I have been given an unhappy 2.5" external USB drive to look at by a friend at a charity that I help with their IT. If it's plugged in via USB or SATA (having shucked it) it shows on my PC as D, but no more information other than it's corrupted. Chkdsk won't touch it and Disk Manager shows it as a raw partition. I have downloaded a couple of random data recovery apps, but wondered if anyone had any recommendations for something decent that's free or a reasonable 'pay to recover what I found' option? The Easeus one found 1.8TB of stuff on a 500GB drive, and that has a 2TB free limit. When I looked, it seemed to be full of duplicates with the same name and small files that are no use. From what I can see, this drive contains someone's attempt at a windows 'backup' where they have dragged and dropped their C drive to an external USB drive...
First things first: STOP WORKING ON THE DRIVE. You need to image it, because every moment it's spinning is another chance for the data to be gone for good. Image it, either to a file or another drive, then do all recovery on the image. As a Linux user, it'd look something like this: Code: $ ddrescue if=/dev/disk/by-id/ata-ExternalDrive of=image.img $ testdisk image.img The first command will create the image, then you can remove the drive; the second will load TestDisk, a data recovery tool, on the image. You could also use plain dd instead of ddrescue: Code: $ dd if=/dev/disk/by-id/ata-ExternalDrive of=image.img bs=4k conv=noerror,sync But if there's damage to the disk it'll drop more data and run more slowly than ddrescue.
I 'unno, I've never used it. dd'll image anything to anything, it doesn't give a monkey's what you're trying to do. Image a hard drive to another hard drive? Sure. Image /dev/urandom to a CD-ROM? It'll give it a go. Image a serial port to a printer? 's your toner, whatever you want, boss. Image the Linux kernel to your soundcard's DSP? G'wan, then, but turn your speakers down first. Assuming that Macrium Reflect's got anything about it, it certainly should let you image a damaged drive. If not, 's a bit rubbish.
Thanks again GH, I've dropped into a rabbit hole that I haven't chosen! I do have an old Mint CD that I could live boot from and have a go.
I've used photorec in the past with great success. It came up with some strange filenames but it at least salvaged them from a dying hdd.
Thanks for all the suggestions. I did image it and the image was seen as corrupt and unusable, and Photorec did have a good go at it but only a list of files with inexplicably small files sizes came out. The list looked promising, all the sorts of things I was hoping to recover, but nothing of ans substance. I have now said I can do no more for it.
not free.... but available from the usual sources, I highly recommend UFSExplorer. I had a drive that nothing was working on... at all! tried all the usual ones and zero luck. 1 did find files but they were all corrupt. Ran UFS and recovered 90% of the files successfully!
I know there was the suggestion of DD imaging via Linux, but if you only want to use Windows, FTK Imager is free (https://accessdata.com/product-download/ftk-imager-version-4-5). From this I'd suggest imaging to "Raw(DD)" as the other types other tools likely won't be able to handle. Then you can work on that image file but you'll likely need to carve it to get any data off (but the tools I know and use for that aren't cheap).
There's the old bung it in a ziplock bag in the freezer for a bit trick. It's 50/50 but might be worth a punt?
You're more likely to know than I... can you use DD from within WSL... [or would it be easier to just boot off a live image of *distro of choice here*]
This is probably safer, depending on what you want to do. There's a lot of wizardry going on in WSL/WSL2 when it comes to filesystems.
This is true, however it doesn't present drives as block devices. Compare Disk Management... ...with sudo lsblk in WSL2 Notice that user prompt though - /mnt/c/Users/byron.... If I ls -lah against /mnt/ I see WSL2 is based in a VM at heart, and your Windows drives are mountpoints inside your WSL filesystem, but those drives are not exposed as block devices. To answer your question, yes you can use the dd command in WSL2... ...but you're probably not going to be able to dump a disk device to an image like you can in a "proper" linux distribution. You can probably work around it and somehow make it work in WSL2, but honestly if you've got the ability to boot from a USB device into a "real" live Linux distro then just do that instead. WSL is bloody great - especially WSL2 - and I use it daily, but it does have its limits.
Honestly I've gone through so many LOTR place names for desktops & servers (mostly servers and laptop re-installs) that I'm running out!
