ALTERthought Blogs

17 April 2006

Use Linux to Recover a Corrupted Windows Drive

This entry was originally posted on an earlier incarnation of this blog. It still seems to have some merit, so I have re-posted it.

So I was the unfortunate victim a harddrive hardware failure. Repeated WindowsXP CHKDSK runs did nothing to fix the problem and I came to the painful realization that I needed a new drive. Bad sectors you see. I contacted Dell, and since my laptop is under warranty, they shipped me an identical 30g drive.

OK, so now the dilemma: How to best recover? My critical data was backed up and current, but the thought of reinstalling 2 years worth of applications, development tools, setting, etc. brought me to tears.

Enter dd. The Un*x/Linux dd (’direct dump’? idunno) command can take raw data dumps from one file to another, and given that all devices in Unix are represented as files, from device to device. To put it another way, it is basically a lowlevel copy utility capable of backing up entire devices.

Here are the steps I followed to recover my system:

Formated the new drive (A) using Windows install disks. This low-level formatting remaps bad sectors and prepares the disk.
Installed drive A in my laptop as the internal drive.
Configured my laptop BIOS to boot from CDROM.
Installed the old/busted drive(B) into an external USB case, and plugged the USB drive into a free USB port on the laptop.
Booted the laptop with a Linux installation CDROM Disk 1 (RedHat WS, but it does not really matter which distribution/release)
At the ‘what do you want install prompt’, I ran ‘linux rescue’ to load a mini kernel into RAM; which drops me into a shell.
Run the following command

dd if=/dev/sda1 of=/dev/hda1 bs=1024 conv=noerror
Came back the next day and rebooted my laptop in to Windows (woo-hoo!), logged in, and _immediately_ ran the full CHKDSK on the drive.
kaPOW! We are in business.

A few notes on the above command invocation.

The basic dd form is dd if={infile} of={outfile} bs={blocksize}
In Linux, devices are accessible as files.
Our infile (if) in this case is drive A, which mapped to the first IDE device of /dev/hda1
Our outfile (of) in this case is drive B, the external USB drive. Linux distros map USB storage devices as SCSI devices, which is why we use /dev/sda1 to access the USB drive.
We specify a blocksize (bs) of 1024. I am a little unclear here as to what repesents an optimal blocksize. I errored on the size of small.
The conv=noerror option tells dd to ignore any I/O errors. This is critical, since we know we will have some, after all, our drive is shot.
Here is link to the man page for dd.