Go Back   Steve's Digicams Forums > Digicam Help > Memory Cards, Microdrives, Card Readers

Reply
 
Thread Tools Search this Thread
Old Jul 9, 2013, 11:35 AM   #1
Junior Member
 
Join Date: Jul 2013
Posts: 11
Default Recovering from bad SD card, my experience so far

So my boss comes in today with her Nikon D5100 DSLR, saying that after she had finished shooting a long video on it, an hourglass icon appeared that wouldn't go away. Sure enough, turning on the camera, the hourglass icon appeared. After a wait of a minute or so, the camera finally came on, but said that the SD card was corrupted.

I pulled the SD card out, a SanDisk 32GB Class 10 card, and stuck in in my Windows 7 PC. Nothing. It didn't even show up in disk manager as unformatted. I tried it using a USB card reader on my PC, same result. I tried running PhotoRec on my PC anyway, but unsurprisingly it didn't see the card.

So I then booted up a spare PC using the Parted Magic Linux LiveCD and the card plugged into a USB card reader. Parted Magic sees my card! However, browsing the card in the file manager reveals just an empty folder. So they I try running PhotoRec, Included in the Parted Magic disc. It sees the card, sees the FAT32 partition, but when I start the recovery, it gives the message "error reading sector" for every sector, and finishes recovering 0 files. Also, I notice that as soon as the recovery is started, File Manager shows the SD card slot as having "no media." I have to unplug the card and plug it back in for it to show back up again. I try running Photorec again, this time selecting the whole drive, but when recovery starts again the SD card stops responding, "error reading sector" messages in PhotoRec, and "no media" in File Manager.

So I now switch to trying ddrescue, using the guide at Forensics Wiki. I open up the terminal and navigate to a recovery folder on the harddrive. After unplugging/pluggin in the SD card, I run the following command and get the following response:
Code:
#ddrescue --no-split /dev/sdb imagefile.ima logfile.log 


GNU ddrescue 1.16
Press Ctrl-C to interrupt
rescued:     5636 kB,  errsize:  31909 MB,  current rate:        0 B/s
   ipos:     5701 kB,   errors:       1,    average rate:     939 kB/s
   opos:     5701 kB,     time since last successful read:       1 s
Finished
Again, "no media." So unplug/plug SD card, and try the next ddrescue command.
Code:
ddrescue --direct --max-retries=3 /dev/sdb imagefile.ima logfile.log
At first, this isn't recovering any additional data, as the SD card slot has quickly showed as "no media" in File Manager. However, instead of quitting, ddrescue has kept going, slowing incrementing the ipos/opos. I figure that maybe if I get the card recognized again, ddrescue will pick it back up and start recovering. So with ddrescue still running I unplug/plug SD card,and low and behold, ddrescue starts recovering more data!

I'm guessing there's some really bad sectors at the beginning of the card (right around the 5701 kB mark) that are so bad they're knocking the controller offline when attempted to be read.

It's been about an hour and a half since I did that, and I'm up to 2660MB rescued of 8500MB read, at an average rate of 580 kB/s, and 61 errors. After approx another 11 1/2 hours, I plan on running it again, this time in reverse, using this command:
Code:
ddrescue --direct --reverse --max-retries=3 /dev/sdb imagefile.ima logfile.log
marsilies is offline   Reply With Quote
Sponsored Links
Old Jul 9, 2013, 11:49 AM   #2
Administrator
 
Join Date: Jun 2003
Location: Savannah, GA (USA)
Posts: 22,378
Default

Hey marsilies

I wouldn't worry about the forward/reverse thing.

If the card is showing up as /dev/sdb, and you want to use a file named imagefile.ima as your disk image, I'd just to it like this instead:

ddrescue -r 3 /dev/sdb imagefile.ima logfile.log

I'm using your file names (they can be anything you want them to be) in that example. I'm assuming that you've already navigated to the folder you want the disk image and log file saved to. Otherwise, you should supply a full path name to a mounted partition. For example, something like this (assuming you have a mounted partition at /mnt/sda3 (3rd partition on first drive) that you want those files saved to):

ddrescue -r 3 /dev/sdb /mnt/sda3/imagefile.ima /mnt/sda3/logfile.log

Sometimes temperature will impact a failing component. So, you could unplug the card reader, let the card cool off for a while, then restart the process again. Just use the exact same command next time.

That way, ddrescue will only try to read the blocks it hasn't already copied OK so far in order to "fill in the blanks".

Then, once you get the best possible copy of the source media, just run photorec against the disk image file created to get the images from it. For example, something like this (using the same image file name in your post):

photorec imagefile.ima

See my posts on the last page of this old thread for examples of that technique (ddrescue to get a good disk image, photorec to get the images from it):

http://forums.steves-digicams.com/me...ialised-3.html


There are some other options with ddrescue that can come in handy. For example, -n tells it not to retry sectors with errors to to get good blocks faster first. For example, something like this (using different names than you're using right now, so substitute the names you want to use instead).

ddrescue -n /dev/sdc /mnt/sda3/20130709.img /mnt/sda3/20130709.log

Then, you can run it again with multiple passes to try and get the bad blocks included in the disk image using a -r parameter and specifying a retry count. For example, something like this for 3 passes against blocks it didn't already read OK:

ddrescue -r 3 /dev/sdc /mnt/sda3/20130709.img /mnt/sda3/20130709.log

That's just the "short" form of the same type of syntax to make multiple passes against media. I'm just specifying specific partitions to save the files to (versus using the default location after navigating to location). There are lots of way to approach it. But, I prefer to use a mounted partition for saving the log and image files most of the time, just using the current date for their names.

You'll just need to keep the card recognized as much as possible (stopping ddrescue with ctrl+c, unplugging and plugging in the reader again) to try and get a good block by block copy of the card (without regards to what's in those sectors) so you can run photorec against the disk image file created to get the photos from it.

Sometimes temperature will impact failing components. Basically, you may be seeing sector read errors because the card is not being recognized any longer because of failing controller circuitry.

So, letting a card cool off between passes (just using CTRL+C to interrupt ddrescue and issuing the exact same commands with the same log file name again can help get a good copy faster. Just make sure the image and log file names are unique to the card copy you're making (because the log file is keeping track of what's being copied OK so far so you can make additional passes that only try to read the blocks that have not been copied OK so far). Sometimes a different PC and card reader can help out, too (because slight voltage/current supply differences via USB can impact how a failing component in a card works).
JimC is offline   Reply With Quote
Old Jul 10, 2013, 7:51 AM   #3
Junior Member
 
Join Date: Jul 2013
Posts: 11
Default

Thanks JimC for the response.

Looking at the ddrescue manual, the switches -n and --no-split are the same, while switches -r and --max-retries= are the same as well. So I think my first two commands were essentially the same as yours, just phrased differently. And yes, I navigated to a folder on the harddrive to save the files first, so that I wouldn't have to enter full paths for them.

I left the program running overnight, and when I came in this monring, this is the report:
Code:
GNU ddrescue 1.16
Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued:     5636 kB,  errsize:  31909 MB,  errors:       1
Current status
rescued:    28816 MB,  errsize:   3098 MB,  current rate:        0 B/s
   ipos:    31914 MB,   errors:     615,    average rate:     630 kB/s
   opos:    31914 MB,     time since last successful read:     1.5 m
Finished
Once again the SD card slot was reporting "no media", so I think it got knocked out when ddrescue went back to the beginning for a retry.

Running it in reverse now, the card stayed online when the program started, and now more data is being recovered. I estimate an hour and a half for this pass.
marsilies is offline   Reply With Quote
Old Jul 10, 2013, 9:14 AM   #4
Administrator
 
Join Date: Jun 2003
Location: Savannah, GA (USA)
Posts: 22,378
Default

Sometimes failing cards work better hot (as you sometimes see with a laptop's internal reader after a card has been in it for a while), and sometimes they work better cold.

Experiment both ways, as when you see a lot of steady errors without it reading any good data, the card may not longer be working or recognized. So, just interrupt it using ctrl+c and unplug it for a while, then plug it back in and restart it using the same command to see if the recovered data rate improves or not.

Of course, sometimes a card is just too far gone to get anything from it, requiring specialized services. For example, http://recoverfab.com/ is the one I'd suggest for a card like that, as they can bypass the controller electronics and reconstruct the data by reading the NAND flash memory directly.

But, because your card is still being recognized (at least some of the time) OK, and it's controller circuitry is still working to some extent, using ddrescue is the best way I've found to try and get the contents of the card (so you can use other utilities like photorec to extract photos from the disk image file of it).

It can just be very time consuming with a failing card like that. Good luck, and please keep us posted.
JimC is offline   Reply With Quote
Old Jul 10, 2013, 10:59 AM   #5
Senior Member
 
Join Date: Mar 2003
Posts: 3,196
Default

Look: http://forums.steves-digicams.com/1351960-post11.html
DonalDuc is offline   Reply With Quote
Old Jul 10, 2013, 11:50 AM   #6
Junior Member
 
Join Date: Jul 2013
Posts: 11
Default

So this recovery pass is taking longer than I thought it would.

After starting at a respectable 450 kB/s, the read rate has dropped to around 20 kB/s. However, it is still recovering data, the time since last successful read stays at 0 secs. The errsize is now down to 1204MB, and the number of errors has dropped to 239, with both of those numbers dropping every hour. If the read rate doesn't drop any lower, I expect this pass to take a further 17 hours to complete.
marsilies is offline   Reply With Quote
Old Jul 10, 2013, 4:07 PM   #7
Senior Member
 
Join Date: Mar 2003
Posts: 3,196
Default

Even 17 hours are shorter then manual puzzle for 17 days.
DonalDuc is offline   Reply With Quote
Old Jul 11, 2013, 8:33 AM   #8
Junior Member
 
Join Date: Jul 2013
Posts: 11
Default

Came in this morning, and the read rate had dropped to 4kB/s, so I stopped it. Tthis is the report:
Code:
GNU ddrescue 1.16
Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued:    28816 MB,  errsize:   3098 MB,  errors:     615
Current status
rescued:    31267 MB,  errsize:    647 MB,  current rate:        0 B/s
   ipos:     6206 MB,   errors:     127,    average rate:    27923 B/s
   opos:     6206 MB,     time since last successful read:       1 s
Retrying bad sectors... Retry 1
Interrupted by user
I started it again going forward, skipping the first 10MB, using this command:
Code:
ddrescue --direct --input-position=10485760 --max-retries=3 /dev/sdb imagefile.ima logfile.log
It's still reading at about 4kB/s
marsilies is offline   Reply With Quote
Old Jul 13, 2013, 2:24 PM   #9
Junior Member
 
Join Date: Jul 2013
Posts: 11
Default

OK, so it kept reading at about 4kB/s after that.

After letting it run for nearly 40 hours, and then running a few more ddrescue commands, I was finally able to get it to this:
Code:
GNU ddrescue 1.16
Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued:    31914 MB,  errsize:    199 kB,  errors:       1
Current status
rescued:    31914 MB,  errsize:     512 B,  current rate:        0 B/s
   ipos:     5638 kB,   errors:       1,    average rate:     3611 B/s
   opos:     5638 kB,     time since last successful read:       1 s
Finished
At the 5638 kB mark, the card gets knocked offline. I rescued nearly everything before and after it though, which to me is a good run. With only 512 B unrescued, I rescued about 0.999999983957%. Now it's on to PhotoRec.
marsilies is offline   Reply With Quote
Old Jul 13, 2013, 4:03 PM   #10
Administrator
 
Join Date: Jun 2003
Location: Savannah, GA (USA)
Posts: 22,378
Default

Great (able to read almost all data from the problem card).

You can use photorec directly against the disk image file, just by doing this (using your image file name) after navigating to the folder you saved it to.

photorec imagefile.ima

I'd use the defaults for most stuff when asked. But, I'd suggest using the "whole disk" option when you get to the partition selection screen.

That will usually be the very first option on the partition selection screen (the one that says unknown). Note the second screen on this page (Source Partition Selection).

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

That option should represent the entire card (versus a specific partition on it). It usually says "whole disk" on the right side of that selection. But, if your partition table is messed up, it may just be labeled as unknown without showing Whole Disk on the right side.

That should work fine for most problems. If you have any issues with photorec that way, you could write the disk image back to a known good card that's as large or larger than the original card instead. For example, doing something like this:

ddrescue imagefile.ima /dev/sdb

Then, you could use any number of recovery utilities to recover the images from it, without the physical sector errors you saw on the original card (since a new card wouldn't have those issues, and would only have file system errors caused by the original problem). For example, I'd probably look at utilities like http://www.piriform.com/recuva, http://www.z-a-recovery.com/digital-image-recovery.htm or even the free Transcend program that DonalDuc mentioned from http://www.transcend-info.com/suppor...ware.asp?SID=4

But, it's been my experience that photorec is as good or better than other recovery solutions anyway (especially given the large number of customization options you have for recovering data).

So, I suspect that you'll get as much as possible from the disk image file using photorec, without the extra step of writing the disk image file you got using ddrescue back to another card [writing the image file to a good card without the physical problems the original card had, so that other recovery solutions can work without "choking" due to the sector read problems present on the original failing card].

Please keep us posted on progress.
JimC is offline   Reply With Quote
 
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -5. The time now is 7:22 PM.