A friend of mine sent me an MMS the other day with a picture of the infamous Microsoft blue screen of death (BSOD) and blames his wife of a malware infection while surfing for Elmo videos for their 2 year old son.
Having established the premise for the post, my friend lent me his drive in my request to help him recover his personal files before he reloads his operating system of choice. Assuming malware caused the BSOD, I would extract his user files onto another medium and return the corrupt drive and his files in a days time. Done deal. Easy. Hell, I was going to acquire an image and see if I could find the malware for fun (because that is how we learn, no?)
This post will walk-through how I recovered my friend’s data. If this post helps one person other than myself, it will have achieved the goal. Otherwise, I’ll use this post to refresh my memory when I do this again.
Using a drive duplicator, with USB 3.0 output, I connected my friend’s SATA drive to a Linux box running a lubuntu distro and connected a spare external to another USB interface. To copy the data over, I decided on using ‘rsync‘ from the command-line interface (CLI).
FriendDrive volume of interest: /dev/sdd3 mounted as /media/jc0re/8A54DE6254DE5095
SpareDrive volume for use: /dev/sdc2 mounted as /media/jc0re/JC0R3
^^ This stuff was all automatic upon plugging in the drives but listed for reference
Using rsync to copy the entire user profile, we use the following:
sudo rsync -va –progress /media/jc0re/8A54DE6254DE5095/Users/GoodFriend /media/jc0re/JC0R3/GoodFriend
After about 15 minutes, I start seeing “file has vanished: /location/of/file/being/copied/here”
Looking back over the progress, (hence “–progress” parameter in the initial command), I see multiple “Input/output error (5)“. I also notice the volume is no longer mounted and the drive is no longer recognized. I repeat the rsync several times and the same results. Without too much more thought, I’m going to assume this drive is going bad and the I/O errors might be why Microsoft is throwing BSODs while watching Elmo. It could also be a bad wire.
With the drive failing and disconnecting when trying other various means to copy the data to no avail, I move the focus onto recovering what I can with a tool called dd_rescue. I “sudo apt-get install gddrescue” to get ddrescue on my box for a raw image of the GoodFriend drive. After install, I follow the ForensicWiki ddrescue reference on trying to get the data.
Before proceeding, I ran into a format error and was limited to a 4096MB image file causing ddrescue to stop. Make sure the drive is formatted in something other than FAT because it will not support an image larger than 4GB. I used this link for refreshing myself on fdisk commands.
sudo ddrescue –no-split /dev/sdd3 /media/jc0re/JC0R3/GoodFriend logfile
^^ This simply tries to grab what it can from the drive. I was able to get 80MB of 500GB. Into the freezer it went.
sudo ddrescue –direct –max-retries=3 /dev/sdd3 /media/jc0re/JC0R3/GoodFriend logfile
^^ This is the first attempt to go after the broken stuff with uncached reads (we’ll cover uncached reads in a shorter post another day). I was able to get 300GB of 500GB. Back into the freezer. And change my cable.
sudo ddrescue –direct –retrim –max-retries=3 /dev/sdd3 /media/jc0r3/JC0R3/GoodFriend logfile
^^ This is the second and last attempt to go after the broken stuff but by the full sector. I was able to get 499GB of 500GB. Done. Finally.
Next Day: We have the ‘GoodFriend’ raw image on an external USB drive. Using the linux box, you can mount the image file to a predetermined mount point and examine the contents of the image as if it’s a real, physical drive. Nifty. We no longer have to worry about the physical ailments of the failing hard drive.
To mount from the console, we use this link for reference:
sudo mount -o loop /media/jc0re/JC0R3/GoodFriend /mnt/extra
^^ For the Microsoft users: In this scenario, when you navigate to /mnt/extra, you are looking at the root of GoodFriend’s hard drive. The ‘/mnt/extra‘ is simply a reference pointer.
To copy the actual user data, we need to extract them from the image file and place them onto another medium. I used the same hard drive dock from the previous post and slapped a recently wiped and formatted 500GB SATA into it. Unfortunately, the drive was formatted with my Mac and using HFS+. Linux didn’t play well and so we had to do some extra work. To mount and use the drive on the linux box, we needed to use hfsprogs, a port of Apple’s tools for working with HFS+.
sudo apt-get install hfsprogs
^^ This installed the hfsprogs package
After install, we try to remount the HFS+ drive
sudo mount -t hfsplus -o remount,force,rw /dev/sde2 /media/jc0r3/Untitled
^^ This remounts the HFS+ drive (/dev/sde2) and gives root permission to the drive
Now, we try to rsync my GoodFriend’s user profile from the image file to the HFS+ drive using a similar command from the previous attempt in the earlier post
sudo rsync -va –progress /mnt/extra/Users/GoodFriend /media/jc0re/Untitled/
This leaves me with GoodFriend’s user files for which I’ll burn onto a DVD or on a USB drive for him to restore to a new system!