TestDisk created 51% of image of almost broken disk. Can I already get data from it?

Question

I have half-dead HDD disk from WD "My Passport" purchased in 2013. He has around 260/280 GB of data inside. There are video clips (e.g. 4 GB each) and photos.

It was used to display files on Samsung SmartTV. One day disk manager saw it as RAW formatted. I used MiniTool Partition Wizard to make it NTFS again. It worked fine. The day after file transfer went reaaly slow. For the first second 30 MB/s and after that goes to 0 MB/s.

I have tried to make an image with Partition Wizard but it ended up with error box without explanation.

So now TestDisk on Ubuntu 18.04 is trying to make image since 5 days. He was making 10-13% of disk per day. But the problem is, that throughout monday it recovered only 400MB.

TestDisk is still working and there is only stop option. My question is:

Is it possible to get videos/photos from that half-made image on Linux?

Answer 1

First of all, it's good choice that you're making an image first (most people try to "repair" the HD directly and make thing much worse in the process).

No, don't stop the process. 50% does not mean that it recovered 50% of the files but rather that it trying to recover "50% of the sectors" (loosely speaking). Worst case would be that you won't be able to mount the image as a drive at all. If the data is important to you, you should definitely wait until it's finished because there is always the chance that the HD will fail completely. If that happens you might not get another chance to create another image.

The only alternative would be to create an image without trying to recover the errors on the drive this will take much less time. But this way you will most likely get worse results trying to recover you're files from the image.

Answer 2

@Albin is completely right, do not stop the progress, just wait for the image to finish.

Once you have an image of the disk, assuming you are unable to access the files the normal way, here is how you can go on about recovering the files from it (will include deleted files too):

There are plenty of recovery applications, personally I find that photorec and foremost work best. You already have photorec, foremost can be installed from the foremost package.

a) Photorec

Simply run $ photorec image.dd now to open up photorec's interactive interface.

Hit return ([Proceed]) to select the disk image. In the next screen, you're asked to select a partition. If photorec finds the correct partitions, you can select the one you want to recover the files from here. If it doesn't detect the partitions properly, simply select No partition [Whole disk] and hit return again to perform the [Search]. Once selected the filesystem type in the next screen, you need to select a directory in which the recovered files should be saved. Confirm with C.

b) Foremost

While photorec works by trying to find "data blocks" of the drive and media within using file carving, foremost does it a bit differently. It's still using the file carving concept but it ignores the type of underlying filesystem and directly works by copying segments of the drive into your RAM, which is then being scanned for file header types. Foremost comes with a lot of built-in headers to recover most types of common files, if you want to add custom headers/footers to detect less common file types, foremost offers you this ability.

To run foremost using the default options on the image, run the following command:

$ foremost -i image.dd -v

That will save all recovered files into output (new directory that foremost will create). You can specify another output directory using the -o flag, and -a to ignore errors/save corrupted files.

Optional: Filter the recovered files

This is optional, but sometimes you are only interested in specific types of files, or even worse: Recovery tools give you a million of files out of which thousands appear to be, for example, a JPEG file, but in reality it's just a corrupted file and not a picture at all. To filter these out you can use this answer I gave to another question on SuperUser.