Help me recover my data!
September 18, 2006 4:50 PM Subscribe
My hard drive died and I want to recover a great deal of the data that (hopefully) still exists on it. After reading the Metafilter Wiki, I know this question has been asked before, but my question relates more to the process of recovering the data than the actual possibility of doing so.
One day, while booting my computer, my hard drive up and died telling me that the boot sector had failed. This was annoying given I had a great deal of unbacked up data on it. I installed a new hard drive and went on my way, assuming my precious data was gone forever and I'd just have to rebuild.
But after reading the Metafilter Wiki, I learned that not only was it possible to recover data from dead hard drives, but that programs existed which allowed one to do it theselves. So now I intend to go about rescuing that data and hopefully restoring my sanity. I think I know what I need to do but was hoping to get confirmation from the hive mind. Correct me if I'm wrong.
First of all, my new drive is a SATA RAID drive. My old drive is an old standard IDE drive. I plan to install the dead drive into my machine as the primary slave. All good so far, or will the two drive types create some kind of conflict?
After that's done, I assume I simply install one of these programs from within Windows XP which will then somehow allow me to move the data I want to the new drive. Is this correct?
Finally, before I set about this process, is there anything else seasoned vetrans of this kind of thing could tell me, or is there anything else I need to know, to make sure everything goes nice and smoothly?
Thanks in advance!
One day, while booting my computer, my hard drive up and died telling me that the boot sector had failed. This was annoying given I had a great deal of unbacked up data on it. I installed a new hard drive and went on my way, assuming my precious data was gone forever and I'd just have to rebuild.
But after reading the Metafilter Wiki, I learned that not only was it possible to recover data from dead hard drives, but that programs existed which allowed one to do it theselves. So now I intend to go about rescuing that data and hopefully restoring my sanity. I think I know what I need to do but was hoping to get confirmation from the hive mind. Correct me if I'm wrong.
First of all, my new drive is a SATA RAID drive. My old drive is an old standard IDE drive. I plan to install the dead drive into my machine as the primary slave. All good so far, or will the two drive types create some kind of conflict?
After that's done, I assume I simply install one of these programs from within Windows XP which will then somehow allow me to move the data I want to the new drive. Is this correct?
Finally, before I set about this process, is there anything else seasoned vetrans of this kind of thing could tell me, or is there anything else I need to know, to make sure everything goes nice and smoothly?
Thanks in advance!
The way you've proposed cabling up the drives should be OK.
This seasoned veteran is telling you that if you're asking questions this general, you want to get in the same room with somebody who knows what they're doing, and watch and learn.
For a start, I wouldn't use Windows to do the data recovery. Windows likes to write on disk drives even when you don't think it is, and it's hard to dissuade it. I'd use a Linux live CD, and I'd use the ro option on any mount command for the drive to make sure no writing was attempted.
For seconds, I wouldn't get my hopes up too much. There are several failure modes that result in boot sectors becoming unreadable; some of them take out many more sectors than just the boot sector. Basically, anything you can recover from this drive without specialist equipment is a bonus.
For thirds, I would certainly not go in boots-and-all with an undelete utility. Your files have probably not been deleted, and attempting to undelete things will probably hose the drive up worse than it is already. Successful data recovery from faulty drives needs a reasonably detailed understanding of the process by which a computer stores files on a disk; if you don't have that, it's easy to damage data that would otherwise have been quite recoverable.
Get skilled local help, and good luck!
posted by flabdablet at 5:17 PM on September 18, 2006
This seasoned veteran is telling you that if you're asking questions this general, you want to get in the same room with somebody who knows what they're doing, and watch and learn.
For a start, I wouldn't use Windows to do the data recovery. Windows likes to write on disk drives even when you don't think it is, and it's hard to dissuade it. I'd use a Linux live CD, and I'd use the ro option on any mount command for the drive to make sure no writing was attempted.
For seconds, I wouldn't get my hopes up too much. There are several failure modes that result in boot sectors becoming unreadable; some of them take out many more sectors than just the boot sector. Basically, anything you can recover from this drive without specialist equipment is a bonus.
For thirds, I would certainly not go in boots-and-all with an undelete utility. Your files have probably not been deleted, and attempting to undelete things will probably hose the drive up worse than it is already. Successful data recovery from faulty drives needs a reasonably detailed understanding of the process by which a computer stores files on a disk; if you don't have that, it's easy to damage data that would otherwise have been quite recoverable.
Get skilled local help, and good luck!
posted by flabdablet at 5:17 PM on September 18, 2006
Your SATA drive, if it is just the one drive, can't be a Redundant Array of Inexpensive Disks by itself, but it can be a model of drive designed to perform well as a member of a RAID array. If you had two of them, you could set up a RAID 0 or 1 level array, and if you had 3 or more of them, you could setup higher levels of RAID protection. RAID arrays generally work best with drives of similar characteristics, but you could use your old drive and your new drive in various ways to create a RAID array, too, although the practicality of this might be suspect. You clearly need to learn a lot more about RAID before plunging into this.
As for recovering your data from the old drive first, your success will depend on what, besides your Master Boot Record, is also FUBAR on that drive, and whether you had it formatted with FAT, FAT32 or NTFS, or some other file system. Some UNIX file systems are quite robust, and your chance of recovery would be quite good, but FAT's sector mapping structures (File Allocation Table) are pretty easily screwed up by delamination of the physical media, head crashes, and various other forms of gradual drive death.
As long as you mount the dead drive read only, and only do operations to pull information off of it, as opposed to trying to do anything to remap sectors or repair the drive, you at least won't make your problems worse. Trying to "recover" the drive by "fixing" its MBR, partition tables, or file system has the considerable potential of destroying information which links the drive's randomly addressed data sectors into files, thus permanently destroying access to your data. So, don't do anything that writes changes to the drive, until you've recovered all your data. You might even be able to set a jumper on the drive before installing it, such that it is set to "read only" or "write inhibited" in hardware, before you start.
If the old drive is IDE, you'll need an appropriate IDE flat ribbon cable (either 40 or 80 wire, 80 being a "better" cable for noise reduction), to connect it to your motherboard. And you may need to set some BIOS options for selecting your new SATA drive as the preferred boot drive. I concur with flabdabet that using a Linux boot CD to examine your dead drive is the safest root. But if you must use Windows, boot into your OS, see if you can mount the old drive at all, and if so, if you can access any file system information. Details for doing that are found in Windows XP in the Disk Management tool.
posted by paulsc at 5:28 PM on September 18, 2006
As for recovering your data from the old drive first, your success will depend on what, besides your Master Boot Record, is also FUBAR on that drive, and whether you had it formatted with FAT, FAT32 or NTFS, or some other file system. Some UNIX file systems are quite robust, and your chance of recovery would be quite good, but FAT's sector mapping structures (File Allocation Table) are pretty easily screwed up by delamination of the physical media, head crashes, and various other forms of gradual drive death.
As long as you mount the dead drive read only, and only do operations to pull information off of it, as opposed to trying to do anything to remap sectors or repair the drive, you at least won't make your problems worse. Trying to "recover" the drive by "fixing" its MBR, partition tables, or file system has the considerable potential of destroying information which links the drive's randomly addressed data sectors into files, thus permanently destroying access to your data. So, don't do anything that writes changes to the drive, until you've recovered all your data. You might even be able to set a jumper on the drive before installing it, such that it is set to "read only" or "write inhibited" in hardware, before you start.
If the old drive is IDE, you'll need an appropriate IDE flat ribbon cable (either 40 or 80 wire, 80 being a "better" cable for noise reduction), to connect it to your motherboard. And you may need to set some BIOS options for selecting your new SATA drive as the preferred boot drive. I concur with flabdabet that using a Linux boot CD to examine your dead drive is the safest root. But if you must use Windows, boot into your OS, see if you can mount the old drive at all, and if so, if you can access any file system information. Details for doing that are found in Windows XP in the Disk Management tool.
posted by paulsc at 5:28 PM on September 18, 2006
Response by poster: "... is this data important enough that you can find a friend who's a little more technically savvy than you to come over and help you do this?"
posted by onalark at 11:05 AM AEST on September 19
Not really. It's mostly some videos, MP3s and other data that I can easily recover. I'd prefer not to, but I can, given time. The only really irreplacable data is some of the stuff under My Documents on the C Drive, such as the drafts of a few books I was writing and photographs of my girlfriend and I long since deleted from the cameras they were taken on. That's the stuff I'd really like to get back.
The problem for me, however, is I don't really have a friend who's more tech savvy than me. I could pay a professional to do it, but I suspect that that would cost me a fortune to get it done, and currently I do not have a fortune.
"... I wouldn't use Windows to do the data recovery. Windows likes to write on disk drives even when you don't think it is, and it's hard to dissuade it. I'd use a Linux live CD, and I'd use the ro option on any mount command for the drive to make sure no writing was attempted."
posted by flabdablet at 11:17 AM AEST on September 19
Which version of Linux would you reccomend I use to do this with?
"As for recovering your data from the old drive first, your success will depend on what, besides your Master Boot Record, is also FUBAR on that drive, and whether you had it formatted with FAT, FAT32 or NTFS, or some other file system."
posted by paulsc at 11:28 AM AEST on September 19
It was formatted with NTFS.
Thanks for all your help so far everyone. I'm learning a lot. I wouldn't have known that Window's attempts to write to the drive could screw up the drive even more and this knowledge, when coupled with paulsc's advice of setting a jumper to the drive to prevent it from writing, will help me out a lot. AskMe rocks! Keep it coming!
posted by Effigy2000 at 5:54 PM on September 18, 2006
posted by onalark at 11:05 AM AEST on September 19
Not really. It's mostly some videos, MP3s and other data that I can easily recover. I'd prefer not to, but I can, given time. The only really irreplacable data is some of the stuff under My Documents on the C Drive, such as the drafts of a few books I was writing and photographs of my girlfriend and I long since deleted from the cameras they were taken on. That's the stuff I'd really like to get back.
The problem for me, however, is I don't really have a friend who's more tech savvy than me. I could pay a professional to do it, but I suspect that that would cost me a fortune to get it done, and currently I do not have a fortune.
"... I wouldn't use Windows to do the data recovery. Windows likes to write on disk drives even when you don't think it is, and it's hard to dissuade it. I'd use a Linux live CD, and I'd use the ro option on any mount command for the drive to make sure no writing was attempted."
posted by flabdablet at 11:17 AM AEST on September 19
Which version of Linux would you reccomend I use to do this with?
"As for recovering your data from the old drive first, your success will depend on what, besides your Master Boot Record, is also FUBAR on that drive, and whether you had it formatted with FAT, FAT32 or NTFS, or some other file system."
posted by paulsc at 11:28 AM AEST on September 19
It was formatted with NTFS.
Thanks for all your help so far everyone. I'm learning a lot. I wouldn't have known that Window's attempts to write to the drive could screw up the drive even more and this knowledge, when coupled with paulsc's advice of setting a jumper to the drive to prevent it from writing, will help me out a lot. AskMe rocks! Keep it coming!
posted by Effigy2000 at 5:54 PM on September 18, 2006
I plan to install the dead drive into my machine as the primary slave. All good so far, or will the two drive types create some kind of conflict?
It shouldn't. You don't specify what motherboard you're using, but I'm guessing if it supports both IDE and SATA, it should be able to handle both of them. That's not necessarily a wise assumption, but you can still proceed carefully and not screw anything up. In general with systems these days, you simply plug 'em both in and start the machine up. If the primary boot drive has an operating system installed on it, it'll boot up and figure out the rest.
The RAID part of your statement is a bit confusing, since nearly all SATA drives can be set up in a RAID configuration. But you don't have it set up as a RAID, so that shouldn't concern you. Don't, by the way... in case you were thinking about it. RAID will just complicate matters. First things first: recover your data.
So hook 'em up and boot up.
I assume I simply install one of these programs from within Windows XP which will then somehow allow me to move the data I want to the new drive. Is this correct?
That's it. Be advised that Windows might automatically detect a problem with the boot array in your old drive and offer to "fix" it for you: always say no. In general, just about any other modern drive recovery program will do better than the built-in datamangler mechanism.
Once you boot up on your "good" drive, install whatever program you've got (and if you so happen to need a good one, just send me an email—address in the profile). The program detects the old drive and, provided the problem was in the MBR, with some luck and Voodoo witchcraft the software will try and replace it with the other copy the OS holds. Hopefully.
If you've got a good program, none of this will matter. The software I use can get any files deleted long ago on any filesystem: linus, ntfs, you name it, it'll recover it. Here's their instruction manual. I think you'll find the order of operations is basically the same with any recovery program.
posted by Civil_Disobedient at 6:09 PM on September 18, 2006
It shouldn't. You don't specify what motherboard you're using, but I'm guessing if it supports both IDE and SATA, it should be able to handle both of them. That's not necessarily a wise assumption, but you can still proceed carefully and not screw anything up. In general with systems these days, you simply plug 'em both in and start the machine up. If the primary boot drive has an operating system installed on it, it'll boot up and figure out the rest.
The RAID part of your statement is a bit confusing, since nearly all SATA drives can be set up in a RAID configuration. But you don't have it set up as a RAID, so that shouldn't concern you. Don't, by the way... in case you were thinking about it. RAID will just complicate matters. First things first: recover your data.
So hook 'em up and boot up.
I assume I simply install one of these programs from within Windows XP which will then somehow allow me to move the data I want to the new drive. Is this correct?
That's it. Be advised that Windows might automatically detect a problem with the boot array in your old drive and offer to "fix" it for you: always say no. In general, just about any other modern drive recovery program will do better than the built-in data
Once you boot up on your "good" drive, install whatever program you've got (and if you so happen to need a good one, just send me an email—address in the profile). The program detects the old drive and, provided the problem was in the MBR, with some luck and Voodoo witchcraft the software will try and replace it with the other copy the OS holds. Hopefully.
If you've got a good program, none of this will matter. The software I use can get any files deleted long ago on any filesystem: linus, ntfs, you name it, it'll recover it. Here's their instruction manual. I think you'll find the order of operations is basically the same with any recovery program.
posted by Civil_Disobedient at 6:09 PM on September 18, 2006
My only addition to Civil_disobedient's advice is to put the old drive on its own channel (separate cable from your CDROM drive, etc). I'd also set it as master. I've had flakey drives that locked up IDE channels completely. I've also had flakey drives that were somewhat less flakey when they were on a channel by themselves.
I've had good luck using the R-studio software that Civil_disobenient suggests. One nice thing about it is that you can run the trial version and see how it does at finding your files before you actually pay for it and actually recover the files.
posted by Good Brain at 6:19 PM on September 18, 2006
I've had good luck using the R-studio software that Civil_disobenient suggests. One nice thing about it is that you can run the trial version and see how it does at finding your files before you actually pay for it and actually recover the files.
posted by Good Brain at 6:19 PM on September 18, 2006
Or, you know, just send me an email. :)
And good point about the separate channel idea, except since one's IDE and the other is SATA, I don't think that will be a problem. But for posterity's sake, GB's right: it's usually better to have each drive on its own channel. If you've got a CDROM or somesuch, just make it a slave off the drive you know that works. Leave the dying drive on its own cable, the useless wretch. You wouldn't want to contaminate your good data by even sharing the same pipelines as that beast. (Slight sarcasm alert.) Anyway, at the very least it follows the tried and true principle of minimize points of conflict.
posted by Civil_Disobedient at 6:28 PM on September 18, 2006
And good point about the separate channel idea, except since one's IDE and the other is SATA, I don't think that will be a problem. But for posterity's sake, GB's right: it's usually better to have each drive on its own channel. If you've got a CDROM or somesuch, just make it a slave off the drive you know that works. Leave the dying drive on its own cable, the useless wretch. You wouldn't want to contaminate your good data by even sharing the same pipelines as that beast. (Slight sarcasm alert.) Anyway, at the very least it follows the tried and true principle of minimize points of conflict.
posted by Civil_Disobedient at 6:28 PM on September 18, 2006
If your BIOS sees the disk, you can grab a file restore utility from portablefreeware.com and recover stuff.
posted by PowerCat at 7:06 PM on September 18, 2006
posted by PowerCat at 7:06 PM on September 18, 2006
Which Linux?
If that were my drive, I'd buy another one at least as big, cable them both in, boot a Linux, use a little mysterious and inscrutable command line voodoo to image the failed drive onto the new drive, shut down, unplug the failed drive, then do all my data recovery experiments on the copy.
That way, when (not if) some nice automated tool helpfully screwed everything up worse than it was before, I could make another copy and try something else.
Your files have not - repeat, not - been deleted. Deletion is an orderly process by which disk blocks formerly in use to store files get marked free for reuse. Your disk drive has developed a fault, the extent of which is unknown. It might be just the boot sector, in which case all you need to do is rebuild your partition table. It might be a random selection of sectors due to a media fault, in which case a certain amount of filesystem rebuilding might be called for; doing this automatically might even work. It could be a bad head, in which case up to half the data blocks on the drive might be irretrievable without physical disassembly and reassembly in a clean room by an expensive professional data recovery business.
In all but the least damaged of these possibilities, automated file recovery programs are going to be making bad assumptions, which is why it's worth unleashing them only on copies of your failed drive rather than on the original.
If you want to try this, post back here and I'll walk you through the requisite voodoo. But I won't play unless you've got a spare drive to trash completely, though temporarily. I don't want one of my instructional mistakes trashing your existing good SATA drive.
posted by flabdablet at 9:36 PM on September 18, 2006
If that were my drive, I'd buy another one at least as big, cable them both in, boot a Linux, use a little mysterious and inscrutable command line voodoo to image the failed drive onto the new drive, shut down, unplug the failed drive, then do all my data recovery experiments on the copy.
That way, when (not if) some nice automated tool helpfully screwed everything up worse than it was before, I could make another copy and try something else.
Your files have not - repeat, not - been deleted. Deletion is an orderly process by which disk blocks formerly in use to store files get marked free for reuse. Your disk drive has developed a fault, the extent of which is unknown. It might be just the boot sector, in which case all you need to do is rebuild your partition table. It might be a random selection of sectors due to a media fault, in which case a certain amount of filesystem rebuilding might be called for; doing this automatically might even work. It could be a bad head, in which case up to half the data blocks on the drive might be irretrievable without physical disassembly and reassembly in a clean room by an expensive professional data recovery business.
In all but the least damaged of these possibilities, automated file recovery programs are going to be making bad assumptions, which is why it's worth unleashing them only on copies of your failed drive rather than on the original.
If you want to try this, post back here and I'll walk you through the requisite voodoo. But I won't play unless you've got a spare drive to trash completely, though temporarily. I don't want one of my instructional mistakes trashing your existing good SATA drive.
posted by flabdablet at 9:36 PM on September 18, 2006
Hiren's Boot CD has all the data recovery apps you could possibly ask for. Quite easily available wherever bittorrents aren't sold. Win/dos. There's a free version, too, but you'll need the "full" version, which has much more robust data recovery solutions.
posted by ChasFile at 11:59 PM on September 18, 2006
posted by ChasFile at 11:59 PM on September 18, 2006
I concur with flabdablet, the Right Way to do this is to do an image first and then try various recovery methods. I did this a few weeks ago to get back my employer's crucial, unrecoverable data (which was on a single-drive Windows machine...).
To outline the process that we're talking about, what you would do is to use a fancy linux utility called ddrescue to cleverly read the literal, lowest-level 'on' and 'off' states on the disk without trying to interpret them as a filesystem, and you're going to copy those 'on' and 'off' states to a new disk. This new disk now has an 'image' of the old filesystem in the same state as the old disk. Now we can try all sorts of nifty things on the old disk safe in the knowledge that we can re-image the whole thing and start over if we make a mistake.
This, however, is a procedure fraught with pitfalls for the unwary as linux command line tools will happily erase your good data if you're not Very Careful.
Feel free to contact me at the gmail in my profile if you'd like, or take flabdablet up on his offer.
posted by Skorgu at 4:47 AM on September 19, 2006
To outline the process that we're talking about, what you would do is to use a fancy linux utility called ddrescue to cleverly read the literal, lowest-level 'on' and 'off' states on the disk without trying to interpret them as a filesystem, and you're going to copy those 'on' and 'off' states to a new disk. This new disk now has an 'image' of the old filesystem in the same state as the old disk. Now we can try all sorts of nifty things on the old disk safe in the knowledge that we can re-image the whole thing and start over if we make a mistake.
This, however, is a procedure fraught with pitfalls for the unwary as linux command line tools will happily erase your good data if you're not Very Careful.
Feel free to contact me at the gmail in my profile if you'd like, or take flabdablet up on his offer.
posted by Skorgu at 4:47 AM on September 19, 2006
SATA and IDE could never be on the same channel, as each SATA device gets its own.
posted by owenkun at 5:48 AM on September 19, 2006
posted by owenkun at 5:48 AM on September 19, 2006
owenkun I assumed he meant installing the old drive as the slave to his CD-ROM.
posted by Skorgu at 3:02 PM on September 19, 2006
posted by Skorgu at 3:02 PM on September 19, 2006
If you can't read any data from the drive, try throwing it in the freezer overnight. then hook it up and you may have 1-2 hours to get the last of the data off.
Not joking. It worked for me on a drive that couldn't be read. Of course, YMMV.
posted by Four Flavors at 5:29 PM on September 19, 2006
Not joking. It worked for me on a drive that couldn't be read. Of course, YMMV.
posted by Four Flavors at 5:29 PM on September 19, 2006
Skorgu, I owe you one - I hadn't met ddrescue before. I have always relied on dd if=/dev/hdXX of=/dev/hdXX bs=512 conv=noerror, with multiple passes over sections that dd lists as bad; old-school, but gets the job done :)
It looks like ddrescue essentially automates that process, which strikes me as a very useful thing to do. I will have to corrupt a few floppies and take it for a test drive.
posted by flabdablet at 11:43 PM on September 19, 2006
It looks like ddrescue essentially automates that process, which strikes me as a very useful thing to do. I will have to corrupt a few floppies and take it for a test drive.
posted by flabdablet at 11:43 PM on September 19, 2006
flabdablet yeah, I did that for a while too until this last incident. The importance of the data and the state of the drive made me look for a better way, and lo ddrescue sprung forth. It freaking rocks. Speaking of, the Recovery Is Possible iso has it preinstalled, but almost none of the other LiveCDs do. Grrr.
posted by Skorgu at 11:58 AM on September 20, 2006
posted by Skorgu at 11:58 AM on September 20, 2006
This thread is closed to new comments.
posted by onalark at 5:05 PM on September 18, 2006