I got an external hard drive enclosure for the purpose of recovering some of the files from my old laptops hard drive. The hard drive and all of it’s partitions show up in both disks and gparted but it wont mount. When I tried to mount it manually, it gave the error message stating that it can’t read the superblock. I’ve never had to deal with this issue before, so the only things I’ve tried so far were fsck and the data recovery option in GParted, and neither of them helped.
I tried searching about it online but all of the solutions I found online either didn’t work or required methods that are currently not possible for me. The hard drive had Ubuntu (22.04 if I remember correctly) installed on it and I just need access to the files in the sdd3 partition, which was formatted in ext4.
First step, in case you didn’t do that yet: Create a disk image of the partition - you don’t want to try data recovery on the actual data. Easiest is just using dd to dump the disk to another drive.
Next try running testdisk on the image to see if it can find the backup superblocks - if it does you can feed that to fsck to restore the filesystem.
If you know the blocksize of the filesystem you can also run mke2fs with the -S parameter - this will just write the superblocks. Again, only do that on a disk image, not the actual drive.
If the disc is corrupted it may be failing, recommending ddrescue over dd is probably a better call not knowing anything else about this situation. Essentially, no reason not to use it.
I swear by ddrescue. It’s a situation I strive to never be but i’ve been there before. I used it once to rescue an employees masters capstone project from their dead work laptop.
After reading about it - true. Disadvantage of doing this stuff for a long time - you miss new developments. Only reason I’m aware of testdisk is that I lost the sources of my own superblock search tool, my old binaries broke with a newer glibc, and before reimplementing it I checked if sombody else had done that in a more usable form in the meantime.
That’s one of the solutions I saw that I currently can’t do because I have no other device that I can use for that.
You can decide yourself if the data in that disk is more valuable than the price of a new disk to store the backup image. If it’s not that valuable I guess you can one-shot it.
You can do all of that on the device - but you only get one shot. If you mess up that’s it - so no sensible person would try any form of data rescue directly on the device. Storage is cheap, if you don’t have sufficient space on your computer just get another external disk.
I know you wont understand where I’m coming from so I wont bother explaining it. If I need another storage device than I’ll just have to wait until next year to get another storage device.
Edit: I don’t understand why I’m getting downvoted but it proves to me that I made the right choice in not explaining my situation.
In that case I’d recommend waiting until next year before attempting recovery.
The target storage device for the image can be over the network if that’s an option for you.
I admit the downvote is weird.
I don’t think I can use that mostly because my internet package has a data cap and I don’t want to risk exceeding that.
Also, I know it’s not really the time or place for this type of discussion but I’ve noticed recently (within the last few months) that for some reason the Lemmy community has changed. I don’t know if anyone else feels that way but it sometimes seems like some users are unnecessarily hostile/judgemental towards me. I wont say anything more because once again, this is not the time or the place but Lemmy wasn’t like this when I first started using it over two years ago.
By “network” they also meant you can export the disk image to another device on your local network, rather than over the internet.
The hard drive should be connected by SATA or eSATA when making the image. Connecting over USB is just asking for more trouble when the drive is not working correctly.
That has changed over the last few years - I’d prefer a proper usb3 to sata bridge over a shitty sata controller - and the quality of integrated sata controllers isn’t that great nowadays.
Another tool that has helped me when the others couldn’t was RecuperaBit. It has the same restrictions though, you have to do it on an image of the drive.
Try
testdisk. It can copy files from damaged filesystem without touching it. But only if you are lucky enough and the filesystem is not so heavily damaged thattestdiskwill be unable to find it.I have had great results with testdisk. At one point my dad’s external hard drive was so messed up that a local IT company couldn’t fix it. Mind you all our family and vacation pictures where on there, so it was kind of important. I think it took me a couple of hours, but with testdisk I was able to recover everything
Assuming I’m using it correctly, it doesn’t seem to be working for me. It sees the partitions but then it says that they can’t be recovered. But it’s weird because it’s for some reason saying that there is two unreadable partitions called “ms data”, which unless it’s referring to some partitions that were deleted when I install Ubuntu, I have no idea what they are supposed to be.
Yes, it could find partitions removed long time ago if filesystem headers were not overriden.
As others have said, first make a full copy of the disk so you’re not working on a failing drive.
Then, I highly recommend DDRescue
The quick and dirty way I’ve used is…
Use the nbd system (network block devices) and qemu to create a qcow2 image with your defective device as the base device. Serve this qcow2 image with qemu-nbd and attach it as a NBD device locally. Then run fsck or testdisk on the NBD device. This will let you repair the filesystem Linux sees without writing to the disk. Testdisk can scan for any filesystems left on the device if the partitions no longer match filesystems.
Also, if all else fails use photorec to slice the file types you need.
Also, ddrescue can try to read any actually failing sectors and work out what they contain, but puts a lot of stress on the device.
Beware, any method that puts more wear on the disk should not be used unless you’re willing to accept the risk that the drive could get worse.
I don’t know how to do any of that first part. All of the data on the drive is replaceable, it’s just going to be very tedious and time consuming. I’m currently trying one other method and I think after I’m done with that, that I’m just going to skip trying to recover the data. I had some other plans for what I wanted to do with this device and I think trying to recover the data isn’t worth it at this point.
The first thing you should do is create a raw backup of the data. The more you use this drive the worse the failure gets.
First create an image (cat /dev/your-disk > /path/your/image) and use recovery tools on there.
