Hi, All.
First of all, apologize if this is not the correct way to post, in order to get information about ddrescue and related tools. I looked for how to post this notes but I only find this email account.
I have an external 1 TB USB ADATA Hard Drive, model CH11.
Probably because of a misconnection, it began to fail. I have bit more than 60% of the disk full of information.
At the very first beginning, the disk continued being recongnized by Windows, but loosing only its personalized name. Nevertheless, the access to data was impossible, because of a cyclic redundancy check error.
In Windows Drive Manager, the disk shows with is proper manufacturer name and says also that the driver works properly.
In Windows Disk Manager, the disk was shown as only one healthy partition. Nevertheless, the filesystem was shown as RAW.
Of course, chkdsk did not recongnize the disk.
I have tried to recover it using many tools, first trying to clone it with clonezilla, without results. Also trying to copy the data to another TOSHIBA 2 TB HDD with HDD Guru RAW Copy tool, but nothing. Also, I tried GetDataBack without success.
I boot with Ubuntu Live CD and also used GParted, but was not able neither to recover the MBR, nor the MFT (may be... because of my ignorance...).
So far, the partition is shown as unallocated in Windows. And each time I connect the disk the OS asks me to boot the disk with MRB or GBT. I have tried with both, but nothing. Trying to boot again with Ubuntu, the OS says that the disk has GBT filesystem, and advise me to use GParted.
So, actual status: I have used an hexadecimal editor and have seen that around the first 8,000 sector appear with "READ ERROR". Then, there is one sectorr which seems the MBR copy that NTFS disks always have. The next sector seems related to NTDLR. Then, I can find white sectors, then sectors "READ ERROR", and sectors with data beginning with "INDX(". I download another HEX editor and began to manually copy good sectors from my drive to the other editor, saving files with names like this: "offset_begin-offset-end". But I was not able to advance so much, and in another process the mentioned MBR probably sector was shown as "READ ERROR" (but, I have copied it in the previous step).
Finally: I discovered these tools....
dd
ddrescue (with lzip and lziprecover)
ddrecuelog
rescue-remix
ddrutility
ddru_findbad
ddru_ntfsbitmap
ddru_ntfsfindbad
osforensics
bootmed
bootmedplus
Roadkil's Unstoppable Copier
So, I feel that the only thing I have done well was not writing anything to the disk.
Unfortunately, I did not know, till yesterday, that damaged disks become worse every time we try to boot them.
So, I understand now what I should have done from the beginning: trace a plan to recover my disk.
So, PLEASE: SOS, SOS, SOS, SOS!!!!
Give me, please, all your advises, and correct all what I will write here below.
1. I understand that my previous step would be carefully reading the GNU ddrescue tutorial.
2. But I am a bit confused which tools I should use and which not; and in which order I should use them.
3. I guess that, may be, my first step with the disk should be running ddrescue in reverse mode.
4. Then, use ddru_ntfsbitmap to create a second domain and use it with ddrescue.
From here onwards, I do not know what to do. Honestly, I need to read once and twice the documentation.
All your help will be very much appreciate!!
Thanks a lot in advance and best regards!
Karol.