PBR) have something wrong.
You should run TESTDISK (or check/fix manually thhroigh a disk editor) the "base" of the filesystem before even thinking of running chkdsk on it.
http//www.cgsecurity.org/wiki/TestDisk
Also DMDE is a very handy tool.
http//softdm.com/

But the "restored" drive is likely to have been "damaged" by the chkdsk attempt, and you will need to restart fromthe dd image.

If you need help, just say so.

jaclaz

ReplyQuote
Posted : 25/09/2012 1:53 am
taurean25
(@taurean25)
Member

Thanks jaclaz I was able to see the file system on the restored drive using dmde.
The only issue now is that the free edition of dmde only recovers one file at a time.

Thanks a bunch for all the help

ReplyQuote
Posted : 25/09/2012 2:33 am
jaclaz
(@jaclaz)
Community Legend

Thanks jaclaz I was able to see the file system on the restored drive using dmde.
The only issue now is that the free edition of dmde only recovers one file at a time.

Thanks a bunch for all the help

Well, I find it fair enough, it allows experimenting with the "real" thing (and all functions are working) with the only limit of recovering a file at the time.
But if you can see "plainly" the filesystem with dmde it should mean that all that is needed is to fix the PBR BPB.
This must most probably be done "manually" as the backup bootsector (provided that the disk had only one "big" NTFS partition) is likely to be in the "end" sectors that ddrescue failed to recover.

What you can do is to

  • get a new disk (or create a suitable sparse file image and mount it using VDK or VSS or similar, like Total Mounter (NOT Imdisk)
  • copy to it the MBR of the recovered disk (it should be ok, but check it)
  • format the volume (under the same OS the "failed" volume was)
  • copy from the newly formatted volume the PBR and replace the PBR on the recovered disk

This should be enough to have the right data pointing to the $MFT (that should be OK).
TESTDISK should also be able to do the above (fix pointers to $MFT, but I prefere to do it manually.
A suitable (freeware) tool is Tiny Hexer, but most probably you already have X-Ways Winhex.

jaclaz

ReplyQuote
Posted : 25/09/2012 4:15 pm
taurean25
(@taurean25)
Member

Thanks man I will give it a try next time the issue comes up.

ReplyQuote
Posted : 25/09/2012 5:23 pm
Share: