Re: [gentoo-user] data recovery advice needed

[Grant Taylor]

On 12/18/2018 10:42 AM, Mick wrote:
> I know others have commented on the reliability of recovering data from drives
> connected via USB caddy, but I have had satisfactory results on a number of
> cases.

I think it completely depends on the type of problem.  In my experience, 
SATA-to-USB adapters don't deal well with physical hard drive / media 
errors.  (At least compared to SATA connections on the motherboard.)  I 
think their retry mechanisms are somewhat limited.  Conversely, software 
/ file system / logical corruption issues are likely perfectly fine over 
USB.

> I cloned the whole drive having run ddrescue backwards and forwards a couple
> of times.  c/f/gdisk would see all partitions, but when I tried to mount the
> cloned /dev/sdb4 (NTFS) with ntfs-3g it complained there was no device found
> (/dev/sdb4).  I got the same error with the failing drive.

Seeing the partitions in the partition table is independent of the 
device file being there.  -  Did the device file exist?  -  I 
occasionally have to run (k)part(x) to tell the kernel that the 
partition is there and to create the device file.

> So, I used losetup with --offset on the failing drive itself over USB 2.0 and
> was able to mount and recover all the NTFS files.

That sounds like the kernel didn't know about the partition and / or the 
device file didn't exist.  losetup will create a new device file (and 
possibly partitions depending on how you did it).  Then you will be able 
to point standard FS tools at the new device (partition) file.

> Over the years I've used clonezilla, ddrescue, testdisk, photorec and losetup
> to recover files.  On a couple of times where data on the disk had been
> overwritten by subsequent operations, I was not able to recover the affected
> files.  So, if when moving the partition data was overwritten I suspect it
> will be very difficult to recover this with conventional software tools.

I would expect moving a partition to an earlier location on the drive 
will take the first block and move it to the new location, then the next 
block, etc. until finished.  I'd expect moving a partition to a later 
location on the drive will take the last block and move it to the next 
location, then the previous block, etc. until finished.  This way the 
data is never actually overwritten.  Blocks have been moved, and 
committed to disk, thus vacating the old block.

> However, it doesn't hurt to try.  :-)

I mostly agree.  You need to be mindful of physical damage and thermals.



-- 
Grant. . . .
unix || die