Best way to deal with a physically damaged NTFS formatted hard drive?

Mar 11, 2018
1
0
10
I have a NTFS formatted hard drive that I believe is physically damaged. It is a seagate barracuda 3tb, the ones that are notorious for failing. It is a data drive so there is no OS on it. When it first starting failing, it would crash my computer (Windows 7, completely frozen but no BSOD).


The first thing I did:
I booted from Ubuntu live and it would not mount. I forgot the exact message but I ran testdisk on it and may have erased some hidden partition or something. I did a quick analyze and it found both of my partitions and two unused partitions. I wrote the both my partitions to the drive and it no longer shows the unused (unallocated) partitions. I don't know if this is relevant or not.



Next:
I attempted to use ddrescue to clone the disk to an img file. ddrescue cloned about ~600MB of about 1TB before it froze (and presumably crashed). I resumed using the log file, and it would immediately freeze.


Next:
I went back to testdisk and was able to list the contents of both partitions. I tried copying all files at once and not surprisingly testdisk would freeze/hang (and presumably crashed). I then tried copying single files/folders one at a time and it seemed to work. I copied a relatively large folder before I went to sleep and when I woke up testdisk crashed sometime during the copy and the HDD was unmounted.


Some things I've noticed:

1. Detection of the HDD is a hit and miss. Sometimes linux will see the drive, sometimes it won't. Sometimes testdisk can list files from it, sometimes testdisk cannot (immediate crash upon pressing list).
2. Copying files is a hit and miss as well. Same reasoning as above.
3. Windows 8.1 (laptop via USB) no longer detects the hard drive at all (connecting via sata->usb cable. yes, the HDD is powered).
4. Keeping the HDD plugged in when booting into Windows 7 (desktop, directly via sata) will cause Windows 7 to not boot at all. It hangs on the startup screen.


My questions:
It seems that this is a physical hardware issue. If this is the case, is it possible to pull the data out of the hard drive by myself without visiting a professional? The data is not extremely important and I should be able to get the important stuff out one by one via testdisk but obviously doing it automatically/in bulk would be preferable.
I've been doing some reading (https://www.cgsecurity.org/testdisk.pdf) and one method seems to be using ddrutility to create a mapfile (16.5 in PDF) and then using ddrescue to copy based on that mapfile. Is this a viable approach? Any suggestions on this topic would be greatly appreciated.
 
Solution
First to say I take no responsibility for any further damage if you follow this suggestion: I heard that storing a hdd in a fridge for some time may enable data transfer from the disk temporarly. Haven't tried that myself so I don't know the probability for success.
First to say I take no responsibility for any further damage if you follow this suggestion: I heard that storing a hdd in a fridge for some time may enable data transfer from the disk temporarly. Haven't tried that myself so I don't know the probability for success.
 
Solution

USAFRet

Titan
Moderator
1. Stop messing with the drive.

2. Attempt a sector by sector copy, off to a different drive.
Linux dd, or one of the current imaging tools. Macrium Reflect can do a 'Forensic copy', which will attempt to copy every sector off to another drive.
Then work on the data on the new drive.

3. If it is a physical issue...you may be 100% out of luck, no matter how much you mess with it.