How to recover a damaged partition?

[eclecticist]

Background
I have been working to recover my wife's hard drive for coming on 3 months now, and I have not had any success, so I figure it's time to reach out to others.

The drive had Windows 7 installed and was where she backed up her files. It's a 320 GB internal drive that I put in a USB case so that we could use it as an external drive. One day she deleted the files from the source, so that the backup files were then the only copy, and then out of the blue the drive couldn't be accessed through Windows anymore. A drive letter would show up, but trying to access it prompted to format the drive. We didn't format the drive, and now we've learned a very valuable lesson about backing up files

What I've tried
In all seriousness, the files are very important. The disk wasn't making any strange clicking or whirring sounds, or any other abnormal onomatopoeias, so I started with EaseUS. EaseUS could not recognize the drive, so I moved on to Recuva. Quick search took less than a day. Deep search went for 3 weeks and was around the 20% mark before I stopped it. It "recovered" many files, but they were 95% DLLs that I didn't recognize (presumably from the Windows OS, or possibly garbage).

Disappointed with the results from Recuva, I tried TestDisk. I should have recorded the exact results, but TestDisk didn't recover any files. Then I tried PhotoRec, and it recovered over 3 million files, mostly DLLs, and only 8 files were recognized by me and my wife as originally being on the drive.

In the spirit of disclosing everything I know / have tried with the drive: when I plug it in to my Windows 7 PC via USB, it shows two partitions. It used to show only one when it worked properly. The first one is around 100 MB and can be accessed, and it has to be the Windows recovery partition. It would have been hidden when the drive was working properly, so I'm not worried that I see it now. The main partition, however, has no "XXX GB out of YYY GB free" text underneath it in my computer and no blue bar indicating free space. It also does not have the name it used to have. The recovery partition shows up within a minute of plugging in the drive, but the main partition takes several minutes to show up.

Related to the above paragraph, I've opened Disk Management to glean information about the drive. It takes > 15 minutes but < 2 hours for Disk Management to move past a blank screen that says "Connecting to Virtual Disk Service..." When it does finally load, it shows the bad partition as healthy and with 100% free space but with a RAW file system. It used to be NTFS and I have no idea when that changed.

A friend at work gave me two things to try: take the disk out of the USB case and put it in my laptop's extra bay, then boot the PC, and if that doesn't work, try viewing the contents of the disk in Linux.

I put the disk in my PC and booted it. Instead of booting the OS, Windows ran chkdsk on the drive. There were ~300,000 sectors, and it got to sector 45,000 on day one. Then, every single sector scanned thereafter was an unreadable bad sector. I let chkdsk continue to scan at a rate of about 1,000 bad sectors a day until it reached 80,000. It said it was at 2%. The disk still wasn't making any strange sounds, but I didn't think it should be taking nearly as long as it was, so I stopped chkdsk and moved on to try Linux.

Where I am now
I installed Precise Puppy 5.7.1 and VirtualBox on a USB flash drive using Linux Live and fumbled my way around (first time on Linux) until I got the bad drive mounted. It took several minutes for the OS to scan each item in the root of the drive and determine if it deserved a folder icon or a warning triangle. It's about 50/50. But, the items which were deemed readable (the folders) are either empty or contain only items with the warning triangle. So, I still can't see any of my files. Clicking on one of the what-should-be-folders-but-are-warning-triangles throws an error popup: "File doesn't exist, or I can't access it".

I'm still holding on to hope, especially now that I see all the folders at the root that I was expecting, but I need help accessing the files, making sure they're readable and getting them copied off to a good drive.

What information did I leave out that you need? Where should I start?

[Burn_IT]

TESTDISK is designed for this sort of thing, BUT:::


You must do any recovery with the disk directly connected in its native method if at all possible - tthat probably means SATA or IDE and not via USB

It will work via USB but that involves other interfaces that may confuse the matter and cause failure.

Any recovered date must be to a seperate disk - again for safety reasons and because of the possibilty of cross connected files.

[TeX Dog]

You are in SpinRite territory, next is recovery $$$$ companies or a NSA/FBI buddy or its darkweb blackknights

https://en.wikipedia.org/wiki/SpinRite

https://www.grc.com/sr/spinrite.htm

Had to run spinright with a harddrive in a freezer! but it recovered the low level stuff enough to get a working re-image (harddrive was past the point yours was )

[eclecticist]

Thank you guys. Any further discussion or is this pretty much a lost cause?

[TyroBGinner]

Try recovering from the source drive - perhaps it has not been manipulated too much in the intervening three months.

[eclecticist]

What do you mean, precisely, by "Try recovering from the source drive..."? Isn't that what you would call what I've been doing?

[TyroBGinner]

You said that your wife deleted the files from the source, and then it was subsequently shown that the backup had failed. Your description makes it sound like there were two storage devices. Is that the case? If so, I was referring to the storage that you referred to as "source".

[peterw]

Hi

I am puzzled. Looking at your screen shot it shows:

sda1 this is the usb stick with Puppy installed?

sdd1 and sdd2 which is the 320GB hard drive that is failing? And is it in a usb enclosure or is it mounted in the PC as a SATA drive?

sdc1 which is a Seagate 1 TB back up storage device where you think you are going to store any files you can get of a failing hard drive

And then we have /mnt/sdb2 Thumbs which has the Windows files you want AND that does not appear in pmount.

Then there is mention of the source drive that is still working somewhere from on which your wife deleted the items you want AND which may still be recoverable as TyroBGinner says.

Can you clarify what is what and how come /mnt/sdb2 is not showing in pmount. You may have some files to save if you mount the drive.

I to have had limited success by putting the hard drive in a freezer in a plastic bag. It is also worth doing a little bit of a physical check of the hard drive before giving up.

[eclecticist]

@TyroBGinner: Ahh, sorry for my misunderstanding of "source". Yes, she moved the files from the source drive to a destination drive and then deleted from the source. I had not thought to run any utilities on the source drive--I'll try that. But unfortunately the source drive is nearly full with new files now, so I'm betting that the deleted files truly are overwritten by now.

@peterw: Drives are as follows:
- sda1: USB stick with Puppy
- sdd1/2: failing 320 GB drive (in USB enclosure)
- sdc1: the drive to move any recovered files to

I don't know why /mnt/sdb2 does not appear in pmount... Honestly, I assumed I was looking at sdd2 when the window with all of my folders appeared, since all my missing files would be on the larger partition of the 320 GB drive.

I'm confused why sdb2 didn't show up as a mountable drive, but I was still able to navigate to the drive and view the folders. Maybe that's my lack of understanding of how mounting works in Linux. Any idea why " (thumbs)" is suffixed to the drive name?

[peterw]

Hi eclecticist

What you have with the various drives is puzzling. I can't explain it either. In a terminal "blkid" displays lots of information about the PC drives.

If ever you unintentionally delete files the best strategy is to switch the PC off. Do not use the disk again until you have the tools ready to recover the data. Check which distro has photorec and testdisk capability.and make a bootable usb with it on.
https://en.wikipedia.org/wiki/PhotoRec
Reboot the PC and attempt the rescue storing any captured data onto a separate drive.

If you have a failing drive attempt to get important files from it. Then switch it off and power it up using Puppy on a usb stick.. Use Puppy Pudd to copy the partition or drive to another as a backup - can take ages. This can be worked on to try and recover important data in the same way as above.

If the hard drive is not making distressing sounds the cause of failure may be the electronic board and not the spinning disk and arm. I might be tempted to remove it and heat it up to reflow the solder. It is a bit of an art doing this. I have often had success with other components doing this.

Anyhow, the moral of the story is to maintain backups. The cloud is a good place for very important pics.