Please help me rescue my data using a Live CD

April 4, 2007 6:57 PM

I was attempting to resize the partitions on my laptop when accidentally my laptop shut down and now I can't boot back into windows.

I have a Dell Inspiron laptop with WinXP Pro SP2 installed and I was attempting to resize a partition on it using Partition Magic in order to install Linux when the power on my laptop ran out and it shut down without any warning mid-process. Now I cannot reboot into WinXP and keep getting an error message saying :

"Windows could not start because the following file is missing or corrupt: \system32\hal.dll"

I burned a Knoppix Live CD in the hope that I would be able to access my WinXP paritions and rescue my data before having to reinstall WinXP again. But it seems even that is not possible.

I can get Knoppix to load fine but when attempting to mount the windows partitions, I get the following message:

"
Could Not Mount Device

WARNING: Dirty volume mount was forced by the 'force' mount option. fusermount: mountpoint is not empty
fusermount: if you are sure this is safe, use the non empty mount option

Failed to create FUSE mount point: No such file or directory

Retry to create FUSE mount point
FATAL: Module fuse not found

fusermount: mountpoint is not empty
fusermount: if you are sure this is safe, use the non empty mount option

Failed to create FUSE mount point: No such file or directory

Unmounting /dev/sda2 ()

"
I spoke to a data recovery service and based on an explanation of the situation on the phone, they were of the opinion that the data on laptop was indeed recoverable but were quoting a price I cannot afford at the moment.

Is there any way I can attempt to do this on my own. I don't mind getting my hands dirty and doing whatever reading is required. But I have no idea where to start. All I want is to be able to get access to my emails and a few documents. I don't care about having to re-install the OS after that.

And failing that, any recommendations for a tech help service that could do this for around $100-$150 and is located in Chicago?

posted by sk381 to computers & internet (10 comments total)

Rip out that hard drive and put it in a USB cradle? But if the disk is borked, that not work either.
posted by gergtreble at 7:19 PM on April 4, 2007

i hope you have install disks. here's a good recovery program. their site mentions something about a free test drive.
posted by phaedon at 8:17 PM on April 4, 2007

Plug in an external drive so you've got somewhere to copy files to, then boot up the Trinity Rescue Kit, and use

mountallfs -g

to mount all detected filesystems, using NTFS-3G to do any required NTFS mounts (this will give you full read-write access if you need it). The mountallfs script will make mount points under / for all your mountable hard disk devices, so /dev/hda1 would be mounted on /hda1, /dev/sda1 on /sda1 and so on. If mountallfs detects that a filesystem is dirty, it will warn you that this is so, and give you the option to mount it anyway.

Assuming your internal hard disk ends up mounting successfully as /hda1 and your external drive ends up as /sda1, you can copy everything from internal to external using

cp -av /hda1/* /sda1

Linux has a different file permissions model from Windows/NTFS, so file permissions might not survive this copy even if your external drive is NTFS-formatted, but at least your data will be intact.
posted by flabdablet at 8:32 PM on April 4, 2007

I often agree with flabdablet's generally excellent advice, but I'm posting to disagree here. The current internal drive is already borked badly enough that Knoppix doesn't find or recognize a valid partition table. Extra care is in order.

Don't boot the drive in the laptop again, until/unless you're ready to re-install Windows. Anything you do that can cause the laptop to try writing to the device risks making it unrecoverable, if it is not already. If you were trying to resize an active Windows partition, without having made a complete backup, and without having connected the machine to a UPS, or working on it with a good battery that could carry it through a power glitch, you may not have the technical skills to accomplish a low level disk recovery.

At the very least, the partition table is borked, and probably the MBR. You'll want make a working copy of the drive, in its current state, to another drive of equal or greater capacity, and then work only on the working copy, for your recovery efforts. To do that, you'll need to remove the drive from the machine, and use a drive cloning kit to connect it to a known good machine with a copy drive of equal or greater capacity to the one you are trying to recover. If changes you make to the working copy fail, you can still re-run your procedure from the point of recopying the existing drive. Expect to do this several times, as you learn about the low level file layout of the drive in its current state. Without a valid partition table, all recovery operations can do is sequential block reads, so this may be very time consuming.

You can probably use your Knoppix disk to create a working clone onto a recovery drive, as this poster previously did. Repairing the Windows partition to a bootable state may not be possible, but it is probable you could read the drive for files, if the drive was formatted as an NTFS partition, and the MFT is still usable, using one of the mention recovery suites. I recommend R-Studio. If the drive was formatted as FAT or FAT32, and the partition table is truly borked, the chances of successful recovery of file data is lower, as it's nearly certian the File Allocation Tables are in an inconsistent condition, with no way, other than trial and error, to decide which copy is correct.
posted by paulsc at 8:37 PM on April 4, 2007

I think you should consider taking it to someone who knows what they're doing and pay them to fix it. Places like "Best Buy" have technical consulting desks for this kind of thing. It isn't free, but how much is your data worth to you?
posted by Steven C. Den Beste at 9:40 PM on April 4, 2007

Don't take this problem to Best Buy. they will not make it better. Google if you don't believe me.
posted by misterbrandt at 10:01 PM on April 4, 2007

Perhaps Best Buy is not the place to go, but this sounds complicated enough so that it's probably better handled by someone who really does know what he's doing.
posted by Steven C. Den Beste at 10:04 PM on April 4, 2007

Well the only real way to really stuff up is to try to write to the dead drive. So if you use knoppix to boot with fresh hard drive in your machine with a partition with equal or greater (greater on the safe side) and then do a "data dump" (dd /dev/dead_drive > /dev/new_drive" (command for illustrative purposes only)) then unplug the dead drive, there's not much more irreversible damage you can do to the old disk.
posted by singingfish at 10:44 PM on April 4, 2007

Does your partition re-sizing software run off of a boot CD? If so, have you tried re-running it? It may be able to pick up where it left off.
posted by banshee at 9:23 AM on April 5, 2007

paulsc: I generally have the greatest respect for your advice as well, and I'm not familiar with Knoppix, so if there's something specific I've missed I'd appreciate being shown what that is.

Most of the work of resizing a file system involves moving chunks around inside the filesystem, and this has to be done before resizing the partition that contains the filesystem. You'd have to be pretty unlucky for the write that got screwed up by power loss to be the very last one that was going to happen. Also, the partition table is in the same disk block as the master boot record, which is still there; without it, the boot process wouldn't get as far as being able to complain about hal.dll.

I don't think the Knoppix mount errors mean there's anything terribly wrong with the volume. It looks to me like there are two issues there: (1) the NTFS volume that Knoppix is attempting to mount is dirty (2) the mountpoint is not empty. The fact that it said "umounting /dev/sda2" suggested to me that /dev/sda2 exists, which is more evidence that the partition table is not completely b0rked.

I don't know why Knoppix would be attempting to use a non-empty mount point; it might plausibly be bad error recovery from trying to mount a dirty filesystem. In any case, the mountallfs script in TRK won't do this - it creates a new, empty directory to mount the volume in, as I described; I've successfully used it before to mount dirty filesystems. Also, the commands I suggested don't write anything back to the original disk - all they do is copy files off it onto an external hard disk.

Booting up from the TRK CD-ROM is not, in and of itself, going to do anything to the hard disk one way or another; it's as safe as doing anything else with it, and safer than physically removing it.

sk381, if you're concerned that there has in fact been damage to the partition table (as opposed to resizing-related damage to the file system on the main NTFS partition) you can check for this by booting up TRK, then using the command

fdisk -l

(the thing after - is a lowercase L). This will give you a listing of all your partitions. If the partition table has been overwritten, you'll get some pretty nonsensical numbers here; if all looks basically OK, it should be pretty safe to go ahead and mount the partition.
posted by flabdablet at 3:49 AM on April 6, 2007