Emergency hard drive recovery: success!
filed under: family, geek, netbsd, programming
6 January 2007

Waaaay back in April of 2006, my cousin Karen (and her husband David) had a hard drive failure, resulting in the loss of all their digital pictures of their baby daughter Ella. They didn’t have backups, and they didn’t have prints. Computer shops weren’t able to help, and clean-room data recovery was too expensive. Eventually, they gave up on it and sent an email to the family asking if we could send them copies of any pictures we had.
I, being a geek, offered to take a look at the drive and see if I could get anything off of it. They, lacking any better options, sent the drive to me so I could give it a shot.
I dropped the drive into my NetBSD machine and sure enough, the BIOS recognized it. That meant that the drive was still physically working, and that I might have a chance at getting whatever data was left off the drive. I was able to mount the drive (read-only) and read data from it, which meant that there was a good chance of finding at least some of the pictures.
I did a bunch of googling and learned a lot about home-brew data recovery. To sum it up, I learned that you need:
- A copy of the
dd
utility that supports theconv=noerror
argument. (netbsd’sdd
does) - A handy program that knows how to find images on a raw drive image. (See below)
I was able to make a copy of the bad drive (onto a good drive of mine) using dd
and the instructions on this page. There were a lot of bad drive sectors encountered during the copy, which was to be expected given the fact that the drive had failed in the first place, but I was hopeful about finding at least some of the images. And having the drive copy was a big win – it meant that I could work with a copy that wouldn’t get worse if the hard drive took a dive.
The hard part was finding a program that could recover the images. For a long time I thought I was going to have to write my own, and that seemed a daunting task, but I finally found this guy who had this exact same problem and already wrote this program. It was exactly what I needed – a program that would find and extract images from a raw drive!
The only problem was that jpg-recover was running at about 15kb/s. At that rate, getting through the 80gb hard drive would have taken about 60 days to finish. I didn’t have 60 days (without interruption!) to wait.
So I dug into the code and discovered that it was horribly innefficient. It was reading data one byte at a time, checking for an image after each byte read, and just generally not being smart about performance. I set about improving it.
I was able to do so. My version takes more memory (a configurable amount) but it runs much faster: at about 12000kb/s. That’s 800x faster :) At that rate, it only took about two hours to finish, finding (after some tuning) 4,422 potential images, of which 187 were uncorrupted pictures of Ella – including this one.
That felt good :)
I’ve published my version of the program as jpg-recover-faster. It’s a perl script, so you’ll need perl. I make no guarantees about the lack of bugs – use this script at your own risk. It may eat your children. ;)
You’ll want to read the comment at the top of the script before using it, and the other pages listed above will help you figure out how to use it. Feel free to post comments here with questions or suggestions.
Comments
6101 days ago
Matt says:
AWESOME! And, let me just repeat – AWESOME!
Now, applying my knowledge of scope creep and donning my alter identity as an aspiring Perl Monk, phase 2 might go something like this:
<blockquote>Relatives: “Nathan – Thank you! Those pictures were the most important thing on the hard drive and the most devastating loss. Beyond that, we lost Quicken files, Word files, email, etc. etc. etc. I wonder, since you get the JPGs, can you get X, Y, and Z for me too?”</blockquote>
If you want to be a hero to millions, first off upload your script to CPAN. Then, search CPAN (http://search.cpan.org/search?query=file+type&mode=all) and take a look at some of the modules that identify file types and extend away :-)
(PS – I can’t use your Textile help to format my text anymore, so you’ll just have to imagine…)
6080 days ago
Amitai Schlair says:
This is very awesome. Have you seen http://mail-index.netbsd.org/pkgsrc-changes/2007/01/26/0061.html ?
6073 days ago
Nathan Arthur says:
Very interesting. I installed it to check it out, and it looks like a much better version of my program. It can be found at sourceforge or in pkgsrc. It’s even got tests!
Too bad it wasn’t available in pkgsrc when I did this, and I didn’t find it via Google. Either way, I’ll try it next time. Thanks!
5975 days ago
Compare Data Recovery says:
At this site you can compare data recovery quotes, I haven’t seen any other sites that does that, was very valuable in my case.
http://www.datarecoverycompare.com
5954 days ago
laptop data recover says:
This post is important for any who lost data. thanx for posting it.
5928 days ago
monicker says:
Okoker Data Recovery can help you to recover all the deleted and lost your data. You can use the software: missing or
lost partition recovery, deleted partition recovery, deleted file recovery.
download:
http://www.qweas.com/download/system/data_recovery/okoker_data_recovery.htm
5823 days ago
www.DisasterRecoveryGroup.com says:
That is great! The amount of data recovered may be increased using professionals but for home use and cost efficiency, you probably hit the nail on the head. congrats. DRG performs data recovery and the results are finite as they do perform single sector scanning, but at a much faster rate.
5579 days ago
Alex says:
I wish I could find your post when my dd was wracked. Though I will keep the information in advance. Thank you.
5472 days ago
data recovery services says:
Nice posting http://www.hdrconline.com
Add a comment