Disk and filesystem recovery

Was asked to recover data from a SoHo NAS (Bufallo) disk. Windows had issues recognizing the partitions (now wonder as the NAS is operated with Linux). Trial was already made to use some Linux live distros (Ubuntu, Mint) in various versions to mount the data partition, with no success.

I assumed the drive had some real physical issues and decided to immediately go for a full disk imaging.

parted reported broken secondary partition table, but intact primary, so I was able to get the info about the partitioning scheme.

oogled a bit about the best way to get a disk image. dd is the tool that immediately comes to mind, but it should not abort upon read errors, and it would also be nice if the tool would perform multple retrials to salvage as much as possible of the bad blocks.

I finally came across ddrescue which seems very promising. I used following recommended commands :

  • ddrescue -f -n /dev/sdd2 dumpfile logfile
  • ddrescue -d -f -r3 /dev/sdd2 dumpfile logfile

First command took 15 hours to complete on the 1TB drive, showing 360 broken sectors. I canceled second command after 5 hours, as it showed only 40GB completion and no sector being read correctly

The dump could nevertheless not be mounted (loop device can’t be mounted read-only"). Web search suggested usage of xfs_repair command (equivalent of the fsck for XFS). Had to add the -L switch to force zeroing the logfile.

Could then finally access the filesystem and recover the data.