Ted Carnahan

I always thought that it was a bit silly that some people tried putting their mostly-broken hard drives in the freezer to get them working to rescue the data, but I’m a believer now. I had some important data to get off of an old drive, and with the help of 24 hours in the freezer, the Ubuntu alternate install CD (which doubles as a rescue CD) and some patience, I have emerged victorious! In the process, I learned…

1. Cold hard drives work better.
2. The Ubuntu install CD doesn’t have scp, so don’t plan on it being there to transfer files over the network.
3. Having a spare disk with a small vfat partition is really handy when you need to copy data someplace locally and you don’t have much time.
4. dd is not invincible - it gets hung up on I/O errors just like lots of other tools
5. Don’t stop just because the drive started clicking again - I was about to give up, but then I tried one last time and got all of the data off cleanly. Of course, Your Mileage May Vary.

Disclaimer: it’s not my fault if you lose all your data. Follow these instructions at your own risk.

After upgrading from Ubuntu Dapper to Edgy, I noticed that my swap partition wasn’t mounted. I ran mkswap /dev/sda2 and continued on my merry way. The system seemed fine for a little while, but then I couldn’t write to any files. Upon rebooting, grub gave me error code 17. Oops - wrong partition!

I booted a Ubuntu Edgy Live CD, then downloaded TestDisk,
an open-source low-level disk analyzer. I used it to analyze the broken partition, and located the backups my ext3 filesystem made of the superblocks:

superblock 32768, blocksize=4096
superblock 98304, blocksize=4096
superblock 163840, blocksize=4096
…etc…

Being a good Boy Scout, I was prepared, having relatively recent backups. If you don’t have backups, you should probably use some incantation of dd to backup an image of your partition first.

Using the superblock information, I ran fsck.ext3 in a non-destructive mode like so: sudo /sbin/fsck.ext3 -n -v -b 32768 /dev/sda2 The -n flag means “answer no to every question,” which prevents any destructive writes to the disk. Flag -v means “verbose,” and “-b 32768″ tells fsck to use the superblock backup at block 32768. If you get a lot of errors (that you care about), try a different backup superblock.

If you’re satisfied that fsck can do the job safely (and if you’re not, it’s time to turn off the machine, pull the hard drive, and call a data recovery company), remove the -n flag (and add the -y flag if you’re really brave and want to answer “yes” to every question) and run fsck again. Cross your fingers. Run fsck one more time, this time non-destructively (with -n), to see if everything was fixed.

Now, if all has gone well, it’s time to mount the drive again, read-only, in a folder called /rescue: sudo mount -r -t ext3 /dev/sda2 /rescue. Now (hopefully) you’ve got your files back! Copy them someplace safe ASAP.