Data recovery

[stevo1210]

80% of the time, I can recover data from hard drives that are infected with viruses or similar. But 20% of the time I can't. Like for example, yesterday a friend of mine bought in her IBM Thinkpad R51 for repairs as it wouldn't load Windows XP. Everytime the OS was loading up, a BSOD appeared saying "UNMOUNTABLE_BOOT_VOLUME" and then nothing would happen until it was turned off, in fact there wasn't even a "Windows XP splashscreen", it just jumped directly to the BSOD and that was it.
I removed the hard drive and plugged it into my desktop PC using a converter and the desktop PCs wouldn't read the data on the hard disk. It just simply said the disk was unformatted or at times, had an "I/O error".
Funnily enough, when I put the Windows XP CD in to reinstall Windows, it simply said that the file format system of the disk was "Unknown" and that was it, this meant it was neither NTFS or FAT32.
I think in this case the MBR has been damaged or something has become corrupted. She didn't bother to back up her data, but had to face the fact she lost everything and that the only thing I could do was reformat and reinstall Windows on the laptop. Using a live Linux OS (Knoppix) on the laptop and trying to access the data also failed.
What worries me now is that I have another 3 clients which have a similar issue to what my friend has, a BSOD when trying to start up; and they too want thier data back.
Is there any way to get the data back? because I've tried my best and I can't get the data back. Let this be a lesson to my clients about the importance of data backup.

Thanks.

[i4004]

Re: Data recovery

>She didn't bother to back up her data, but had to face the fact she lost everything and that the only thing I could do was reformat and reinstall Windows on the laptop

uh stevo.
chkdsk /p
run from the recovery console is what you do first on such errors.

http://support.microsoft.com/kb/555302
you can do /r if you have time....as it can be slow.

mbr can be fixed too.
http://askbobrankin.com/fix_mbr.html

you should of asked first.

[stevo1210]

Re: Data recovery

>She didn't bother to back up her data, but had to face the fact she lost everything and that the only thing I could do was reformat and reinstall Windows on the laptop

uh stevo.
chkdsk /p
run from the recovery console is what you do first on such errors.

http://support.microsoft.com/kb/555302
you can do /r if you have time....as it can be slow.

mbr can be fixed too.
http://askbobrankin.com/fix_mbr.html

you should of asked first.

I tried the recovery console technique as well, no go. It didn't work at all and it restarted as soon as I entered the recovery console. One hell of a problem this is.... never encountered such a bitchy situation.

Anyway.... I haven't formatted the laptop yet because I've been a bit busy today so I've left it as is and I haven't installed any OS or anything yet.
Um, in regards to data loss, I did as kher and she was OK with it. But albeit to that, If I can recover the data then I get more cash for the repair, which is what I want at the moment.

and that the only thing I could do was reformat and reinstall Windows on the laptop

Hmm.... should have phrased that better, it sounds like I've already formatted the laptop when I haven't done anything yet....

"the only thing I can do now is to reformat it and reinstall Windows.... but haven't been bothered to do so because I'm currently in bed about to take an afternoon nap", there now that sounds better.

Thanks.

[momaka]

Re: Data recovery

Ok, I have and idea, but I'm not sure it will work. Perhaps someone with more knowledge here can confirm this.

So, maybe if you do a Quick Format, say NTFS (if her laptop is fairly new and has had Windows installed from the factory, chances are that it was NTFS formated) and then use some type of software/tool to look for deleted files (there are many free ones on download.com) and recover them, you might be able to get some of her data back.

But again, this is just an idea.

[jpdoe]

Re: Data recovery

There are programs designed to guess how a hard drive was partitioned and formatted, and try to recover the files present on those guessed partitions.
The one I've used a few times is rstudio 3
I'ts quite good. To run it, you connect the hard drive to recover to a functioning system which has winxp and rstudio installed on another drive. Then use rstudio to detect how the source drive was formatted. You are usually presented with several partitioning options, and decide which is the correct one by looking at how many files are being detected on those possible partitioning schemes. Finally, you tell the program to recover the files to the other hard drive on the system (the one with windows and rstudio).
The number one thing to have in mind when recovering files is never, never, never modify the source hard drive in any way before you succeed in recovering the files you want.

[i4004]

Re: Data recovery

>I tried the recovery console technique as well, no go. It didn't work at all and it restarted as soon as I entered the recovery console.

you tried what?
how did you try it if you couldn't enter it?
and if you can't enter console why are you thinking about hdd at all.
why not check psu, cpu for overheating, ram etc.

[bgavin]

Re: Data recovery

OnTrack Professional software will probably do it. The price is not for the faint of heart. I do data recovery as part of my services, and customers pay for the privilege.

Data recovery is pricey work. If the customer balks, direct them to OnTrack in Minnesota. They charge at least $100 to look at the drive, just to give you an estimate. You plug the drive into an internet capable machine, and they install an Active-X control and recover the drive through your workstation.

The bill is usually $6,000 or so. I've seen the bill go as high as $22,000.

[Paul S]

Re: Data recovery

Linux Pro Magazine recently had an issue devoted to hard drive forensics (Aug 2008). One of the articles was "Investigating Windows systems with Linux" Here is a link to a PDF version of that article:
http://www.linux-magazine.com/w3/iss...ws_Systems.pdf

Another article in the same issue dealt with recovering deleted files. Some of the tools used may be of use in this case.
http://www.linux-magazine.com/w3/iss...remost_Web.pdf

It refers to two programs Foremost, and a derivative of it called scalpel. Here is some info on using them in Ubuntu.
http://www.ubuntugeek.com/recover-de...in-ubuntu.html

That's a lot of reading to do, so enjoy. I hope it helps you out.

[i4004]

Re: Data recovery

if it's the real hdd hardware problem he needs tools he can't find/afford (those include special pci cards that help troubleshoot the hdds, special programs and knowledge to use them...it's not really that easy to edit hex files manually etc.).
in such cases no kind of software (win or linux) helps because hdd is just not talking to hardware anymore. you first need to fix that link to be able to rescue anything.

i had exactly same errors that chkdsk was solving.
but it seems he can't do chkdsk from recovery console and that points to some other cause, not the hdd(recovery cd is not loaded to hdd, but to ram).

in that sense, buying expensive software or reading about linux tools...is productive in what way?

>Data recovery is pricey work. If the customer balks, direct them to OnTrack in Minnesota.


he's from australia. you think the whole continent doesn't have hdd recovery service of some sort?
and hdds are sent to those when they're dead, like "bios doesn't recognize them" type of dead.
this hdd is obviously reading the mbr, but can't read the filesystem.
it probably got damaged because of forcefull shut down, mainly happens when power goes down and user had no ups etc.
and then you do chkdsk /p first.
if you can't do it, you see why you can't do it, ie what piece of hardware is preventing booting to recovery console.
at least that what makes most sense to me.
anybody has better idea?

[Paul S]

Re: Data recovery

First, I didn't reply to YOU. I will NEVER reply to any of your posts, because you are just a negative motherfucker!

[i4004]

Re: Data recovery

this reply is as usefull as any of your linux tips when you push them in threads about explicit windows problems.
in thread about dvd ripping you mention linux(what will user do install linux just to rip dvds)?
here you mention linux after stevo said knoppix didn't help him at all.

yeap, me negative(for trying to help with windows tools) and you positive for brining us the easy world of linux command line etc.

>I will NEVER reply to any of your posts, because you are just a negative motherfucker!

you just did reply, you moron(note i never insult first, will reply to insult, though).

oh yeah, i will take time to repeat two questions, just for you
"in that sense, buying expensive software or reading about linux tools...is productive in what way?"

"at least that what makes most sense to me.
anybody has better idea?"

ie the issue is not if i'm motherfucker or not(or if you're a dumb linux pimping bastard or not), but what do we do to help stevo.
so far you produced linux pdfs and he doesn't even have a linux to put that on.
now if he does it(installs linux) and your pdfs help him and he solves it, all the respect to you.
(btw. did YOU read any of that at all? it deals with finding data on functional windows disks. not those that have filesystems errors....)

[stevo1210]

Re: Data recovery

>I tried the recovery console technique as well, no go. It didn't work at all and it restarted as soon as I entered the recovery console.

you tried what?
how did you try it if you couldn't enter it?
and if you can't enter console why are you thinking about hdd at all.
why not check psu, cpu for overheating, ram etc.

I entered the recovery console at that screen during Windows XP setup that says "Press enter to install Windows.... R to enter recovery console".

This is going to sound incredibly stupid but my client has back up data, yes she indeed does. But wants to torture me to back up her data because she can't be bothered getting it off her sisters computer. That's really suss if you think about it.
I managed to contact her sister and asked if I could get the data off her hard drive. She was Ok with it and was indeed surprised that her sister didn't ask her about giving her the data.... what's even more stupid is that they live in the same house, only seperated by a wall.
As for the power adaptor, I'm being tortured into using a Chinese made generic thing that won't even fit into the charging socket properly.... I have to either bend the connector to make it work or even worse, hold it in place to make it work.
In the end, I've reformatted the whole thing and reinstall XP. Dunno what to charge them at the moment, but I think $50AU would be reasonable since the stores charge at least $60-70 for a Windows reinstall.

Thanks.

[Scenic]

Re: Data recovery

hmm... a bit late... but i had the same issues ("unformatted" HDD) a while ago.

allthough it's considered as a "n00b tool", i used PowerQuest Partition Magic 7.0 (PowerQuest got bought out by Symantec, so the newer Version is labeled Norton Partition Magic 8.0, but it's actually the same thing.. just with a branding)

connecting the "unformatted" drive to a USB converter with an adapter and starting up partition magic, it immediately popped up a window saying that there are "filesystem problems on drive xyz" ...

it tried to fix this.. needed to wait a while.. and then partition magic finally came up and the partition problems were gone.

those problems occured on my private laptop with Win2k (NTFS partition) and an extra FAT32 Partition (hidden) with some private stuff (no.. not pr0n :P)
i was on the way to a friend and used my laptop while i was in the bus.
well.. i took the wrong battery (got 5 of them), and the laptop suddenly just turned off (without battery warnings) while i was preparing the software..
thats where the partition problems came from..

[bgavin]

Re: Data recovery

Stevo, you used the word "client". That puts you into the realm of "servicer" which is also "responsible party." You cannot FUBAR a client's data... simply not allowed.

If you are going to do data recovery, you *MUST* learn to use a bootable repair environment. I use BART-PE with Driverpacks. This runs on just about everything.

Booting up BART and running chkdsk against the offending volume cures a lot of ills. Some cannot be fixed with the XP version, and the only alternative is NTFS4DOS and their chkdsk replacement. This tool is DOS based and allows full NTFS device access through their bootable drivers. Neat tool, out of production, and expensive.

BART allows you to boot up with an attached USB disk, and/or network access to your data server. These are required when you have to get client data off the disk. If the disk system is in jeopardy, must have to get the user data off NOW. I've worked enough broken disks to learn you sometimes only have 1 boot left before the disk fails completely. Never count on 2nd chances.. they often do not come.

GHOST runs under BART, and lets you make a data image, or forensic image (every sector). This is a useful safety net to have if you are working on a critical disk that cannot be lost. A forensic image takes a long time to build, so I left them run overnight. Again, no second chances.

Partition Magic 8.5 on a DOS diskette, or HD formatted bootable CD is another must-have tool. There are things that PM can fix that are also beyond reach of chkdsk. Especially when your BART setup will not allow access to the disk.

The last thing you ever want to do is tinker with the disk by guessing. If you don't know what you are doing, go figure it out first. Working without a good image of the disk is like walking the high-wire without a safety net.

[Wizard]

Re: Data recovery

My motto for recovering data is WRITE NOTHING on the storage to be recovered.

That means looking at, copying, using software to enable you to do so, and there are plenty of NTFS software out there and all are payware but not outragously so (say, less than 120 or so, but one in particular is excellent at preserving directory tree. Couple I found that are not payware could not do this and poorly on recovery.

Cheers, Wizard