How to Copy Data from an Unmountable & Corrupted Hard Drive?

Immediate Safety Precautions

When a hard drive becomes unmountable and exhibits constant 100% disk activity, it often indicates that the drive head is struggling to read sectors or the filesystem metadata is severely damaged. The most critical rule in this scenario is to stop all write operations immediately. Any attempt to save new files, run antivirus scans, or defragment the drive can overwrite recoverable data.

If the drive makes clicking, grinding, or beeping noises, power it off immediately. These are signs of mechanical failure, and continued operation will destroy the platters or heads. In such cases, professional recovery services are the only viable option. However, if the drive spins up normally but simply fails to mount in your operating system, you can proceed with logical recovery methods.

Creating a Bit-for-Bit Image

The safest way to extract data from a corrupted drive is never to work on the original hardware. Instead, create a raw image file (a .img or .dd file) that contains an exact copy of every sector on the disk. This protects the original drive from further stress while allowing you to experiment with recovery tools on the image.

On Linux

Linux provides powerful command-line utilities for this task. Identify the device name of the failing drive using lsblk or dmesg | tail. It is crucial to use the correct device identifier (e.g., /dev/sdb) and not a partition identifier (e.g., /dev/sdb1).

sudo dd if=/dev/sdX of=/path/to/backup/image.img bs=4M conv=noerror,sync

The conv=noerror flag tells dd to continue copying even if it encounters read errors, filling unreadable sectors with zeros. The sync option ensures that all input data is properly aligned. This process may take a long time, especially if the drive is failing.

On Windows

Windows does not have a built-in command-line tool as robust as dd for this specific purpose. You should use third-party software like HxD (hex editor) for small drives, or dedicated imaging tools like FTK Imager or R-Studio. These tools allow you to select the physical drive and output a .E01 or .IMG file.

On macOS

macOS users can utilize the Terminal app. Similar to Linux, identify the disk using diskutil list. Then run the dd command:

sudo dd if=/dev/diskN of=~/Desktop/recovery.img bs=1m conv=noerror

Replace N with the correct disk number. Ensure you do not target a mounted volume directly, as this can cause issues.

Extracting Files from the Image

Once you have a secure image, you can attempt to recover files without risking the original hardware. There are two primary approaches: mounting the image with error tolerance or using specialized recovery software.

Mounting with Error Tolerance

In some cases, you can mount the image or the raw drive in a way that ignores filesystem errors. On Linux, you can try mounting the filesystem with the -o ro,noatime,nodiratime flags to prevent updates to access times. If the filesystem is NTFS, you might use ntfs-3g with the force option:

sudo mount -t ntfs-3g -o force,ro /dev/sdX1 /mnt/recovery

This allows you to browse and copy accessible files. If the filesystem is too corrupted to mount, skip to the next section.

Using Data Recovery Software

Run recovery software against the image file rather than the physical drive. Tools like TestDisk, PhotoRec, R-Studio, or DMDE are industry standards. PhotoRec is particularly useful because it ignores the filesystem structure and recovers files based on their signatures, making it effective for severely corrupted drives. TestDisk is better for repairing the partition table itself.

Scan the image file in these tools. They will list recoverable files. Save the recovered data to a different, healthy storage device. Do not save them back to the corrupted drive or the image file itself.

Addressing Specific Corruption Scenarios

Sometimes the issue is not just general corruption but specific structural failures. For instance, if the drive was dropped, it might still be partially readable but fail standard checks. In such cases, specialized handling is required to avoid triggering more errors. You can learn more about solutions for dropped SSDs here: Solution for Dropped SSD: No Longer Mountable or Fsck-able, but Partially Readable.

Another common issue arises when a drive disconnects unexpectedly during file operations, such as zipping files. This can leave the filesystem in an inconsistent state where it appears unmountable. Understanding how sudden disconnections affect mounted drives can help diagnose whether the corruption is logical or physical. See this guide on troubleshooting sudden disconnections: Troubleshooting Sudden Disconnection of Mounted Hard Drive During Zipping Files.

When to Seek Professional Help

If imaging fails, if the drive is not detected at all, or if you hear mechanical noises, software solutions will not work. Physical damage requires a cleanroom environment and specialized hardware. Attempting to fix physical issues yourself will likely result in permanent data loss. In these cases, contact a professional data recovery service.

Frequently Asked Questions

Can I format the drive to make it usable again?

No, formatting will erase all existing data. If your goal is data recovery, formatting destroys the filesystem structure needed to locate files. Only format the drive after you have successfully copied all important data to a safe location.

Why does my hard drive show 100% activity constantly?

This usually means the operating system is repeatedly trying to read bad sectors or resolve filesystem inconsistencies. Each failed read attempt consumes time and resources, causing the high activity meter. Continuing to use the drive in this state accelerates its failure.

Is it safe to run chkdsk or fsck on a corrupted drive?

It is risky. While these tools attempt to repair filesystem errors, they can sometimes make things worse by moving corrupted data or deleting "orphaned" files that contain important information. Always create an image backup first before running any repair utilities.

What is the difference between logical and physical corruption?

Logical corruption involves errors in the filesystem structure, such as lost cluster chains or damaged boot records, which can often be fixed with software. Physical corruption involves actual damage to the magnetic platters or read/write heads, requiring hardware intervention. Logical issues are recoverable with software; physical issues often require professionals.

Will photoRec recover folder structures?

No, PhotoRec recovers files based on their content signatures but typically discards the original filenames and directory hierarchy. You will receive a large collection of files with generic names (like f1234.jpg). If preserving folder structure is critical, use a tool like R-Studio or DMDE instead.