[ale] OT: Migrating off dying HDD

[Greg Freemyer]

On 11/14/05, John Mills <johnmills at speakeasy.net> wrote:
> ALErs -
>
> I have a problem repairing a friend's MsWin Dell 'Inspiron 2600' notebook.
>
> The old HDD will only run a few minutes before it ceases to respond,
> probably due to internal overheating. I get the same results when the HDD
> is extended externally on a 'Simple Drive' PCMCIA adapter, so I really
> think it's the HDD that is causing the problem, not general internal
> overheating of the laptop.
>
> No problem installing a new drive (now done, in fact), but I foresee a
> long and painful migration of user data, even after a clean &8-) MsWin
> reinstallation from CD.
>
> The drive's current, usable half-life is far too little to transfer any
> great fraction of [say] the user's documents, etc. I get perhaps 300 MBy,
> then it clams up. Turn off, cool down, try again, and repeat ...
>
> Questions:
>
>  1. What directories should I copy first to migrate e-mail and web links
> of importance?
>
>  2. It would sure be nice to migrate the whole installation if
> I can find a suitable MS tool. Any recommendations?
>
>  3. Other than a fan, any clever ideas to keep this #$%&!! working long
> enough to dump a good fraction of its data? (I plan setting it on a
> cold-block and see if that helps.)
>
> I have MsWin and Linux both available as hosts, FWIW. I also have an
> adapter to connect the 2.5" notebook HDD to a standard PC-format IDE
> controller.
>
> Thanks for any guidance.
>
>  - John Mills
>    john.m.mills at alum.mit.edu
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>

One of the tricks of the trade is to put your drive in a freezer for
long enough to get it really cold.  Then connect it to your "capture"
computer and get a dd image as fast as you can:

dd if=/dev/hdc of=/path/to/lots/of/empty/space/dd-image conv=noerror,sync

Very often the dd will finish before the drive comes up to temp and fails.

Then mount the dd-image as a loopback device "mount -o lo dd-image"
and copy off what you want.

Greg
--
Greg Freemyer
The Norcross Group
Forensics for the 21st Century