Data Recovery with Ubuntu + Virtual Box on Occasion Disconnect Hard Disk

Too busy recently so just to make this as simple as possible.


One of my schoolmates brought me a failed hard disk, in which UBCD4Win also failed to boot the PC with the hard disk installed (Stopped after the Windows Logo with only the movable cursor on the screen). He needed data recovery on the important Excel files stored on the hard disk.


  1. Connected the hard disk to a desktop running Windows 7 using hot plug, after installed the drivers the hard disk disappeared from the Disk Management. Tried reinsert the hard disk but it appears on the Disk Management for a few seconds and disappeared. The hard disk was not shown on the Device Manager and my DVD drive connected to the same SATA controller also disappeared from Device Manager after reinsert.
  2. Boot UBCD4Win, stopped after the Windows Logo with only the movable cursor on the screen.
  3. Tried NTFS4DOS bundled with UBCD4Win, able to list the directory but need several second until free space is displayed for the DIR command. However failed to copy the data needed because of the unsupported Chinese characters and the missing of XCOPY command (I am not sure if COPY command works on directory. I tried to COPY a file but it just shows 0 file copied. Later I found out that the directories and files has the user privacy set).
  4. Tried Ubuntu. Able to boot up the PC successfully and able to see the hard disk SMART status. However the NTFS file system is damaged and failed to access the files. I am no experience in operating Ubuntu and the data recovery software on Linux so gave up.
  5. Tried CloneZilla to attempt cloning the hard disk to another hard disk. Failed because I cannot find raw clone. NTFS file system is damaged and showing the following screen when attempting cloning.
    Tried fsck as suggested but not working on NTFS seems. Used ntfsfixas suggested in some websites but failed as well with the following messages.

    Error on CloneZilla when Attempting Cloning

    Error Message when using ntfsfix


Common bad sector problem on the failed hard disk. What make it even worse is that when loading some particular sectors on the hard disk, it will make itself offline.

Final Solution:

Ubuntu with ddrescue for getting a hard disk image as suggested by the post on Ubuntu Community Documentation, and VirtualBox for reading the hard disk image as inspire by the post in HowtoForge.

Step 1: Create disk image with ddrescue

  1. Find the partition using Disk Utility, for example /dev/sdc1
  2. Run the command sudo ddrescue -v -r1 /dev/sdc1 st.img st.log (the command in the screenshot is a bit not correct. -nswitch should not be used in this case)

    ddrescue Command and Offline Hard Disk

  3. When discover the hard disk is offline (by watching the time from last successful read displayed by ddrescue), reinsert the hard disk (on hot plug supported mainboard, not sure what will happen if not supported.), and rerun the above command. I actually put that running for the whole night but with the -R flag on since the end of the partition has less bad sectors so the chance for the hard disk to disconnect itself is lower.
  4. Run the above command a couple of times until most of the data are recovered.
  5. The un-recovered data are actually scattered around the hard disk. By using the log file from ddrescue with the help of Excel (Need to enable HEX2DEC in Analysis ToolPak add-in of Analysis ToolPak add-in), make a script to recover the scattered data and try to avoid the sectors which may cause the hard disk to disconnect itself manually by adjusting the parameter in the ddrescue command, for example ddrescue -v -n -T -r1 -i7526M -s17M /dev/hdb1 st.img st.log

    Running ddrescue with Script for Scattered Data Recovery

Step 2: Converting disk image to VDI disk image format

Sadly VirtualBox does not support IMG disk image. To make the image available for further processing, it is necessary to convert to VDI format supported by VirtualBox. Command used: VBoxManage convertfromraw -format VDI st.img st.vdi

Step 3: Data Recovery

So finally you mount the VDI disk image to the VirtualBox and run the Windows XP inside the VirtualBox. It will prompt for disk checking during boot but please just skip it. It took me over 2 hours and still not finish the checking whereas in Windows XP, it just need 30 minutes! Just run the command chkdsk D: /F in your Windows XP command prompt! Finally after 4 nights and 1 morning of work, I found the Excel files in the hidden folder (Forgotten the exact name XD) in the checked hard disk inside VirtualBox for my schoolmate.

The disk check during Windows XP boot up is slow, really slow.

Final Words

Well at the end this article took me more than an hour to finish. Whatever. All in all this is a good experience having myself trying out on rarely used Linux platform. Hope this article also served as a guide to someone who are desperately looking for help in recovery their valuable data. But as always, BACKUP YOUR DATA REGULARLY!


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s