Dead HDD? try to recover data or destroy it?

Questions
1

Hi, I was doing some cleaning and found this old HDD. It has not been accessed for probably 15 years. It is a SATA drive. So I plugged it and while it is detected, nothing shows up. On Windows, on the disk manager it shows up as disk 0 but not initialized. When I try to initialize it, it asks for MBR or GPT partition creation or something like that. I did not do it because I think this would screw up any chances of recovering data.

I tried opening with Linux and during boot there is a lot of errors like this:

“status: { DRDY ERR }”

“error: { ABRT }”

“exception Emask”

“failed command: READ DMA”

And then when I log in, lsblk just shows the drive but no accessible files.

On “Disks”, “Assestment” says:

“Disk is OK, 11017 bad sectors”

The blue rectangle thing is just the 2TB and set as “unknown”

smartctl results:

Raw_Read_Error_Rate: 122006097

Spin_Up_Time: 0

Start_Stop_Count: 1025

Reallocated_Sector_Ct: 10295

Seek_Error_Rate: 12245207878

Power_On_Hours: 12532

Spin_Retry_Count: 0

Runtime_Bad_Block: 1

End-to-End_Error: 0

Reported_Uncorrect: 2064

High_Fly_Writes: 8235

Current_Pending_Sector: 0

Offline_Uncorrectable: 0

UDMA_CRC_Error_Count: 8

Im not a expert on this stuff but some of these error counts seem a lot. So what should I do?

I have no idea what is on this disk. There is probably some tax related documents and passwords, probably old and not relevant, but still, I would like to know. There is probably some old music that I lost on my other drive, it would be cool to recover that. Other than that, im not willing to spend money on recovery services stuff. Also back then I was not using full disk encryption, so the passwords and tax data is probably on some document. I assume you can trust these services, but I would rather not send it, plus if I have not needed this in 15+ years, then it’s probably not a big deal, so unless someone has an idea to recover this data yourself, then I guess the only way to safely discard the drive is to open it and scratch the plates and nail a few holes with a hammer on it, since I cannot do a soft format.

If anyone has any ideas to access the data if possible let me know. It cannot be the cable because I just tried another HDD and it works fine with the same cable and port.

3 Likes
2

Following. I have a number of failing drives I need to sanitize. They can somewhat boot, but partitions are faulty & running a secure wipe always fails

Short of pulverizing them into a fine power or dissolving them in nitric acid, I’m not sure how to proceed

4 Likes
3

I remember watching a video on youtube, they tried a number of methods to destroy a drive, and I think making some holes on it was enough that a recovery service was unable to get any data. So I would assume, scratching the surface, making some holes and bending it would be enough?

But I would like to recover the data if possible. I’ve seen it’s better to make an image of the drive and then use ddrescue or something like that, but I have no free space to put an image of the size of the drive.. I would need to buy a drive bigger than this drive to make the image file fit then run ddrescue.. this may be too much work already.

1 Like
4

I wish you luck, but once the actual storage hardware fails to the extent that your logs suggest, I haven’t seen much success on recovery efforts

Take this as a sign to start taking 3-2-1 backups, if you haven’t already

1 Like
5

I know someone who had success with photorec, which can restore more than just photos if I remember right, though it was over 15 years ago. It’s mentioned here:

It’s worth a try before destroying it, I didn’t think it would work for my friend at the time but it did.

1 Like
6

Tools like that can recover files that were insecurely deleted in software. They do nothing on drives you can’t read from due to failed hardware.

One of the only two ways to recover otherwise inaccessible data from a drive suffering a hardware failure is by shipping it out to a specialized lab where they will disassemble it, and even that only works under certain circumstances.

The other method is to have a backup on at least one other drive that hasn’t failed.

1 Like
7
1 Like
8

Up to you.

9

People on the reddit about datarecovery seem to not recommend testdisk for some reason, they are recommending some tool called “dmde”. Also it seems that you must create an image first. So I would need to find a bigger drive, encrypt it, then create the image, dump it there and then run the dmde thing (and testdisk too for good measure) and see what happens. Probably too much work. But also probably doesn’t work, since this drive shows i/o errors. I wasn’t even able to get a hexdump, it would just say i/o errors, so I doubt I can make an image out of it and recover it.

Do you think this looks recoverable? Like I said I will not bother with a lab, so if it does not look recoverable, it sucks but I will just smash it and make some holes on it and thats it.

1 Like
10

I mean like I already said, if you can’t read from the disk your options are to restore from backup or send to a data recovery lab. Software tools need to be able to read from the disk to recover data. If the controller isn’t sending data when you ask for it your only chance is to disassemble it and read directly from the platters to get whatever’s there, which requires a full clean room data recovery lab.

If I were in your position I would try to dd the drive and make an image (e.g. dd if=/dev/sdX of=drive.img) because it can’t hurt but if hexdump fails with an I/O error when trying to read from the drive dd probably will too. dd might be able to get some of the data first though, if you’re lucky.

1 Like
11

When using dd to create the image (dd if=/dev/sdX of=drive.img) do you need to wait for the entire drive size to be completed? or can you do like 10GB and see if there is something there?

It’s a 4TB HDD, so I assume this will be slow (if it works at all).

Could I use a live USB and start the image cloning on RAM to see if it writes something? (to test if it works because of the i/o errors).

Because to do this I would need to find a drive bigger than 4TB which I don’t have atm. So if I have to find a drive, install linux and encrypt the entire drive, then do this thing and then it doesn’t even write anything, that will be a massive waste of time.

1 Like
12

I would recommend just running it in one go because every time you read from a failing drive you are potentially causing it to fail more and you don’t know if you will be able to continue again if you stop it.

You can add status=progress to monitor as it runs. It will take a long time, yes.

You can compress the image by having dd write to stdout and piping to a compression utility as you run it, but there’s no way to know how much space that will save you in advance so you should still write to a >=4TB drive IMO just in case and I’m not sure it’s really worth dealing with the compression at that point.

Keep in mind anything you do at this point is at your own risk. Any interactions with the drive may make the issues worse and make any remaining data completely unrecoverable even to a lab.

1 Like
13

This also includes Testdisk which saved me in the past a long time ago.

1 Like
14

Honestly, this is a lot of work and I doubt there’s anything of value. I don’t really want to buy a 4TB HDD for this. I doubt you can recover anything anyway with so many bad sectors and so on. I think im going to smash it and call it a day.

If I open it, scratch the plates and pierce some holes, that’s it right?

1 Like
15

You don’t have to open or be delicate about it. Take a hammer and a huge nail/old screwdriver and hammer it through all platters ~5 times. Done.

2 Likes