Large USB Disk Data Recovery

This page is about the recovery of data from large (1TB) USB disks. There aren't actually any disk drives this large (yet) so these devices are actually two 500GB IDE drives concatenated.

Someone came to me with one of these drives that had suffered a failure of its USB interface; the disk themselves were fine, but the data was needed urgently and there was no spare enclosure into which to transplant the drives.

It is possible to read these devices using the Device Mapper in Linux. This tool combines a set of block devices into a single block device by mapping sectors from one to the other. If your disks had 100 blocks each, the mapping would look like this:

In practice, there'll be a partition table at the start of the disk; to get hold of the filesystem, we'll need to ignore the sectors on the first track (typically sectors 0–63).

• Remove the disks from their enclosure and attach them to a Linux machine (let's call them /dev/hda and /dev/hdb).
• Work out which disk is which. The first disk will be the one with the partition table, so fdisk -l should be sufficient to work this out.
• Find out the size of the disk using blockdev --getsz /dev/hda. In the example below, this will be 976773168 sectors. (Each sector is 512k so this is about 500GB.)
• Assuming that there's only one partition, the filesystem starts one track in from the start of the disk, so we need to map all of /dev/hda except the first track (63 sectors), followed by all of /dev/hdb.
  Create a file, "dmtable", with the following contents:

  0         976773105   linear   /dev/hda   63
  976773105 976773168   linear   /dev/hdb   0
  

• Program the device mapper with this table:

  dmsetup create bigdisk dmtable

• You should now be able to mount the disk:

  mount -oro /dev/bigdisk /mnt

Peter Benie <peterb@chiark.greenend.org.uk>
Linux