How to use GRML to check whether a hard disk is failing
Hello, I am wondering whether GRML can help me here. I have agreed to check a computer (tomorrow) for someone as it isn't booting properly (its a windows XP computer). By the sound of it I suspect the hard disk is failing or totally failed or windows has become corrupted to the point it won't boot. So my question is, how (if) can I use GRML to check whether the HD has failed? I know that the BIOS probably will give suitable warnings, but I am visually impaired and so BIOS is inaccessible to me, GRML is good from that angle as I have a way of accessing a computer without relying on what's on it.
Thanks for any information.
Michael Whapples
Hi
Try http://grml.org/files/release-2009.10/dpkg_list or look at
# grml-tips disk
There will be other tools but I cannot think offhand. The suite of programs ntfs-3g might help. Sorry not to be more useful but I've just started my shift offshore in the North Sea. I'll see if I can dig any thing out in the morning.
Best Wishes Maurice
On 22/12/2009, Michael Whapples mwhapples@aim.com wrote:
Hello, I am wondering whether GRML can help me here. I have agreed to check a computer (tomorrow) for someone as it isn't booting properly (its a windows XP computer). By the sound of it I suspect the hard disk is failing or totally failed or windows has become corrupted to the point it won't boot. So my question is, how (if) can I use GRML to check whether the HD has failed? I know that the BIOS probably will give suitable warnings, but I am visually impaired and so BIOS is inaccessible to me, GRML is good from that angle as I have a way of accessing a computer without relying on what's on it.
Thanks for any information.
Michael Whapples _______________________________________________ Grml mailing list - Grml@mur.at http://lists.mur.at/mailman/listinfo/grml join #grml on irc.freenode.org grml-devel-blog: http://grml.supersized.org/
Thanks, some of that would be useful (I found more to do with recovering data than checking that the hardware is working fine). Thinking about it, if the hardware isn't working properly I guess I would be unable to mount the NTFS partition (is this right).
Michael Whapples On 22/12/09 18:21, Maurice McCarthy wrote:
Hi
Try http://grml.org/files/release-2009.10/dpkg_list or look at
# grml-tips disk
There will be other tools but I cannot think offhand. The suite of programs ntfs-3g might help. Sorry not to be more useful but I've just started my shift offshore in the North Sea. I'll see if I can dig any thing out in the morning.
Best Wishes Maurice
On 22/12/2009, Michael Whapplesmwhapples@aim.com wrote:
Hello, I am wondering whether GRML can help me here. I have agreed to check a computer (tomorrow) for someone as it isn't booting properly (its a windows XP computer). By the sound of it I suspect the hard disk is failing or totally failed or windows has become corrupted to the point it won't boot. So my question is, how (if) can I use GRML to check whether the HD has failed? I know that the BIOS probably will give suitable warnings, but I am visually impaired and so BIOS is inaccessible to me, GRML is good from that angle as I have a way of accessing a computer without relying on what's on it.
Thanks for any information.
Michael Whapples _______________________________________________ Grml mailing list - Grml@mur.at http://lists.mur.at/mailman/listinfo/grml join #grml on irc.freenode.org grml-devel-blog: http://grml.supersized.org/
Just a short one:
At Tue, 22 Dec 2009 18:56:24 +0000, Michael Whapples wrote:
Thanks, some of that would be useful (I found more to do with recovering data than checking that the hardware is working fine). Thinking about it, if the hardware isn't working properly I guess I would be unable to mount the NTFS partition (is this right).
Not necessarily. Mounting may work but changing a directory or reading a file may fail or take ages while the kernel log fills with read error messages.
HTH
-- David
David Maus wrote:
Just a short one:
At Tue, 22 Dec 2009 18:56:24 +0000, Michael Whapples wrote:
Thanks, some of that would be useful (I found more to do with recovering data than checking that the hardware is working fine). Thinking about it, if the hardware isn't working properly I guess I would be unable to mount the NTFS partition (is this right).
Not necessarily. Mounting may work but changing a directory or reading a file may fail or take ages while the kernel log fills with read error messages.
HTH
-- David
An easy to use tool for data recovery is photorec. It is part of the testdisk tools. " DESCRIPTION PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (Photo Recovery) from digital camera memory.PhotoRec ignores the filesystem and goes after the underlying data, so it’ll work even if your media’s filesystem is severely damaged or formatted. PhotoRec is safe to use, it will never attempt to write to the drive or memory support you are about to recover lost data from."
-BoB
Michael
salvage-ntfs is suite of recovery tools. Look also at ntfs-3g or its predecessor ntfs-progs scrounge-ntfs is another data recovery tool. dd-rhelp is a disk rescue tool pcopy will copy the raw disk image so that you can use it to rescue what you can.
You could launch the CD with "grml readonly" to minimise further damage to the disk. I have never used "grml forensic" so I don't know much about it.
Best Wishes Maurice
At Tue, 22 Dec 2009 15:33:30 +0000, Michael Whapples wrote:
Hello, I am wondering whether GRML can help me here. I have agreed to check a computer (tomorrow) for someone as it isn't booting properly (its a windows XP computer). By the sound of it I suspect the hard disk is failing or totally failed or windows has become corrupted to the point it won't boot.
IMHO the first question should be how important the data on the hard disk is. If the hdd sounds unhealthy chances are goot the it may be a mechanical defect that gets worse and destroys data simply by spinning the discs. I personally refuse to check computers whose hard disks make unhealthy noises.
If you decide to check it, my second step would be booting grml and making a backup of the drive using ddrescue.
To check the hdd I would use smartmontools that queries the internal log of the hard disk.
smartctl -a /dev/<disk>
Displays a overview over the hard disk's state. I normally check the line
SMART overall-health self-assessment test result:
and on the SMART Attributes
- 196: Reallocated_Event_Count
Physically damaged sectors are reallocated; it's okay if this happes sometimes but an increasing number of reallocated sectors is troubel ahead.
- 197: Current_Pending_Sector
Pending sectors are sectors that are marked for reallocation but can't be reallocated for some reason.
Please be aware that the attribute table is hard to interpret because what most of the values actually /mean/ depends on the hard disk manufacturer. It is for instance normal for a "Seagate Barracuda 7200.10 family" that the raw value of attribute 1: Raw_Read_Error_Rate is about 124438548 etc.
It's my practical expirience as a sysadmin that the attributes 196 and 197 are good indicators of failing hdds.
You may also start an internal self-test of the hdd (smartctl -t) -- the possible test routines depend on the hdd model but I would try a long selftest (smartctl -t long).
As I had to debug a failing hdd recently I can only stress that what ever you do you should check the SMART values occasionally. In my case I noticed an increasing rate of reallocated sectors while trying to fix the filesystem.
On the question how to check and/or fix a broken ntfs filesystem, I am lost.
HTH
-- David
On Tue, Dec 22, 2009 at 1:06 PM, David Maus maus.david@gmail.com wrote:
On the question how to check and/or fix a broken ntfs filesystem, I am lost.
I missed the original post, but if you want to check the ntfs file system, you need an XP disk. look up CHKDSK.
http://support.microsoft.com/kb/315265
Bit thanks to David for posting the hard drive checking information...great stuff!
[sorry for off-topic posting...]
Am 22.12.2009 20:21, schrieb Josh Lawrence:
On Tue, Dec 22, 2009 at 1:06 PM, David Maus maus.david@gmail.com wrote:
On the question how to check and/or fix a broken ntfs filesystem, I am lost.
I missed the original post, but if you want to check the ntfs file system, you need an XP disk. look up CHKDSK.
When you have cloned a dying hard disk with ddrescue (and were able to only copy a fraction of the information) your first choice should not be CHKDSK. CHKDSK primarily tries to restore the filesystem into a consistent state, which means that directories that are only partially readable will be completely lost completely afterwards - not very good if you try to rescue data.
When you have the disk space available, create a clone from the clone and try several tools on it (free and commercial ones). When the data is "important", buying an additional external hard disk may be worth the money (especially since it can be used afterwards, regardless whether the data recovery was successful or not). Give each tool a clean clone after having copied all the data it could rescue.
Note that cloning from a failing drive can take a long time (hours to days), cloning the healthy clone afterwards is much faster.
In the (two) cases where I tried to rescue lost data from a friend's hard disk, the commercial Windows tool "Get Data Back for NTFS" (from Runtime software) was able to rescue most of the files where free alternatives failed. There is also a trial version available that can list you the files it could rescue (and can save a small number of files so that you see it is right).
Of course, it's better to make backups and never need these tools.
Regards,
Michael
On Tue, Dec 22, 2009 at 1:49 PM, Michael Schierl schierlm@gmx.de wrote:
When you have cloned a dying hard disk with ddrescue (and were able to only copy a fraction of the information) your first choice should not be CHKDSK. CHKDSK primarily tries to restore the filesystem into a consistent state, which means that directories that are only partially readable will be completely lost completely afterwards - not very good if you try to rescue data.
yikes! I had no idea. thank you for the correction.
Note that cloning from a failing drive can take a long time (hours to days), cloning the healthy clone afterwards is much faster.
curious about ddrescue, I'm reading the wiki page now:
http://www.forensicswiki.org/wiki/Ddrescue
does ddrescue want to copy data to a hard drive of the same size? I seem to recall running into this issue with free imaging tools in the past. if not, it seems like ddrescue + netcat would make an awesome free alternative to ghost.
Thanks, I had noticed smartctl but the amount of output was a bit much at first.
Michael Whapples On 22/12/09 19:06, David Maus wrote:
At Tue, 22 Dec 2009 15:33:30 +0000, Michael Whapples wrote:
Hello, I am wondering whether GRML can help me here. I have agreed to check a computer (tomorrow) for someone as it isn't booting properly (its a windows XP computer). By the sound of it I suspect the hard disk is failing or totally failed or windows has become corrupted to the point it won't boot.
IMHO the first question should be how important the data on the hard disk is. If the hdd sounds unhealthy chances are goot the it may be a mechanical defect that gets worse and destroys data simply by spinning the discs. I personally refuse to check computers whose hard disks make unhealthy noises.
If you decide to check it, my second step would be booting grml and making a backup of the drive using ddrescue.
To check the hdd I would use smartmontools that queries the internal log of the hard disk.
smartctl -a /dev/<disk>
Displays a overview over the hard disk's state. I normally check the line
SMART overall-health self-assessment test result:
and on the SMART Attributes
196: Reallocated_Event_Count
Physically damaged sectors are reallocated; it's okay if this happes sometimes but an increasing number of reallocated sectors is troubel ahead.
197: Current_Pending_Sector
Pending sectors are sectors that are marked for reallocation but can't be reallocated for some reason.
Please be aware that the attribute table is hard to interpret because what most of the values actually /mean/ depends on the hard disk manufacturer. It is for instance normal for a "Seagate Barracuda 7200.10 family" that the raw value of attribute 1: Raw_Read_Error_Rate is about 124438548 etc.
It's my practical expirience as a sysadmin that the attributes 196 and 197 are good indicators of failing hdds.
You may also start an internal self-test of the hdd (smartctl -t) -- the possible test routines depend on the hdd model but I would try a long selftest (smartctl -t long).
As I had to debug a failing hdd recently I can only stress that what ever you do you should check the SMART values occasionally. In my case I noticed an increasing rate of reallocated sectors while trying to fix the filesystem.
On the question how to check and/or fix a broken ntfs filesystem, I am lost.
HTH
-- David
Michael
One other thing you might try.
Seagate, who now own Maxtor, have a bootable iso image (in Windows an DOS modes) available which may be of some help. It is only a few mega bytes. Go to www.seagate.com and search for Seatools. You may have to register with the serial number of the hard drive in quenstion. There is a linux legacy version also but it may only be for businesses.
Maurice
Thanks to everyone who replied. It actually turned out not to be the hard disk failing, I had misunderstood what was meant by the person when I spoke to them on the phone. It is that they are visually impaired as well and have a software package called guide, which is designed for simplicity and to lead them through all they may want to do on a computer (they are certainly not experienced with computer usage), it was that guide wasn't starting (well actually guide seems to have disappeared, but that's another matter and I should be able to deal with that).
This and some messages I have seen on mailing lists (they tend to come from ubuntu users first trying Linux) makes me wonder how much value there is in making things really simple. I know sounds controversial, but I mean by this, is it better to teach/explain computers fully to people than give them something simple to use which makes it hard for them to deal with unexpected problems due to their lack of computer literacy?
May be the above is why I like GRML, plenty of handy scripts to get things set up (eg. grml-x, grml-network, etc) but it doesn't isolate me from what is actually going on. Good work Mika and the rest of GRML contributors, its probably something not said enough mainly because good software won't get in the way and so less noticeable to the user.
Michael Whapples On 22/12/09 19:06, David Maus wrote:
At Tue, 22 Dec 2009 15:33:30 +0000, Michael Whapples wrote:
Hello, I am wondering whether GRML can help me here. I have agreed to check a computer (tomorrow) for someone as it isn't booting properly (its a windows XP computer). By the sound of it I suspect the hard disk is failing or totally failed or windows has become corrupted to the point it won't boot.
IMHO the first question should be how important the data on the hard disk is. If the hdd sounds unhealthy chances are goot the it may be a mechanical defect that gets worse and destroys data simply by spinning the discs. I personally refuse to check computers whose hard disks make unhealthy noises.
If you decide to check it, my second step would be booting grml and making a backup of the drive using ddrescue.
To check the hdd I would use smartmontools that queries the internal log of the hard disk.
smartctl -a /dev/<disk>
Displays a overview over the hard disk's state. I normally check the line
SMART overall-health self-assessment test result:
and on the SMART Attributes
196: Reallocated_Event_Count
Physically damaged sectors are reallocated; it's okay if this happes sometimes but an increasing number of reallocated sectors is troubel ahead.
197: Current_Pending_Sector
Pending sectors are sectors that are marked for reallocation but can't be reallocated for some reason.
Please be aware that the attribute table is hard to interpret because what most of the values actually /mean/ depends on the hard disk manufacturer. It is for instance normal for a "Seagate Barracuda 7200.10 family" that the raw value of attribute 1: Raw_Read_Error_Rate is about 124438548 etc.
It's my practical expirience as a sysadmin that the attributes 196 and 197 are good indicators of failing hdds.
You may also start an internal self-test of the hdd (smartctl -t) -- the possible test routines depend on the hdd model but I would try a long selftest (smartctl -t long).
As I had to debug a failing hdd recently I can only stress that what ever you do you should check the SMART values occasionally. In my case I noticed an increasing rate of reallocated sectors while trying to fix the filesystem.
On the question how to check and/or fix a broken ntfs filesystem, I am lost.
HTH
-- David
Michael Whapples mwhapples@aim.com wrote:
Thanks to everyone who replied. It actually turned out not to be the hard disk failing, I had misunderstood what was meant by the person when I spoke to them on the phone.
For the benefit of the archives (someone will probably discover this thread in a Web search while looking for solutions to hard disk failures) smartctl -a /dev/sda (replacing /dev/sda with the correct device) will tell you whether the SMART monitoring firmware in the drive has detected hardware/media errors.
As to your other question, computer literacy is always to be preferred. Knowledge is better than ignorance, and Linux is a great environment in which to learn.
participants (7)
-
Bob -
David Maus -
Jason White -
Josh Lawrence -
Maurice McCarthy -
Michael Schierl -
Michael Whapples