created: February 24, 2008

Imaging a corrupt hard drive

These steps describe my own journey... you will need to adapt it for your set of circumstances. Standard disclaimer applies, as always: You are 100% responsible for your own actions. Using this guide, visiting a link, downloading a program, in short, living, is done entirely at your own risk (and joy).

1. Failing 2.5" hard drive, NTFS / Windows XP
2. Generic PC with a large internal hard drive formatted as ext3
3. USB IDE adapter

1. Knoppix 5.1.1 disc
2. dd_rhelp (which uses dd_rescue)

1. Boot computer from Knoppix 5.1.1 disc
2. Download and extract dd_rhelp to Knoppix Desktop
3. Connect failing drive to USB IDE adapter and plug in
4. Failing drive appears on Desktop as sda1 (do not mount!)
5. Mount hda3 (an ext3 partition on PC's internal hard drive with plenty of space) by clicking its Desktop icon and changing read/write mode from the context menu.
6. cd to dd_rhelp directory and run:
   dd_rhelp /dev/sda1 /media/hda3/recovered.img
7. Run mount to list mounted devices - since /mnt/hda4 is not in use, I'll mkdir /mnt/hda4 and mount the image there as a loop device:
   mount -t ntfs-3g -ro loop /media/hda3/recovered.img /mnt/hda4 -f
8. cd /mnt/hda4 and check out your files!

1. All commands issued from root prompt.
2. Had the failing drive been formatted FAT32, step 7 might have been: mount -o loop /media/hda3/recovered.img /mnt/hda4
3. I used dd_rhelp (as recommended by the author of Knoppix Hacks) and it did a wonderful job. However, in dd_rhelp's readme, the author states that GNU ddrescue is superior to his own tool, so you may want to try that instead.
4. dd_rhelp 0.1.2 requires dd_rescue 1.03 or higher. Fortunately, Knoppix 5.1.1 includes dd_rescue 1.11. Also, note that since version 0.1.0, dd_rhelp no longer requires compiling - just extract and run!
5. In my testing, I managed to use up all 8 loop devices, and began receiving a "could not find any free loop device" error. Rebooting would have solved the problem of course, but a little Googling turned up the losetup command. List all loop devices with losetup -a and delete loops with losetup -d /dev/loop#.