recover disk

[colore]

hello

a laptop hard disk has some problem, it makes sounds and does not boot in XP (it stays in the boot screen for hours)

what can I do to safely and fully recover all the data?

i was thinking somehow (via an adapter or something) to connect the drive to another pc/laptop, then produce an image of the problematic drive, then buy a new laptop drive, load the image on it, install the new drive to the problematic laptop

is this the way to go? i am asking, because i really do not want to loose the data of that disk

thanks

[jaclaz]

is this the way to go? i am asking, because i really do not want to loose the data of that disk

More or less yes.

Use a PROPER (dd like or forensic sound) utility, advised under Windows is DataRescue dd:

http://www.datarescue.com/photorescue/v3/drdd.htm

You need a bigger (temporary) disk, standard procedure is:

• dd the failing drive
  
• assemble (if needed) the "target image" on the "bigger" disk from the various bits
  
• make a copy of the image
  
• recover and check the filesystem of the image (if possible)
  
• dd the image to the new drive
  

jaclaz

[colore]

actually the drive does not boot to windows, so this does not mean that it won't work if connected in usb case, right?

[Ponch]

We got that part. Jaclaz had already jumped to your "connect the drive to another pc/laptop" step. From what you describe (stops during Windows start, not before, but also makes noise) the drive will "work" but some of the data might be unreadable.

[colore]

okay, I downloaded DDRD, but it says there are 3 drives... the 3 partitions of the usb-connected drive-to-restore...

at the same time, there are also one drive with one partition of the laptop that actually runs DDRD

moreover, DDRD says that each partition is 100GB, which is wrong...

don't know what to do with this software, is there any better? or i miss something?

please note that i want to create an image of the whole disk-to-recover, including boot sectors, etc, whatever is needed in order to install this image to a new drive and have a fully functional, bootable drive with my previous data

Edited December 13, 2010 by colore

[jaclaz]

okay, I downloaded DDRD, but it says there are 3 drives... the 3 partitions of the usb-connected drive-to-restore...

Yep , the interface may be a little deceiving.

What the program is trying to tell you is that you can access:

the disk drive on which partition "D:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

OR

the disk drive on which partition "E:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

OR

the disk drive on which partition "F:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

Since your hard disk contains three partitions D:, E: and F: totaling 100 GB whichever of the three you choose you will always choose the SAME hard disk, in it's entirety.

jaclaz

[colore]

okay, I downloaded DDRD, but it says there are 3 drives... the 3 partitions of the usb-connected drive-to-restore...

Yep , the interface may be a little deceiving.

What the program is trying to tell you is that you can access:

the disk drive on which partition "D:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

OR

the disk drive on which partition "E:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

OR

the disk drive on which partition "F:" resides (and gives you the TOTAL size of the WHOLE hard disk that contains that partition)

Since your hard disk contains three partitions D:, E: and F: totaling 100 GB whichever of the three you choose you will always choose the SAME hard disk, in it's entirety.

jaclaz

the total hard disk size is 80GB or 120GB I think, but definately not 100GB, so... shall I continue selecting any of the options? will it result in recovering the full hard disk?

also, what will I have to do next? can I burn the image to partition of the hard disk of my desktop pc disk and then boot from that partition? what are the steps to do this?

thanks

[jaclaz]

the total hard disk size is 80GB or 120GB I think, but definately not 100GB, so... shall I continue selecting any of the options? will it result in recovering the full hard disk?

also, what will I have to do next? can I burn the image to partition of the hard disk of my desktop pc disk and then boot from that partition? what are the steps to do this?

thanks

NO.

Just create the image.

Then, we'll talk about (hopefully) recovering DATA from it.

You DO NOT attempt booting from that image, and more generally you NEVER attempt booting from anything you want to recover DATA from.

Rest assured that the size Drdd shows is the actual size.

Anyway, just do the image, then we'll see what it comes in it.

jaclaz

[colore]

ok, i created the image

it created a 93,1GB file: image[0-100027630080].dd

hope, this is the whole disk including MBR etc

what's the next step?

[jaclaz]

what's the next step?

Ideally - if you ave enough space available, you should now make a copy of the image (and leave it alone)

Then, get TESTDISK:

http://www.cgsecurity.org/wiki/TestDisk

Read a bit about it's usage.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

http://www.cgsecurity.org/wiki/Data_Recovery_Examples

Run it as follows:

testdisk_win /log X:\my_path\image[0-100027630080].dd

Change "X:" and "my_path" to your actual values.

Se if you can list files on the partition(s).

Copy them to another disk.

Once you have the files safe we can try to "fix" the damaged filesystem.

jaclaz

[colore]

what's the next step?

Ideally - if you ave enough space available, you should now make a copy of the image (and leave it alone)

Then, get TESTDISK:

http://www.cgsecurity.org/wiki/TestDisk

Read a bit about it's usage.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

http://www.cgsecurity.org/wiki/Data_Recovery_Examples

Run it as follows:

testdisk_win /log X:\my_path\image[0-100027630080].dd

Change "X:" and "my_path" to your actual values.

Se if you can list files on the partition(s).

Copy them to another disk.

Once you have the files safe we can try to "fix" the damaged filesystem.

jaclaz

i got these:

http://shup.com/Shup/452488/1101130222522cwindowssy.png

next?

[jaclaz]

It seems like you have a well garbled MBR DATA.

What happens with "Quick Search", and if still "meaningless data is found", with "Deeper Search"?

jaclaz

[colore]

the previous screenshot shows the result when i choose 'intel' partition

this screenshot shows the result when i choose 'non partitioned data' (while performing quick search):

http://shup.com/Shup/452830/1110112442.png

this screenshot is after quick search or deep scan:

http://shup.com/Shup/452843/111012925.png

what is happening? please note that when i plug in the disk via usb, WinXP succesfully recognizes the partitions

[jaclaz]

I don't know what's happening.

Maybe the image itself has some corrupted data?

Anyway, do the following:

• re-attach the drive to a Xp machine in a USB enclosure
  
• run HDhacker:
  http://dimio.altervista.org/eng/
  
• you want to save:
  
• the MBR or first sector of PhysicalDrive (the PC inner hard disk is \\.\PhysicalDrive0, if you don't have other HD's the USB attached one will be PhysicalDrive1)
  
• the PBR or first sector of each and every partition you can see (LogicalDrives)
  

Additionally, run again Drdd.

You want to save the initial part of the hard disk, starting from (if the drive was partitined under 2K/XP) sector 0 to sector 100 or (if the drive was partitioned under Vista or 7) from sector 0 to sector 2100. (sectors NOT megabytes)

Compress all the resulting files into a .zip archive and either attach the resulting archive to yur next post or upload them simewhere and post a link.

jaclaz

[colore]

okay here it is:

http://ifile.it/txnr20g

it includes the 0-100 sector dd file and the MBR/PBR of all partitions and drives