Data Backup and Recovery for MBR Drives
Intro:
Posts here should include discussions of Data Backup and Recovery.
Please read the RULES here before posting.
Retro Hardware and Software Topic Rules
Recovering data off legacy MBR drives
Here is an example of a recent issue of a corrupted MBR for a 2TB external USB drive caused by an XP USB installer.
This particular 2TB USB drive when the case is opened has a soldered USB so direct SATA connection recovery isn’t possible which would have been faster.
Never keep the corrupted drive connected in Windows once it’s been corrupted to prevent further corruption and lessen the chances of data recovery. Use Windows to safely Disconnect the USB drive and unplug the USB cable from the USB drive.
We’ll need a USB flash drive of at least 4GB to flash this Cloning program.
First download osfclone.1.2.1000.zip
https://www.osforensics.com/downloads/osfclone.1.2.1000.zip
Extract this contents of the zip folder and then run the file
imageUSB.exe
Make sure no other USB external drives are connected except just the Flash drive to prevent any accidents.
Once you’ve burned this program to your USB flash drive you’ve got the tool to do some cloning.
First we’ll need to hook this up to another machine to make the recovery process easier and also isolate from picking the wrong drive.
Set the USB Flash drive as the primary boot device.
Now you’ll need to connect the “Corrupted USB Drive” to an Intel USB 3.0 xHCI Port. ( I’ve tested this and gotten 100MB/sec average, 110MB Peak transfer rates so don’t accidentally pick a USB 2.0 eHCI port.)
You’ll need to connect in a USB port above or below that port you connected the “Corrupted USB Drive” a secondary USB drive of the same brand/model or a different brand of larger capacity.
So if the drive is 1TB or 1.5TB you can use a 2.0TB drive of any brand to be the target drive since you are doing an exact clone it’s a 1:1 and since different manufacturers has slightly different total capacities not exact to the same total bytes you may run into a problem if another manufacturer has less total Bytes capacity.
However I recommend you find a test USB drive of lesser capacity than the 2TB so you can isolate which drive is which and which USB port is which for better identification.
This cloning software uses Linux so it identifies drives much differently than Windows and doesn’t use a drive letter.
In the case of 2TB recovering it is a bit trickier as you will need the same exact Brand/Model as the source USB drive.
I don’t recommend storing data on drives larger than 2TB as it makes it more difficult to do recoveries and requires GPT in most cases and this method is aimed towards legacy MBR drive recovery. So you won’t need anything but Windows XP.
Second you should boot up the OS Cloning software and check which drive is paired with these Linux drive identifiers:
/dev/sda
/dev/sdb
/dev/sdc
Once you’ve figured out which USB port is attached to which /dev/sdx you need to label the USB cables so you are certain how the drives are connected and identified.
After you’ve isolated the smaller capacity test USB drive you can disconnect the drive from the USB cable taking note that you will be replacing this drive only with a replacement target drive. This is the target drive of where the clone will take place. So if you’re not careful and having marked everything down you could accidentally be cloning an empty drive onto the USB drive you are trying to recover data from.
So that’s why I’m stressing marking and identifying everything. You can even hook up another USB target drive with a different capacity than the other three just to be certain it correctly maps to the /dev/sdX that you expect it to. Reboot the system to verify the connections match your markings.
Once everything has been painstakingly verified it is time to select the Source and Target drives.
Phase 1 Begins: Cloning
The Menu Choices:
1. Select source
2. Select destination
3. Change Options
9. Execute 'dd’
You will use “1” to select the SOURCE which is your USB drive that is damaged and want the data recovered from.
Please make sure the Drive ID# 0, 1, or 2 matches the /dev/sda, /dev/sdb, or /dev/sdc that matches the “Source” drive you wish to make a clone backup.
Next use “2” to select the target USB drive that it will be cloned onto.
Once you confirm the correct “SOURCE” and “TARGET” drives are selected.
You will hit “9” (Execute ‘dd’) it will begin the cloning process. Once this starts it can take many hours to complete.
For my test using two identical 2TB USB drives on USB 3.0 ports it took 6 hours to clone the 2TB.
This is the easy part. Once you’ve cloned the drive you should make sure the SOURCE drive is marked with a label or tape so you don’t tamper with this drive and keep it safe.
Now the TARGET drive should be marked with a label so you know this is your CLONE. This is the drive we can mess with at attempting to recover your data.
Phase 2 Begins: Scanning/Recovery
http://download.wondershare.net/recoverit_full4174.exe
Wondershare Data Recovery (Recoverit) supports XP.
This is just an example of a software that will scan the CLONE drive for any files and it separates them by type.
JPG, MP4, MOV, DOC, ZIP, et cetera.
To give you a sense of how long to scan the entire 2TB it took about 26 Hours.
In an internal SATA to SATA file recovery after scanning 2TB it could take over 6 Days to complete.
For File Recovery it averaged 12GB per hour.
The unfortunate thing is this Windows recovery method doesn’t maintain the directory structure that these were in originally but categorizes all the files into types which means more work but the goal is recovering your data so that part is still satisfied.
Once the scanning of the 2TB is done you will need another drive or drives to recover the files to. Note this program doesn’t remember all the scanning that took place if you exit the program so don’t close it or you’ll spend another day scanning the recovery drive.
That sums up the process I have endured for about a week and I’m still recovering the last portion of my 2TB drive.
[Other Tips]
For DOS Recovery Methods you need to Reformat the Target Drive as FAT32.
Since Windows Disk Management forces a max of 32GB FAT32 Partition it is necessary to format a 2TB drive as FAT32 with a special tool.
FAT32 formatting program downloaded from here:
http://www.ridgecrop.demon.co.uk/guiformat.exe
Use Windows Disk Management
Create 2TB NTFS Partition
64KB Allocation Unit Size
Next Use Fat32GUI
64KB Allocation Unit Size
If anyone knows of any Windows drive recovery software that recovers files with the directory structure intact write a post.