Data recovery from corrupted hard drive?

Factual Questions
1

During our move something happened to my PC, despite the fact that it was securely packed and transported right next to my husband’s completely unharmed PC. :confused:

Upon setting it up in our new place, my PC would not boot as the primary drive was corrupted. My 40Gb primary drive was partitioned with the OS (XP) on one partition, my media files on another, and an archive on another. I’ve since reinstalled the OS on a spare drive, but I’d like to try to recover my media files and backups if possible. I don’t care about anything on the OS partition. Then I’d like to see if I can repair the drive or trash it if it’s permanently fubar’d.

How can I find out if any data on other partitions are recoverable and how do I recover them if it is possible? I lost my entire digital music collection and most of the pictures that I hadn’t already uploaded to Picasa. :frowning: I want to at least attempt to get them back.

2

Plug it in as the PC’s secondary drive. With any luck, only the boot sector got clobbered, but the drive is otherwise OK, and you’ll be able to access your files.

If this is the case, move all of your stuff off the drive immediately, then dump it. (The old drive - not your data. :smack: )

If you’re not able to access the drive, there are commercial data recovery companies (We use Ontrack and Drive Savers here) but they charge roughly the gross national product of France to recover data. On the plus side, if you ship the drive to them, they’ll assess it for free and advise what recovery will cost, and how likely a full recovery will be. The service is expensive, but it’s amazing what sort of damages they can rescue data from. Unfortunately, it’s not possible to say “Oh, that’s a lot of money. Can you just recover my Quicken files and my address book?” - it’s usually an all or nothing proposition.

3

If you can try just plugging it into the same PC as an ordinary second drive. If that doesn’t work or if it interferes with the boot drive, if it’s an IDE (sometimes now called PATA) or SATA drive, you can use an adapter or external enclosure like one of these:

and plug it into the USB port on your computer. If the drive has not had a hardware failure and the other partitions are not corrupted as well, you should see the data on the other two partitions and be able to copy it to your new drive or some other drive or backup media.

In either case, if the other partitions are corrupted as well, you can try something like SpinRite;

to recover.

Otherwise, there are data recovery services who may be able to get data even off a failed drive, but plan to spend between $300 and $1500.

4

On preview, I saw that was gonna say the same thing as gotpasswords and RJKUgly, so I won’t repeat it. Just wanna wish you luck. It sucks losing data. Just so you know, I have been able to recover data 9 times out of 10 by plugging it in as a second drive. I hope it works for you.

5

I’ve was successful with iRecover. It’s $79.95 but you can try it for free on one folder to help you decide if it’s worth buying. You would still need to do what others are suggesting and get a computer booted with this drive connected as a secondary drive. I guess iRecover deals with corrupted data and directories etc but I don’t think it helps with bad blocks on the disk. Spinrite might help there.

Good luck!

6

Forgot to ask earlier - is the drive making the usual happy drive noises - whirring and what I can only describe as scribbly noises of the heads seeking tracks, or is it grinding, squealing, repeatedly ticking, etc.?

7

New info (second-hand):

Husband is telling me “it can’t be recognized as a drive - slave or master.” It isn’t detected at all, he says.

8

[QUOTE=gotpasswords]
Forgot to ask earlier - is the drive making the usual happy drive noises - whirring and what I can only describe as scribbly noises of the heads seeking tracks, or is it grinding, squealing, repeatedly ticking, etc.?
[/QUOTE]

He says it spins, but the bios doesn’t recognize it as a drive.

9

So, I decided to try it myself (despite the fact that I am not a hardware geek) to satisfy my tendency to never accept ‘no’ for an answer.

I installed the 40Gb as a slave and the BIOS recognized it. Unfortunately, with the 40Gb installed, Windows on the 8Gb will not boot up. The XP pre-screen comes up and then it just goes black. Without the 40Gb plugged in, Windows boots just fine.

So now what?

10

[QUOTE=Brown Eyed Girl]
So, I decided to try it myself (despite the fact that I am not a hardware geek) to satisfy my tendency to never accept ‘no’ for an answer.

I installed the 40Gb as a slave and the BIOS recognized it. Unfortunately, with the 40Gb installed, Windows on the 8Gb will not boot up. The XP pre-screen comes up and then it just goes black. Without the 40Gb plugged in, Windows boots just fine.

So now what?
[/QUOTE]
Your problem may be that Windows is attempting to mount the damaged drive as a valid NTFS partition, and is spending an inordinate amount of time trying to access it as part of the boot-up and failing (thus the black screen). Getting an external USB adapter can help in this situation, as you plug in the drive after Windows has booted.

You could try downloading a linux rescue iso (Knoppix or Trinity Rescue) and see if you can mount the failed disk from there. It mounts read only for NTFS and has a more forgiving approach to corrupt NTFS structures, due to the reverse-engineered approach of the driver. I have done this successfully in the past, but it can be a bit technical. You could also try building a BartPE recovery disk (that boots Windows off a CD), but this will try to mount the problem disk as a read/write volume, and thus things can get a bit hairy when it tries to do things (updating the MFT$ tables, etc). BartPE does come with data recover tools, though, that can scan the disk for data structures and rebuild file data (if you are lucky).

Si

11

[QUOTE=Brown Eyed Girl]
So, I decided to try it myself (despite the fact that I am not a hardware geek) to satisfy my tendency to never accept ‘no’ for an answer.

I installed the 40Gb as a slave and the BIOS recognized it. Unfortunately, with the 40Gb installed, Windows on the 8Gb will not boot up. The XP pre-screen comes up and then it just goes black. Without the 40Gb plugged in, Windows boots just fine.

So now what?
[/QUOTE]

Data recovery software or some kind of rescue medi is in order, you need something that can read through a blown partition. We use a set of tools called active@boot that has a decent recovery tool for this type of work on it.

12

[QUOTE=Brown Eyed Girl]
I installed the 40Gb as a slave and the BIOS recognized it. Unfortunately, with the 40Gb installed, Windows on the 8Gb will not boot up. The XP pre-screen comes up and then it just goes black. Without the 40Gb plugged in, Windows boots just fine.

[/QUOTE]

This is not necessarily a problem: just leave it for 10-15 minutes, perhaps more depending upon the speed of the computer and the drive, and let Windows do its thing.

Failing that, what happens if you boot off your Windows CD / DVD? Does it see the drive? Does it see the partitions on the drive?

13

Another thought: your new drive, is it partitioned? If so, do you have a page file on D:? If so, move the whole paging file back to C:, because Windows will see the primary partition of the new drive as D: and try and place the page file there.

14

[QUOTE=Quartz]
Another thought: your new drive, is it partitioned? If so, do you have a page file on D:? If so, move the whole paging file back to C:, because Windows will see the primary partition of the new drive as D: and try and place the page file there.
[/QUOTE]

The new 8Gb drive is not partitioned. When I unplug my Maxtor slave drive that survived the move, D: becomes the CD-ROM.

[QUOTE=si_blakely]
Your problem may be that Windows is attempting to mount the damaged drive as a valid NTFS partition, and is spending an inordinate amount of time trying to access it as part of the boot-up and failing (thus the black screen). Getting an external USB adapter can help in this situation, as you plug in the drive after Windows has booted.
[/QUOTE]

It’s an IDE drive, will that still work? As I look at adapters online to get an idea of what I’ll be doing, I’m reading that IDE is not hot-swappable. (Yeah, it’s a really old drive. It is obviously time to upgrade.)

I’m attempting to use Trinity Rescue Kit, although I’m a complete Linux noob.

15

[QUOTE=Brown Eyed Girl]
The new 8Gb drive is not partitioned. When I unplug my Maxtor slave drive that survived the move, D: becomes the CD-ROM.
It’s an IDE drive, will that still work? As I look at adapters online to get an idea of what I’ll be doing, I’m reading that IDE is not hot-swappable. (Yeah, it’s a really old drive. It is obviously time to upgrade.)

I’m attempting to use Trinity Rescue Kit, although I’m a complete Linux noob.
[/QUOTE]
USB-IDE adapters handle the whole hotplug bit just fine.

If you get Trinity booted, you will need to identify the device node of the missing disk - probably /dev/hdb or /dev/sdb (if your broken drive is the second drive in the system). Then you need to work out the partition number you need to mount, probably 0 or 1.

Then mount the partition in the precreated mount point /mnt1 using
mount /dev/hdb1 /mnt1
If that works, use ls /mnt1 and cd to explore the folders. Hook up a usb drive (almost certainly detected as /dev/sda), mount it on to /mnt2, and cp files over - assuming the drive is sufficiently alive to do so.

Si

16

For data recovery once you’ve got the hard-drive recognised, this download seems about as good as it gets for free.

typo.

17

I second the earlier suggestion of SpinRite. As long as it’s recognized as an available drive to your BIOS, I think SpinRite could recover it.

18

[QUOTE=si_blakely]
If you get Trinity booted, you will need to identify the device node of the missing disk - probably /dev/hdb or /dev/sdb (if your broken drive is the second drive in the system). Then you need to work out the partition number you need to mount, probably 0 or 1.

Then mount the partition in the precreated mount point /mnt1 using
mount /dev/hdb1 /mnt1
If that works, use ls /mnt1 and cd to explore the folders. Hook up a usb drive (almost certainly detected as /dev/sda), mount it on to /mnt2, and cp files over - assuming the drive is sufficiently alive to do so.

Si
[/QUOTE]

Wow. This is all Greek to me. Bear with me; I am slow. And feel free to correct me if I get the terminology wrong.

I am running the default TRK boot with the two drives I know are working. I figured I’d get comfortable with it before I throw in a problem drive. Also, if I can salvage anything, I want to make sure the drive I move it to has integrity. Even so, I saw a lot of fails during the initialization, but I didn’t really know what to do about that. Then I ran mountallfs and now I’m doing a virus scan.

When I mounted the filesystems, I saw: “hda” “hda1” “hdb” etc.
I am assuming the third letter is the physical drive and the number is the partitions, correct? Can I also assume that “a” is the master (8Gb) and “b” is the slave (40Gb)? How do I confirm that?

After the virusscan, is there anything else I should/need to do before I plug in the bad drive? Also, if I wanted to move any recoverable files to the goof 40Gb, does it matter if I just disco the master 8Gb and leave both 40Gb drives as slaves while I’m running TRK?

Thanks for being patient with me.

19

I installed the bad hd and tried to mountallfs, it failed to mount /dev/hdb5 and /dev/hdb6:
“NTFS is either inconsistent or you have hardware faults, or you have a SoftRAID/FakeRAID hardware. In the first case, run chkdsk /f on Windows then reboot to Windows TWICE…”

(Obviously, since I can’t run Windows with this disk plugged in I’m not sure how to accomplish that. I don’t know what SoftRAID/FakeRAID hardware is. If hardware faults, I guess I’m dead in the water, eh?)

Then this:

Result of mounting:
[root@trk]: (~)y
-bash: y: command not found

What does that mean?

20

[QUOTE=Brown Eyed Girl]
I installed the bad hd and tried to mountallfs, it failed to mount /dev/hdb5 and /dev/hdb6:
“NTFS is either inconsistent or you have hardware faults, or you have a SoftRAID/FakeRAID hardware. In the first case, run chkdsk /f on Windows then reboot to Windows TWICE…”

(Obviously, since I can’t run Windows with this disk plugged in I’m not sure how to accomplish that. I don’t know what SoftRAID/FakeRAID hardware is. If hardware faults, I guess I’m dead in the water, eh?)

Then this:

Result of mounting:
[root@trk]: (~)y
-bash: y: command not found

What does that mean?
[/QUOTE]
I didn’t use mountallfs - it is probably a bash script that pipes text characters into the input buffer of some mount commands. When it failed on your partitions, a “y” character got left in the buffer after the script exited, then the “y” ended up dumped on the command line, and failed again as there is no command named y. Ignore.

I would not worry about the SoftRAID/FakeRAID message - it is a default message for when the NTFS filesystem driver really cannot get anywhere with understanding the filesystem. SoftRAID/FakeRAID systems can distribute bits of the filesystem across drives in odd ways, and the NTFS driver has no way of knowing what has been done, so it warns you and gives up.

OK, so you have had an issue with hdb5 and hdb6. Did you check any other partitions to see if they mounted?
type mount to see what mounted and where.

I’m guessing, but
/dev/hdb1 could be the factory restore partition
/dev/hdb2 could be the Windows boot partition
/dev/hdb3 could be a D: drive
/dev/hdb4 will be the extended partition container
then /dev/hdb5 and /dev/hdb6 will be additional drives. But it seems like a lot - did you have 4 drives available on the computer originally?

There is a force option to mount mount /dev/hdb5 /mnt1 -o force may work.

Of course, the drive may be totally inaccessible. Take a look at building a BartPE winXP boot disk - you need a CDRom, some space, and an XP install disk. It will be slower than TRK, and there is a bit of a risk, but it may let you repair the dodgy volumes.

Si