Recovering data from a broken HDD

[Polytropon]

On Sun, 17 Sep 2017 23:39:20 +0100, Shamim Shahriar wrote:
> Good evening all, hope everyone is well.
> 
> a little background:
> I have a couple of portable HDD. One of them was dropped a few weeks 
> back, and then the computer stopped recognising it and asked it to be 
> formatted.

Probably "Windows" asked for this - sometimes suggests to "repair"
a disk, often with the result of causing much more damage. :-)



> Once formatted, it appeared to start working again -- even 
> though all previous data had been lost, and no, I am not trusting that 
> device to hold any important data.

Just because the file system on the disk has been initialized, it
does not neccessarily imply that the actual data has been lost
(read: overwritten or zeroed). Forensic tools often can still get
most of the data of a formatted disk.



> Last week, another HDD slipped through the hands (literally). This one 
> too is showing the same/similar symptoms as the previous one. I believe 
> that the data is still there, but somehow the alignment has shifted and 
> hence the HDD controller is unable to provide the data. I am wondering, 
> can anyone please suggest a data recovery programme that I can try on 
> the drive? The HDD being not in the western/relatively-more-techy region 
> cannot be sent to a data recovery company (and I have been told they 
> cost you a fortune), but have access to m$ or Mac or Linux or BSD 
> systems. So if anyone could please suggest something to try on (Yes, I 
> had been on google, and found a huge amount of tools -- but I would much 
> rather try out something that someone has already tried and can give 
> some insight on).

I suggest you first create an 1:1 image from the disk using
dd, or in case of errors, dd_rescue. Then continue working
with the image only. UNDER NO CIRCUMSTANCES write to the disk,
as this will usually make things more complicated.

There are several tools for data recovery. Which tool to use
depends on several factors, such as what has actually happened
to the disk's content, and what you want to rescue from it (and
how). Those factors also include the kind of file system on the
disk (FAT, UFS, HPFS, ...) and the kind of slicing and
partitioning (none, MBR, GPT), as well as the intended target
(reconstruct file system, just get data, get data with file
names and directory hierarchy, ...). There is no "one size
fits all" kind of egg-laying woolmilksow tool. ;-)

In case there is just a partition misalignment, consider using
the "recoverdisk" tool, provided natively by FreeBSD.

Allow me to repeat my "famous list of recovery tools" that I post
on this mailing list from time to time.

System:
	dd
	fsck_ffs
	clri
	fsdb
	fetch -rR <device>
	recoverdisk		<- as suggested

Ports:
	ddrescue
	dd_rescue
	ffs2recov
	magicrescue
	testdisk
	The Sleuth Kit:
		fls
		dls
		ils
		autopsy
	scan_ffs
	recoverjpeg
	foremost
	photorec
	fatback

Proprietary (free test version for diagnostics):

	SysDev Laboratories LLC "UFS Explorer"

Most tools require you to know what you're doing, so learning
how to use those tools appears to be mandatory. As I said, work
with (a copy of) the copy of the disk if possible, so in worst
case you can start from the beginning without feeling guilty
that you did something wrong. ;-)

Good luck!


-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...