Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a NTFS drive from a Windows 2008 server machine which has a few bad sectors.

I have the drive mounted in Linux.

When I do a list (ls) in /media/hda2/Users/Jason it dosnt give me a complete listing and gives me a Input/Output error. However even though the directory /media/hda2/Users/Jason/Desktop doesn’t show up in the listing I can still cd to it and retrieve my files.

Now I need data from /media/hda2/Users/Jason/???? where ???? is a folder name I cant remember (yes I have tryed to guess).

The kernel log tells me that it gets a I/O error at sector 16564040 now I would like to take a low level look at this raw data in the area in the hope I can see something that jolts my memory about the name of the mystery directory.

I have tried Spinrite.

The next thing I am going to look into is dd_rescure which is simular to dd but better at recovery but I am unfamiliar with both of these.

Does anyone know of a utility to look at data on the disk at its lowest level or can help me on what to do with the dd_rescure utility. Or even has a completly diffrent idea on how I can get my files back.


share|improve this question

closed as off-topic by HopelessN00b Jan 27 at 0:39

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

6 Answers 6

Boot a grml CD (it is a linux which contains dd_rescue).

You will get a simple shell. Here you should use dd_rhelp.

dd_rhelp is similar to dd_rescue. Quoting from its website:

dd_rhelp is a bash script that handles a very useful program written in C by Kurt
Garloff which is called dd_rescue, it roughly act as the dd linux command with the
characteristic to NOT stop when it falls on read/write errors.

This makes dd_rescue the best tool for recovering hard drive having bad sectors.
(dd_rescue can be found : http://www.garloff.de/kurt/linux/ddrescue )

But using it is quite time consuming. This is where dd_rhelp come to help.

In short, dd_rhelp will use dd_rescue on your entire disc, BUT it will try
to gather the maximum valid data before trying for ages on bunches of
badsectors. So if you leave dd_rhelp work for infinite time, it'll have the
same effect as a simple dd_rescue. But because you might not have this infinite
time (this could indeed take really long in some cases... ), dd_rhelp will jump
over bad sectors whenever it encounters too much in a row.  In the long run,
it'll parse all your device with dd_rescue.

You can Ctrl-C it whenever you want, and rerun-it at will, it'll resume it's job as it
depends on the log files dd_rescue creates.

In addition, progress will be shown in a ASCII picture of your device being rescued.


dd_rhelp /dev/yourdrive /mnt/backupdrive/yourdriverescued
share|improve this answer

If you get too many hardware I/O errors from the drive trying to remap itself, you may want to try to run drive manufacturer's disk test utility. It's usually an ISO that you can burn to a CD and boot from. It will let you do a full drive test and in doing so it will detect and attempt to remap bad sectors. That may get you to a point where you can recover your data, though some of it may be corrupt.

share|improve this answer

I haven't used it myself, but I've been told that WinHex (http://www.x-ways.net/winhex/index-m.html) can handle jobs like that.

I'm surprised there's no handy utility to tell you the file stored at a particular sector, but I couldn't find one either when I looked for one.

share|improve this answer

Boot machine with live cd, (Ex : ubuntu,knoppix) after complete boot, Try to mount the partition using following commands : OR you can connect the hdd to linux machine and run the same.

  1. Run cfdisk or fdisk -l (Check the partition)

  2. mount -t ntfs /dev/partition /mnt

  3. Try to copy the data.

share|improve this answer

Most persistent read error are due to the ECC code not matching the data, this can be triggered by a powerloss while writing. The detailed IO error name should be something like ECC uncorrectable error. Otherwise ignore the rest of this post. There is nothing that can be done about the data on this sector. However the mismatch between filesystem block and hardware disk drive blocks is probably keeping you from reading the perfectly good surrounding sectors. When the filesystem tries to read several sectors including the bad one , it gets an IO error and is not smart enough to see that only a small part of the read request failed. One way to solve this issue is to overwrite just that hard sector with zeros. This can be done with:

dd if=/dev/zero of=/dev/yourvolume seek=the_sector_number count=1 (with the approriate hard block size if your device has larger than 512byte blocks bs=XXX ).

To make sure you have the right sector number, first try to read just the failing sector with:

dd if=/dev/yourvolume of=somefile skip=the_sector_number count=1 bs=your_block_size_if_not_512

This way you should able to read the surrounding sector and pinpoint the corrupted block. Obviously, this is a very dangerous operation and getting one of the dd parameters wrong could lead to more data loss.

share|improve this answer

http://www.cgsecurity.org/wiki/TestDisk has bailed me out many times.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.