Jump to content

recover disk


 Share

Recommended Posts

hello

a laptop hard disk has some problem, it makes sounds and does not boot in XP (it stays in the boot screen for hours)

what can I do to safely and fully recover all the data?

i was thinking somehow (via an adapter or something) to connect the drive to another pc/laptop, then produce an image of the problematic drive, then buy a new laptop drive, load the image on it, install the new drive to the problematic laptop

is this the way to go? i am asking, because i really do not want to loose the data of that disk

thanks

Link to comment
Share on other sites


is this the way to go? i am asking, because i really do not want to loose the data of that disk

More or less yes.

Use a PROPER (dd like or forensic sound) utility, advised under Windows is DataRescue dd:

http://www.datarescue.com/photorescue/v3/drdd.htm

You need a bigger (temporary) disk, standard procedure is:

  • dd the failing drive
  • assemble (if needed) the "target image" on the "bigger" disk from the various bits
  • make a copy of the image
  • recover and check the filesystem of the image (if possible)
  • dd the image to the new drive

jaclaz

Link to comment
Share on other sites

We got that part. Jaclaz had already jumped to your "connect the drive to another pc/laptop" step. From what you describe (stops during Windows start, not before, but also makes noise) the drive will "work" but some of the data might be unreadable.

Link to comment
Share on other sites

okay, I downloaded DDRD, but it says there are 3 drives... the 3 partitions of the usb-connected drive-to-restore...

at the same time, there are also one drive with one partition of the laptop that actually runs DDRD

moreover, DDRD says that each partition is 100GB, which is wrong...

don't know what to do with this software, is there any better? or i miss something?

please note that i want to create an image of the whole disk-to-recover, including boot sectors, etc, whatever is needed in order to install this image to a new drive and have a fully functional, bootable drive with my previous data

Edited by colore
Link to comment
Share on other sites

okay, I downloaded DDRD, but it says there are 3 drives... the 3 partitions of the usb-connected drive-to-restore...

Yep :), the interface may be a little deceiving. :ph34r:

What the program is trying to tell you is that you can access:

the disk drive on which partition "D:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

OR

the disk drive on which partition "E:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

OR

the disk drive on which partition "F:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

Since your hard disk contains three partitions D:, E: and F: totaling 100 GB whichever of the three you choose you will always choose the SAME hard disk, in it's entirety.

jaclaz

Link to comment
Share on other sites

  • 2 weeks later...

okay, I downloaded DDRD, but it says there are 3 drives... the 3 partitions of the usb-connected drive-to-restore...

Yep :), the interface may be a little deceiving. :ph34r:

What the program is trying to tell you is that you can access:

the disk drive on which partition "D:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

OR

the disk drive on which partition "E:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

OR

the disk drive on which partition "F:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

Since your hard disk contains three partitions D:, E: and F: totaling 100 GB whichever of the three you choose you will always choose the SAME hard disk, in it's entirety.

jaclaz

the total hard disk size is 80GB or 120GB I think, but definately not 100GB, so... shall I continue selecting any of the options? will it result in recovering the full hard disk?

also, what will I have to do next? can I burn the image to partition of the hard disk of my desktop pc disk and then boot from that partition? what are the steps to do this?

thanks

Link to comment
Share on other sites

the total hard disk size is 80GB or 120GB I think, but definately not 100GB, so... shall I continue selecting any of the options? will it result in recovering the full hard disk?

also, what will I have to do next? can I burn the image to partition of the hard disk of my desktop pc disk and then boot from that partition? what are the steps to do this?

thanks

NO. :(

Just create the image.

Then, we'll talk about (hopefully) recovering DATA from it.

You DO NOT attempt booting from that image, and more generally you NEVER attempt booting from anything you want to recover DATA from.

Rest assured that the size Drdd shows is the actual size.

Anyway, just do the image, then we'll see what it comes in it.

jaclaz

Link to comment
Share on other sites

what's the next step?

Ideally - if you ave enough space available, you should now make a copy of the image (and leave it alone)

Then, get TESTDISK:

http://www.cgsecurity.org/wiki/TestDisk

Read a bit about it's usage.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

http://www.cgsecurity.org/wiki/Data_Recovery_Examples

Run it as follows:

testdisk_win /log X:\my_path\image[0-100027630080].dd

Change "X:" and "my_path" to your actual values. ;)

Se if you can list files on the partition(s).

Copy them to another disk.

Once you have the files safe we can try to "fix" the damaged filesystem.

jaclaz

Link to comment
Share on other sites

what's the next step?

Ideally - if you ave enough space available, you should now make a copy of the image (and leave it alone)

Then, get TESTDISK:

http://www.cgsecurity.org/wiki/TestDisk

Read a bit about it's usage.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

http://www.cgsecurity.org/wiki/Data_Recovery_Examples

Run it as follows:

testdisk_win /log X:\my_path\image[0-100027630080].dd

Change "X:" and "my_path" to your actual values. ;)

Se if you can list files on the partition(s).

Copy them to another disk.

Once you have the files safe we can try to "fix" the damaged filesystem.

jaclaz

i got these:

http://shup.com/Shup/452488/1101130222522cwindowssy.png

next?

Link to comment
Share on other sites

the previous screenshot shows the result when i choose 'intel' partition

this screenshot shows the result when i choose 'non partitioned data' (while performing quick search):

http://shup.com/Shup/452830/1110112442.png

this screenshot is after quick search or deep scan:

http://shup.com/Shup/452843/111012925.png

what is happening? please note that when i plug in the disk via usb, WinXP succesfully recognizes the partitions

Link to comment
Share on other sites

I don't know what's happening.

Maybe the image itself has some corrupted data?

Anyway, do the following:

  • re-attach the drive to a Xp machine in a USB enclosure
  • run HDhacker:
    http://dimio.altervista.org/eng/
  • you want to save:
  • the MBR or first sector of PhysicalDrive (the PC inner hard disk is \\.\PhysicalDrive0, if you don't have other HD's the USB attached one will be PhysicalDrive1)
  • the PBR or first sector of each and every partition you can see (LogicalDrives)

Additionally, run again Drdd.

You want to save the initial part of the hard disk, starting from (if the drive was partitined under 2K/XP) sector 0 to sector 100 or (if the drive was partitioned under Vista :ph34r: or 7) from sector 0 to sector 2100. (sectors NOT megabytes)

Compress all the resulting files into a .zip archive and either attach the resulting archive to yur next post or upload them simewhere and post a link.

jaclaz

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.


×
×
  • Create New...