Need some help with lost data on external drive

UNIX macOS
1

Hi all,

I would really appreciate some assistance with some lost data on external drive. The external is a Seagate Goflex 3TB drive, Desktop hard drive | External Desktop hard drives | FreeAgent | GoFlex Desk | Seagate

The purpose of the drive is to do time machine backups to it from my mac. I also have three folders on the drive (software, movies and computer training stuff). Those are supposed to be backed up to the cloud to my crash plan account. But they aren't there; that's another story. I'm kicking myself now, because I know better.

The drive has been making some weird noises lately. It is still under warranty for another month or so, luckily. I have started the RMA process. They are shipping me a new drive, and once I get it I will ship the old one back to them. In the meantime, I need to get my stuff off that drive to another one to restore.

The drive is encrypted with file vault. So it won't allow me to mount it on a Windows system. My neighbor is a Mac guy too, so I sent him a message asking him if I can mount the drive on his system in order to see if I can see the files on his system.

As you can see from the output, there is definitely data on it, since about 26% is being used.

$ df -h /Volumes/Data/
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk4 2.7Ti 724Gi 2.0Ti 26% 94949497 271238073 26% /Volumes/Data

This shows the directories:

$ ls /Volumes/Data/
Backups.backupdb	Movies	 tmbootpicker.efi
Computer_Training	Software

This is showing the size of what's in the directories:

$ for j in `ls /Volumes/Data/`; do du -sh /Volumes/Data/$j; done
16K	/Volumes/Data/.DS_Store
168K	/Volumes/Data/.DocumentRevisions-V100
1.3M	/Volumes/Data/.Spotlight-V100
0B	/Volumes/Data/.TemporaryItems
0B	/Volumes/Data/.Trashes
920K	/Volumes/Data/.VolumeIcon.icns
8.0K	/Volumes/Data/.disk_label
8.0K	/Volumes/Data/.disk_label_2x
8.0K	/Volumes/Data/.fseventsd
8.0K	/Volumes/Data/Backups.backupdb
692M	/Volumes/Data/Computer_Training
0B	/Volumes/Data/Movies
0B	/Volumes/Data/Software
120K	/Volumes/Data/tmbootpicker.efi

So you can see that all of the above doesn't equal to the 724GB that is being used.

Am I missing something? Can anyone offer any assistance?

2

If you keep poking at your drive while it is "making funny noises" you are going to lose it completely. Make a raw dd copy if you have to, but get the contents off!

Either that, or stop poking at it until you have something to copy it onto.

1 Like
3

I agree, that I was not thinking clearly at this time.

I do have some good news to report, though. I have the drive mounted, and I am in the process of copying the data off.

---------- Post updated at 01:31 PM ---------- Previous update was at 01:08 PM ----------

I tried to manually copy the folders from one drive to another.

I tried to copy files from the failing drive to another drive. I get this error, "The operation can't be completed because the item XYZ is in use."

So then I try to open the terminal and issue this command:

$ cp -R /Volumes/Data/Software /Volumes/DATA2/

And it starts, then errors out.

So then I tried to tar up the directory. That started, then would error out.

I was going to try the dd command like suggested, but the destination disk was smaller than the amount that I had on the source disk. I am not familiar with that command, and I couldn't see how to copy a specific directory over.

So then after I was about to cry (not really...well almost), I realized that rsync would probably work.

So I kicked this off, and I got one directory to sync over to my other drive. I will do the other one now. I didn't want to tempt it, and just did the most important data first.

rsync -larP --exclude ".DS_Store" --exclude ".TemporaryItems" --exclude ".Trashes" /Volumes/Data/Software /Volumes/Data2/Software >> /Users/<snipped>/Desktop/rsync.log 2>&1
4

tar shouldn't die halfway, just continue and print warnings. GNU tar, anyway. Good luck.

1 Like
5

Maybe it wasn't an error, and more of a message. This is what I was seeing when I tried the tar:

tar: Truncated input file (needed 3256915968 bytes, only 3256910848 available)
tar: Error exit delayed from previous errors.

6

It means what it says, it had trouble reading one (or more) of the input files, as one might exepct of a dying hard drive. But it didn't actually quit, it waited until it was done to quit with error.

1 Like
7

Thanks.

I learned a huge lesson from this. And the ironic thing is that I was in the process to get all of my stuff backed up just in case. This was the last of those drives.

I'm trying to get more organized.

8

There's an app called Disk Arbitrator, install it, launch it then attach drive, app will mount it low level before OSX in read-only mode.