Recover files from NTFS drive with bad sectors

A few nights ago I have created a backup of my data on an external 500 GB NTFS USB hard drive. I have then formatted my computer, reinstalled Ubuntu and started transferring back the data from the external HDD.

Unfortunately some files have became corrupted and Ubuntu is unable to copy them over. The same issue happens if I login using Windows 7.

Disk Utility detects with SMART that there are "a few bad sectors".

Some of files are perfectly intact, but other files cannot be accessed (nor read, copied...) although they are displayed within nautilus and show the correct file size.

Is there anything I can do to recover this data? I have thought of using TestDisk but this utility seems more useful for repairing lost partitions or deleted files.

I have also thought of using ddrescue so I could at least have a low level copy of the disk but I am not sure what use to make of it in order to recover the data!!!

Solution 1:

Problem solved! I know this is not related to Ubuntu but I think this could be useful for other people.

I have found out that Window's chkdsk could solve the problem, this is because Ubuntu doesn't support NTFS as well as Windows does. It has taken several hours/days to run the tasks (just Windows scandisk with all options activated) but in the end I have managed to recover 99.98% of the data.

Solution 2:

Instead using dd you should use a tool which handles errors better instead of filling them with zeros. I ran into many timeouts which makes the process really long and tedious. The alternative is ddrescue which retries failed sectors and also is a little bit faster in skipping bad sectors from my experience.

Install (ubuntu)

sudo apt-get install gddrescue

Create the image

 sudo ddrescue -d -r3 /dev/sda1 test.img test.logfile

This will create an image in the current dir named test.img of the disk /dev/sda1. You can of course backup the full drive instead of a single partition. (The r parameter tells it to retry failed sectors three times - don't forget the logfile, otherwise this will not work) ddrescue also allows you to abort/resume the process which is really nice. Remember to set right blocksize: -b "blocksize" if you get errors on -d "direct mode"

Mounting the image file

Create a folder where you want to mount the image and mount the image

sudo mkdir /mnt/mybackup
mount test.img /mnt/mybackup -o loop

Check out the following for more information: https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html https://www.technibble.com/guide-using-ddrescue-recover-data/ https://apple.stackexchange.com/questions/39504/best-way-to-copy-all-files-ignoring-errors

Solution 3:

If a drive has unreadable sectors one of the choices you have is to make an image of it with dd forcing it to ignore the damaged sectors and then mount that image to read the useful data.

Create a image of the drive

Use the command sudo fdisk -l to identify your USB disk, note his device path, it should look something like /dev/sd[*], where [*] is a letter representing your USB drive.

When you are sure about the path to the drive you want to copy you can use dd to make a image of it and use the options to keep on reading after failing to read data

dd if=/dev/hd[*] of=/foo_path/foo_image conv=noerror,sync

This will read the device /dev/sd[*], output it to /foo_path/foo_image and ignore read errors. /foo_path/foo_image should not be on the same disk you are reading.

So, lets say you used sudo fdisk -l and you found that your USB drive is /dev/sdb, you can then use any of those commands to make an image just by replacing /dev/hd[*] with /dev/sdb.

Mouting the image file to read the data

You need to create a mount point, lets call it /mnt/ddimage

sudo mkdir /mnt/ddimage

Now mount the image you just created to it

mount /foo_path/foo_image /mnt/ddimage -o loop

You should now be able to read any useful data from the cloned drive image.