Emergency hard drive recovery: success!

filed under: , , ,

6 January 2007

Waaaay back in April of 2006, my cousin Karen (and her husband David) had a hard drive failure, resulting in the loss of all their digital pictures of their baby daughter Ella. They didn’t have backups, and they didn’t have prints. Computer shops weren’t able to help, and clean-room data recovery was too expensive. Eventually, they gave up on it and sent an email to the family asking if we could send them copies of any pictures we had.

I, being a geek, offered to take a look at the drive and see if I could get anything off of it. They, lacking any better options, sent the drive to me so I could give it a shot.

I dropped the drive into my NetBSD machine and sure enough, the BIOS recognized it. That meant that the drive was still physically working, and that I might have a chance at getting whatever data was left off the drive. I was able to mount the drive (read-only) and read data from it, which meant that there was a good chance of finding at least some of the pictures.

I did a bunch of googling and learned a lot about home-brew data recovery. To sum it up, I learned that you need:

  1. A copy of the dd utility that supports the conv=noerror argument. (netbsd’s dd does)
  2. A handy program that knows how to find images on a raw drive image. (See below)

I was able to make a copy of the bad drive (onto a good drive of mine) using dd and the instructions on this page. There were a lot of bad drive sectors encountered during the copy, which was to be expected given the fact that the drive had failed in the first place, but I was hopeful about finding at least some of the images. And having the drive copy was a big win – it meant that I could work with a copy that wouldn’t get worse if the hard drive took a dive.

The hard part was finding a program that could recover the images. For a long time I thought I was going to have to write my own, and that seemed a daunting task, but I finally found this guy who had this exact same problem and already wrote this program. It was exactly what I needed – a program that would find and extract images from a raw drive!

The only problem was that jpg-recover was running at about 15kb/s. At that rate, getting through the 80gb hard drive would have taken about 60 days to finish. I didn’t have 60 days (without interruption!) to wait.

So I dug into the code and discovered that it was horribly innefficient. It was reading data one byte at a time, checking for an image after each byte read, and just generally not being smart about performance. I set about improving it.

I was able to do so. My version takes more memory (a configurable amount) but it runs much faster: at about 12000kb/s. That’s 800x faster :) At that rate, it only took about two hours to finish, finding (after some tuning) 4,422 potential images, of which 187 were uncorrupted pictures of Ella – including this one.

That felt good :)

I’ve published my version of the program as jpg-recover-faster. It’s a perl script, so you’ll need perl. I make no guarantees about the lack of bugs – use this script at your own risk. It may eat your children. ;)

You’ll want to read the comment at the top of the script before using it, and the other pages listed above will help you figure out how to use it. Feel free to post comments here with questions or suggestions.

  1. Matt says:

    AWESOME! And, let me just repeat – AWESOME!

    Now, applying my knowledge of scope creep and donning my alter identity as an aspiring Perl Monk, phase 2 might go something like this:

    <blockquote>Relatives: “Nathan – Thank you! Those pictures were the most important thing on the hard drive and the most devastating loss. Beyond that, we lost Quicken files, Word files, email, etc. etc. etc. I wonder, since you get the JPGs, can you get X, Y, and Z for me too?”</blockquote>

    If you want to be a hero to millions, first off upload your script to CPAN. Then, search CPAN (http://search.cpan.org/search?query=file+type&mode=all) and take a look at some of the modules that identify file types and extend away :-)

    (PS – I can’t use your Textile help to format my text anymore, so you’ll just have to imagine…)

  2. Amitai Schlair says:

    This is very awesome. Have you seen http://mail-index.netbsd.org/pkgsrc-changes/2007/01/26/0061.html ?

  3. Nathan Arthur says:

    Very interesting. I installed it to check it out, and it looks like a much better version of my program. It can be found at sourceforge or in pkgsrc. It’s even got tests!

    Too bad it wasn’t available in pkgsrc when I did this, and I didn’t find it via Google. Either way, I’ll try it next time. Thanks!

  4. Compare Data Recovery says:

    At this site you can compare data recovery quotes, I haven’t seen any other sites that does that, was very valuable in my case.


  5. laptop data recover says:

    This post is important for any who lost data. thanx for posting it.

  6. monicker says:

    Okoker Data Recovery can help you to recover all the deleted and lost your data. You can use the software: missing or

    lost partition recovery, deleted partition recovery, deleted file recovery.

  7. www.DisasterRecoveryGroup.com says:

    That is great! The amount of data recovered may be increased using professionals but for home use and cost efficiency, you probably hit the nail on the head. congrats. DRG performs data recovery and the results are finite as they do perform single sector scanning, but at a much faster rate.

  8. Alex says:

    I wish I could find your post when my dd was wracked. Though I will keep the information in advance. Thank you.

  9. data recovery services says:

    Nice posting http://www.hdrconline.com

Add a comment

(will not be displayed)

(not required)