Crash recovery by use of forensic tools

Upon the clients laptop smashing to the floor and the LCD becoming a colourful mess, I extracted the hard drive so that it could be copied.  A cyclic redundancy check error was preventing the drive from being read.  CRC's are an error-detecting code that is used in storage devices and digital networks to detect accidental changes to raw data.  Blocks of data get a short check value attached, based on the remainder of a polynomial division of their contents.  {from: wiki }

First you copy as much data as possible, without retrying or splitting sectors:

• ddrescue --no-split /dev/hda1 imagefile logfile 
  
  

Now let it retry previous errors 3 times, using uncached reads:

• ddrescue --direct --max-retries=3 /dev/hda1 imagefile logfile 
  
  

If that fails you, try again but this time retrimmed, so it tries to reread full sectors:

• ddrescue --direct --retrim --max-retries=3 /dev/hda1 imagefile logfile 
  
  

{from: www.forensicswiki.org }

The failure went from 57.1KB to 1024b.  Sir, you may have your drive back, and your family photos have been saved!

---