Hard disk crash recovery

One of the worst things that can happen to your computer is a disk failure. While any hardware component can be replaced, the data on the disk (which is usually more valuable) can not, unless you have a good backup. And while lots of people know about backups, few ever do it (or do it regularly) before they get burnt.

If you're unlucky like me, two hard disks can fail within less than 12 months, and not just get some bad sectors but become completely unusable.

If the data on the disk is worth more than a few hundred US$ and the disk is really dead, then send it to a professional data recovery company (they can open it up in a clean room and read from the platters using special equipment).

Otherwise, here are some things I learned from this experience (together with some things I already knew):

Don't wait

Act immediately when you notice disk errors. If you don't do anything, it will only get worse and you will lose more files.

At the very least, back up your most important data while the disk is still usable.

Avoid disk writes

Mount the partition read-only. Use a live cd such as SystemRescueCd if necessary.

If the partition is not mountable, avoid running fsck.

Copy the important data to another disk

Don't use another partition on the same disk, but another physical hard disk, or USB flash drive.

Copy the files directly while the partition is still mountable (starting with the most important stuff).

If the partition can't be mounted anymore, use ddrescue (named gddrescue in some distros; it's different from dd_rescue or dd-rescue) to copy the readable data from the whole partition into a file on another disk.

Example:

ddrescue /dev/sdb1 sdb1 sdb1.log

Note: you can also use ddrescue on files that can not be read completely (if the partition is mountable).

Use an external case

If the disk stops responding completely when encountering errors, but works again after rebooting, then take it out of the computer and use an external case. That will make it easy to restart the disk without restarting the computer, and it will save you lots of time and nerves.

Fix the copied filesystem

After you finished copying the partition with ddrescue, ideally make a backup copy of the file, then proceed to fix the filesystem:

fsck.ext3 sdb1

If that fails, then you'll need more advanced forensic tools. Either way, you can expect that some of the files will be forever lost.

If fsck succeeded, you can proceed to mount the partition (ideally read-only) to access the recovered files:

mount -o ro,loop sdb1 /mnt/sdb1