Using "dd" restore an unreadable volume: Help!

(Message already posted once in the wrong forum, sorry if you've already seen it: slight modifications below)

My 200G Oxford firewire external drive has suddenly become unrecognisable by my system. When I try to mount it, I get a message that it is unreadable, and would I like to reformat it (to which I have said "no"). Won't launch on my main machine, nor on my portable (iBook, also running 10.4.2). I have no idea why. Sudden and unexpected.

DiskUtility sees the drive, but no mountable volumes. TechTool Pro doesn't see it at all.

I have a second external drive (LaCie 160G, also firewire), and I have seen on various groups that you can use dd to copy off info from a hosed volume.

The LaCie drive is empty, HFS+ formatted, ready to roll.

I have also read that if the target volume is smaller (which is my case) that you can pipe the output of the dd function directly into a .gzip file, with a command like,

dd bs=512 if/dev/disk2 conv=noerror, sync | gzip -9 > recovery.dmg.gz

I've never seen the "piping" incantation, and I don't really know what I'm doing... (not a UNIX expert) The -9 flag means "best compression", right? Given that I'm going to a 160G drive, which is more than the contents of Oxford drive, then I don't heed to worry so much about maximal compression (right?) I could set that flag lower... maybe to -1 even?? But shouldn't this command specify the LaCie drive as a target for the gz file? I don't see where this is specified... (disk2 is the Oxford...)

I'm hoping that I can gzip off the contents of the Oxford drive onto the LaCie, reformat the Oxford, and then expand the zipped file back onto the reformatted Oxford... Does that seem reasonable? Would I have to "dd" it back on? Ah, and the Oxford drive is partitioned... I don't know if that's an important detail. What will happen with the partitions if I expand the gz file onto a drive with a single partition?

I'm outta my league with this, and I'd really appreciate some calm and experienced help. (The man pages on dd and gzip provide some comprehensible info, but do nothing to improve my confidence!)
My Oxford drive - the unreadable one - contains the only copy of nearly 100G of documents, and yes I know how dumb that was... I'm a classic example of someone rendered slack by years of good fortune...

Many thanks for any help

Posted on Oct 23, 2005 1:39 AM

Reply
11 replies

Oct 23, 2005 3:35 AM in response to Colin Harrison

First of all you should find out if the drive has a hardware problem.
Since the problem with the drive could also be related to a defective FW bridge, which resides in the case of the drive, you should take it out.
Disassemble the case, set the jumpers at the drive to "slave" and mount it inside your G4. There is a problem however, that your machine probably does not support ATA drives larger then 120GB. Check that out, and if true, you have to search for someone owning a newer G4.
find out, about the diskname:
sudo pdisk --list
you should be able to identify your disks name, either rdisk0 rdisk1 rdisk2 ...
lets assume its rdisk2
Then, do a:
sudo dd if=/dev/rdisk2 of=/dev/null bs=10485760 conv=noerror,sync
and wait for a long time.
If the process finishes without an error message, the disk should be ok. If you get a message about error reading, the disk is bad.
copying the disk with DD will result in black holes of zeroes where the data is unreadable.
If you get no errors, buy a copy of disk warrior, and give it a try on the drive.

If you dont want to take the drive out, at least do a:
sudo dd if=/dev/rdisk2 of=/dev/null bs=10485760 conv=noerror,sync
even if the drive is inside the FW case.
Trying to read bad sectors while the drive is inside the FW case might probably give you no error messages. Instead, the whole machine will hang.
However, if the process finishes without error messages, try Disk warrior on the drive.

Assuming, the disk is bad, but has not more then about 100 bad sectors:
Chances are good you can recover all data:
Go to someone who has a recent PC-compatible.
Buy a copy of HDD Regenerator ( www.dposoft.net)
connect the drive to that PC, run HDD regenerator. If this is able to repair the drive, put it back in your Mac or FW case, and immediately copy all your important data to another disk. Then replace the drive.
Most of the time, HDD regen works very good. However in rare cases it might worse the situation, rendering the drive totally inaccessible ( especially when you have a western digital drive with many bad sectors)

If you do not know someone with a PC compatible:
Get another disk size 200GB or more, and copy the disk:
sudo dd if=/dev/rdisk2 of=/dev/(Raw disk name of new disk) bs=512 conv=noerror,sync
And wait for a very very long time!

After that, try to run diskwarrior on the copied disk. If successful, copy all needed documents from the repaired disk to somwhere else and reinitialize the Disk. Some Documents might be unsusuable since DD replaces missing data with zeroes!

This is a very short Howto. However, I hope it helps a little.
If your data is very valueable to you and you dont have a backup, consider sending the drive to someone who is used doing data recovery.

Oct 23, 2005 4:18 AM in response to nobody loopback

no much to add, but if the data on the questionable drive is valuable. Before attempting to repair that data. I would recommend running the dd as Nobody suggested, saving the disk image to a file. Then assuming that you have another drive that's large enough, a scratch disk. use dd to write the disk image to the scratch disk. Then apply your recovery efforts on the scratch disk. Doing it this way allows you try over and over again, if necessary. It also allows you to try different techniques. By doing it this way, if you make a mistake, you haven't lost anything. All you need to do copy the image file back on the the scratch disk and start over again.

Oct 23, 2005 4:24 AM in response to nobody loopback

Thanks for your reply.

I think I'll try the sudo dd option on the firewire case...

A couple of queries tho':

sudo dd if=/dev/rdisk2 of=/dev/null bs=10485760 conv=noerror,sync


why "rdisk2" rather than "disk2"?
why bs=10485760?? I have seen other discussions where the blocksize was set to 512 (like in your second example)... That's quite a difference! Your telling dd to copy to nowhere right (/dev/null), just to check the intergrity of the disk, but why the enormous blocksize?

However, if the process finishes without error messages, try Disk warrior on the drive.


I don't have DiskWarrior (but I'll get it) what is it? Which function in particular will I have to try?

The PC-compatible option is possible but complicated. What about the piping to a gzip file? Does that sound like a useful approach? That way I can use my (smaller) LaCie drive as a target... Assuming the Oxford drive is not utterly hosed, then I can try to reformat and reuse it before moving everything definitively to the LaCie...

And what about the partitions? Not a problem?

Thanks,

Colin

Oct 23, 2005 4:39 AM in response to Colin Harrison

The rdisk device is the "raw" disk device - if you like, look it up in the apple dev pages. DD is unlikely to operate on the "disk" device.

I suggest the larger block size to increase the speed of the copy. If really want to copy your disk and not only check for defects, I would use a block size of 512. You can use a larger blocksize even if you copy the disk, but I think you might get less detailed error messages about the unreadable blocks.

Disk Warrior will repair filesystem defects. If your disk has no bad sectors, this is the state of art software for filesystem repair: ( http://www.alsoft.com/ )
You might consider to make a copy to another disk even when you use diskwarrior for safety reasons, but I never saw that diskwarrior made the situation worse. The program will stop if the disk cannot be repaired safely and, if you are lucky even might mount the damaged filesystem so you can copy your data.

Using gzip to compress the image is possible. However you then cannot manipulate or repair the gzipped image unless you copy it back to a disk. Also, it takes additional time to compress the data.
Disks are dirt cheap.
And like Nils suggested, you might need a spare disk anyway if you want to have the option to redo a repair or try other methods.

If you copy an rdisk device, all information including paritions will be copied.
If you make a copy to a larger disk with dd, the larger disk will be truncated to the size of the original disk. There is no easy way to get access to the additional capacity without reinitializing the disk.
However, you dont need to make a copy to a physical disk:
sudo dd if=/dev/rdisk2 of=/mydirectory/myimage.dmg bs=512 conv=noerror,sync
will make a perfect disk image, which you can mount, repair and check with apples disk utility to diskwarrior.

Oct 23, 2005 9:34 AM in response to nobody loopback

OK, Nobody

Thanks again for your advice.

I carried out the sudo dd check (writing to dev/null) and it executed without error, which means (if I understood the point of doing that) that the disk itself is OK.

I have procured DiskWarrior, run it (on the FW box), and it says it cannot rebuild the directory because the file system is unsupported. That seems to be all she wrote for DiskWarrior... A little disappointing really...

Can I take the conjunction of these two results to mean that the problem is probably the FireWire bridge? This would mean that my only hope now is getting the drive out of its FW shell, and into my G4, as you explained earlier.

So, how can I find out if my machine is capable of handling drives greater than 120G? (And what can I do if it isn't?)

I think I'll go ahead and gzip the Oxford onto my LaCie drive, just in case my tinkering with the Oxford makes the situation worse...

Oct 23, 2005 10:00 AM in response to Colin Harrison

Is it possible, there is a FAT filesystem on this disk ?
What does the apple disk-utility tells you about the disk.

Or, what does "sudo pdisk --list" tell about the partitioning of the disk.

I dont think, the FW bridge causes the trouble. If you were able to dump the disk to /dev/null, most likely only the filesystem is in trouble.

Making a backup of the disk prior to any repair attempts is a good idea!

about the 128GB limit, from http://www.speedtools.com/ATA6.shtml, they have a driver which overcomes this:

"The Intech ATA Hi-Cap Support Driver software was created to allow the use of extended capacity ATA drives (drives greater than 128 Gigabytes in size) on older (Pre-Mirrored Door) G4 and G3 Macintoshes running MacOS X versions 10.2 and later. Without this software installed, any extended capacity drive which is connected to the native ATA bus on older Macintosh models will be limited to only 128 Gigabytes. Later model G4's and all G5's do not suffer from this limitation."

Oct 23, 2005 11:40 AM in response to nobody loopback

I wanna say, I really appreciate the time you're taking to help me out here.

I'm currently running this:

sudo dd bs=512 if=/dev/rdisk1 conv=noerror,sync | gzip -1 > /Volumes/LaCie/recover.dmg.gz

which looks like its gonna take a while (1h15, and the gz file is at 2Go...)

Ran pdisk, and the return was fine for my boot drive and for the LaCie disk, but curiously the Lacie is "disk3"... I only have two external drives connected...

Anyway, pdisk told me (after a full listing for the boot volume and the LaCie drive)

...
pdisk: No valid block 1 on '/dev/rdisk1'
pdisk: No valid block 1 on '/dev/rdisk2'

I don't understand why it thinks there are two drives here. There's only the Oxford (and it has more than two partitions...) Curious.

Thanks for the ref to the InTech ATA driver!

Oct 23, 2005 11:52 AM in response to Colin Harrison

Maybe, it tries to find something one the CD/DVD drive but fails since pdisk cant talk to the drive or there is no media in it ?

If you get bored by the long time the copy process is taking, you might start from the beginning and use a larger block size, like 10MB - but it should be ( i am not shure what happens if not) a multiple of 512 bytes. I did this too and the resulting copy was fine.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Using "dd" restore an unreadable volume: Help!

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.