Portable HDD Not working :(

[z3r0aCc3Ss]

What should I do to recover data from my portable HDD?
I have WD, My Passport, portable HDD. It has encryption and requires password to access the actual content.
It has stopped working suddenly. Whenever I connect it my PC, sometimes it shows up, and other times, it doesn't even detects it.
When it detects, I can open it. Then I get an error, "I/O disk error" or "Disk is empty. Do you want to format it?".
I used may tools to recover data from it, but they also get I/O read error. It can't be read.
What's the solution on this? It was 1 TB, and only 50 GB was empty, so you can image what amount of data I had in it.
How should I recover that data?

[bad_brain]

phew...sounds like it's about to die. before you think about the actual recovery you should mirror the complete HDD onto another one as long as it's not completely dead yet. then you can think about getting the data, makes more sense than stressing the HDD now even more by trying and trying.

[z3r0aCc3Ss]

How do I take the mirror? It's not detecting. When I plug in, I just get 614 MB of disk and it has Unlock.exe in it. When I run that, I enter the password and the drive gets unlocked and then I see the entire 1 TB (930 GB) HDD.

[lilrofl]

I agree with b_b, your hard drive is gonna fail.

How is your hard drive encrypted? Hope it was TrueCrypt

I have successfully used ubuntu rescue remix to recover from failed hard drives before, although any live distro with gparted and ddrescue should be able to do it provided the correct file system tools (ie. ntfs-3g for NTFS partitions) is installed. The problem your gonna have is decrypting the hard drive and running the recovery software before it fails, which is hit or miss, to circumvent that issue you should use ddrescue to make an image of the disk first and then recover the data from the image. Bear in mind, every time you plug your hard drive in at this point you are risking the data, but you have to start some place. So:

Anytime you use dd style tools, there is the possibility of loosing all your data, so double check your drive names and triple check you command input before hitting the ol' enter key. Also know that your data will be safe if you stop plugging it in. You can try the procedure out on a fresh drive and data to figure it out exactly before risking your data. Now I'll illustrate the process I would think to use in your case.

Lets get started:
1) Do not run filesystem check or fix software, if the damage is physical and not logical you'll just corrupt more data.

2) Figure out where to put the data you will recover, you say it's about 50GB of data, you'll need a spare 50GB to store that data. If you used trueCrypt though i think you'll need the whole drive space (1TB) because TC stores the encrypted data in partition free space.

3) Download a linux live distro with ddrescue the appropriate file system utilities and maybe even a sweet lookin GUI to make you feel comfy

4a) if you can decrypt your hard drive then skip to 4b, if you cannot, you'll have to copy the MBR of the drive as well as the partition table, and then use a truecrypt rescue disk to restore the boot loader and key data of the image after you have mounted it, so I've been told. I have never recovered encrypted data stored in RAW partition areas before, so this is all new to me.

4b) Make an image of the failing hard drive using ddrescue. I should mention that there is also dd and dd_rescue. dd_rescue will continue to image even when encountering physical damage to hard drives. If you used TrueCrypt though the errors you skip will corrupt your encryption... but cest le vi or whatever.

the command structure is not difficult:

Code: Select all

ddrescue /dev/hda /dev/sda
/dev/hda = source = internal hdd
/dev/sda = destination = external usb drive 

Note hda and sda are not static values, check your drive names first with df or mount commands.

5) Mount the image with the mount command. This command structure is also not real difficult

Code: Select all

mount -t [filesystem type of original drive] -o loop /the/image/file /the/mount/point

As stated earlier I recover data a lot, but never has it been encrypted, and as such I make no guarantees. It is possible that you can find someone who has, and maybe next weekend I'll try the process out myself to hammer out the bugs. If you do choose to give it a go though, may the force be with you

Almost forgot, this process will take a long time to complete, perhaps as long as 24 hours. Set it up, walk away and don't touch it till it's done.

[z3r0aCc3Ss]

It was not truecrypt.
It's the default encryption mechanism provided by WD...

[lilrofl]

in that case you'll have to unlock the drive and image it while it is unencrypted. You can use dd_rescue instead of ddrescue because the drive will be unencrypted while the image is made, so the avoidance of damaged sectors is not important. The rest of the process is the same though. Mount drive, unencrypt, image, mount image and then recover data off image instead of recovering off damaged HDD.

[z3r0aCc3Ss]

So, lets hope it gets unencrypted...

[z3r0aCc3Ss]

Now, the problem is, I don't have enough space to mirror entire 1 TB. Can I just mirror some contents?

[lilrofl]

Well, a mirror is a byte-by-byte copy of an existing medium, so not really; however you can split a cloning into sizable chunks. (this is often done if the media will be burned onto DVDs) but you still need the space to store the chunks.

Another option is to use compression. bzip2 offers the best compression value, but it is slow as molasses... adding an enormous amount of time to an already lengthy process. gzip is faster by a bit, and offers decent compression if you are in a hurry.

If wither of these two options is usable to you, there is a front end to dd and a few other cloning softwares that will make the options easier to understand. It's called clonzilla.

[DNR]

just one thing- cabling could be failing,not the HDD. Check the cabling.

DNR