Before I begin: Congrats to Brian Stempin and Steve Palumbo for winning third prize at the Future of Computing Competition. Also, everyone else who participated did excellent work!
A friend recently brought me his Windows Vista laptop, which was acting up due to a malware infection. The infection was no longer present, but no programs would launch unless he ran them as administrator. I decided that the virus probably hosed his profile, and decided to just make a new one for him.
The new profile worked great, except a new symptom showed up: freezing. It was an unusual type of freeze, but one I had seen before. The system doesn’t totally lock up, but programs, windows, and menus either won’t open or will freeze. This was consistent with a failing hard drive.
In some cases, the drive is still healthy enough that you can look for problems in the event log. I couldn’t even make it that far. I decided to pop in an Ubuntu live CD and use the smartmontools package to determine the health of the drive. Within the package, there’s a utility called smartctl that will spit out all of the drive’s SMART information. SMART is a self-testing feature that modern drives have in order to help predict failure. I used smartctl on that drive, and sure enough, there were 3 attributes in the “pre-fail” category.
I told my friend to get a new drive. In the meantime, I backed up his personal files to another drive. Once the new drive arrived (same capacity), I installed it and attached the failing one to an external enclosure. I used my Ubuntu live CD again to make a carbon copy of the old drive with the dd tool. The command I used was:
dd if=/dev/sdb of=/dev/sda conv=noerror,sync
That’s instructing dd to copy the failing drive (/dev/sdb) to the new one (/dev/sda), converting errors to nulls (conv=noerror,sync). I did not specify partitions, so it does a one-to-one copy of the entire drive (except on errors). One frustrating thing about dd is it does not give you any status indicator. I dug around on the internet, and it turns out you can use the kill command to send dd a special signal while it’s working:
kill -USR1 ddPIDgoeshere
That will make dd print out how much it has copied at that point. After hitting a bumpy spot around 166GB and finally getting past it, dd finished the copy. I had an exact replica of the failing drive’s data on the new one. There was a problem with this though: the copy was damaged! I was 99.9% sure that the only damaged data was the main Vista partition, so I was able to get into Vista’s Advanced Boot Options (hit F8 before the logo shows), choose “Repair your computer” (safe mode won’t work), pull up a command prompt, and enter:
chkdsk C: /R
That does a thorough check of the Windows C: drive and fixes problems with the file system. After that, I only had to fix the antivirus (it was damaged by the initial drive failure) and the laptop was set!
Other free recovery/disk copy utilities worth noting: Clonezilla, TestDisk and PhotoRec