[sleuthkit-users] Re: Recovering files from damaged disk

[Matt K. <mku...@ma...>]

If it works, 'conv=sync,noerror' works great, but I have run into situations where it did not work.  For whatever reason, dd would hang at a certain block even with that option specified.  I ended up looking at the size of the output file after dd hung and estimated the location of the bad spot. I then began reading one block at a time until I found the one that was bad.  I then narrowed my block size down and read smaller blocks noting those that were bad.  At the end of this process, I had a series of dd files.  I created zero'd dd files from /dev/zero to replace the bad sections and used dd to piece everything back together into a single image.  Pain in the rear, but it works.  You just have to keep track of the individual files and put them back together in the correct order.

-Matt

> Hi Colby,
> 
> While you could manually put all the parts together.. It is easier to 
> let dd do it for you!..
> 
> Just use dd with conv=noerror,sync as arguments..
> 
> This way all unreadable data is written as a 0 on the destination and dd 
> continues on after an error...
> 
> dd if=/dev/hdXX of=imagefile conv=noerror,sync bs=1k
> 
> (Take bs small as that is the size of data is "skips" on error If you 
> want to be REALLY thorough use bs=1, but be ready to wait for a LONG time!)
> 
> I hope this helps,
> Paul Bakker
> 
> Colby Gutierrez-Kraybill wrote:
> 
> >
> > Hello,
> >
> > I am attempting to recover data from a physically damaged disk.  I  
> > was able to dd
> > the first GB (including partition info) of the disk and I can run the  
> > sleuthkit tools
> > and do find some useful info on it.  However, to get at the rest of  
> > the disk, I manually
> > skipped past the damaged sectors on disk using dd and was able to  
> > read another
> > much larger block of data (16GB) and then some shorter sections after  
> > that
> > (5x500MB each).  I noted down which sectors this blocks were started  
> > physically
> > on the slice.  Now I am trying to sort out if I can put these pieces  
> > back together
> > enough so that I can use the regular sleuthkit tools on the whole  
> > fragmented
> > mess.  Is this doable?  Is there a recipe for working through this?
> >
> > - Colby