Need to recover data from a corrupted hard drive

[blackdogdeek]

hi everyone,

my mother's pc bsod and she asked me to try to get some documents off of it. i was able to get a significant amount of her data off of the hdd by hooking it up to another pc via a pata-usb cable but the entire Documents and Settings directory (where the bulk of her important docs resided in her My Documents folder) kept generating a corrupted data error when i tried to access it.

is there any software solution for getting the maximum amount of recoverable data out of that folder? if not, does anyone have any recommendations for services that can get the maximum amount of recoverable data out of that folder?

thanks in advance!

 

[Blain]

Free data recovery software, paid recovery software, what's the budget for a data recovery service?
Basically, how valuable (to you and your mom), is the data you're trying to recover?

I'd suggest you clone the HD as soon as possible. Work on recovering data from the clone and save the original in case you decide to send it off to a service.

 

[dave_the_nerd]

It's probably one or two goofy files, or maybe a permissions issue - I run into that kind of thing all the time when backing up "dead" PCs, and the HDDs usually check out fine afterwards.

Just copy a few files at a time, see how far you get.

 

[blackdogdeek]

It's probably one or two goofy files, or maybe a permissions issue - I run into that kind of thing all the time when backing up "dead" PCs, and the HDDs usually check out fine afterwards.

Just copy a few files at a time, see how far you get.

i copied everything in folders i was able to access. however, i was not able to access the Document and Settings folder. without knowing the exact names of files in there, how would i go about copying the files out of there?

 

[blackdogdeek]

Free data recovery software, paid recovery software, what's the budget for a data recovery service?
Basically, how valuable (to you and your mom), is the data you're trying to recover?

I'd suggest you clone the HD as soon as possible. Work on recovering data from the clone and save the original in case you decide to send it off to a service.

i guess that's what i need to determine and let my mother know the options. i was just checking if anyone had any specific recommendations at each level.

 

[razel]

What'd I do is try my best to start your mother's PC in safe mode and copy the files off onto a FAT32 USB drive. That will strip out the permissions. If that fails, I'd find the OS CD/DVD and boot off that to attempt and copy the files. Otherwise you'll need to grant permissions.

You can right click the folder and grant the group 'EVERYONE' full control. Sometimes you'll need to dig down to the owner tab and change it to the current user you are logged in as before you can even change things. Do remember to always start at the folder level and apply it to ALL CHILD objects (files and folders). It also helps to always close all windows of explorer after making permissions changes.

The other way is to rename your computer to the same computer name as your mother's PC copy the files onto another FAT32 formatted drive.

 

[blackdogdeek]

thanks! i'll give those a try.

 

[unokitty]

hi everyone,

my mother's pc bsod and she asked me to try to get some documents off of it. i was able to get a significant amount of her data off of the hdd by hooking it up to another pc via a pata-usb cable but the entire Documents and Settings directory (where the bulk of her important docs resided in her My Documents folder) kept generating a corrupted data error when i tried to access it.

is there any software solution for getting the maximum amount of recoverable data out of that folder? if not, does anyone have any recommendations for services that can get the maximum amount of recoverable data out of that folder?

thanks in advance!

If your mother's machine runs Windows, I've had good luck recovering files from damaged hard drives by booting the drive under Linux. And then copying the files onto a USB stick.

If you don't have convenient access to a Linux machine, you can use a distribution that boots from a CD. Many people like Puppy. Though SysRescue and Trinity probably have more features.

Linux works well in these situations because its default behaviour is different than Windows. Specifically, when Windows runs into something it doesn't expect while accessing a hard drive, it just gives up. In contrast, Linux will try to access the hard drive regardless.

Best of luck,
Uno

 

[blackdogdeek]

If your mother's machine runs Windows, I've had good luck recovering files from damaged hard drives by booting the drive under Linux. And then copying the files onto a USB stick.

when you say booting the drive under linux do you mean mount the drive on a linux box? ie - connect it to the mobo as another drive via ide on my linux box?

 

[Blain]

Probably connecting the HD to a machine and booting from a live Linux CD.

 

[mv2devnull]

Yes, he means mounting the filesystem(s) of the drive (or preferably of a clone of it) with Linux. The "Linux box" can be either a PC with installed Linux or Live / Rescue Linux booted and running from CD / USB. The drive can be physically connected via PATA / SATA / eSATA / USB / whatever.

I'd suggest you clone the HD as soon as possible. Work on recovering data from the clone and save the original in case you decide to send it off to a service.

This. A raw block device level copy ('dd' without mounting filesystems from the source), not a file copy. Every time you access "files & folders", you probably write to the drive. You do not want to write to corrupted/broken drive. Once you have a raw copy (preferably copies), you can work on those -- they are "expendable".

 

[unokitty]

when you say booting the drive under linux do you mean mount the drive on a linux box? ie - connect it to the mobo as another drive via ide on my linux box?

As a couple of posters have observed, yes.

Just connect the drive back to a compter (ide is fine). And then, boot that computer with one of the liveCDs that I mentioned in my post. (Likely, you will have to go into the BIOS and move the CD-ROM up in the boot order so that it attempts to boot from the CD-ROM before the hard drive.)

If you are not familiar with Linux, I would recomend that you use Puppy. Here are links to a couple of file recovery articles that use Puppy.

One article that describes the process.

Another more technical article.

Best of luck,
Uno

 

[Compman55]

1.) Use manufactures utility to try and restore bad sectors.
2.) Use third party software to try and recover.
3.) Decided if a professional solution is within budget. If not step 4.
4.) Wrap with paper towels, place in ziploc bag and allow to be in freezer for 6-12 hrs. Remove and power up, get the most important stuff first as it only lasts about 15 minutes. If it is to cold, it will need to warm up slightly before it will begin to read. That is usually when the 15 minute margin begins.

I have done many of them that had read errors. I was able to get all of them to read. However the second time I did it, the hard drive was done for. So its like a one time shot.

 

[blackdogdeek]

This. A raw block device level copy ('dd' without mounting filesystems from the source), not a file copy. Every time you access "files & folders", you probably write to the drive. You do not want to write to corrupted/broken drive. Once you have a raw copy (preferably copies), you can work on those -- they are "expendable".

i've never done this before. is dd the command i'd run from the linux command prompt?

my apologies for my ignorance.

thanks!

 

[murphyc]

Yes dd is run from linux. Just make really really sure you get the if=<drive> and of=<drive> correct. The of= drive is the one that's going to be WRITTEN to. If you get them reversed, you'll toast the wrong drive. Linux does not ever ask if you're sure you want to do something, it just starts doing it.

During the dd, if you periodically (in a separate terminal window) run dmesg, you will see if the disk is reporting read errors. If so it's a decaying or dying disk. If there aren't read errors, it may report errors related to file system corruption, in which case after you've made your dd copy (sector copy), you can unmount the disk and attempt to repair the file system. Then make another attempt to access the folders/files that were giving you a hard time before.