Help me pull data off this poor, corrupted drive?
June 1, 2004 9:05 AM   Subscribe

Ok, I've blown up another hard drive...even knoppix can't help me get the data because the first few sectors are hosed and knoppix can't determine what the file structure is/was. Do anyone of you godlike system gurus have any suggestions that can help me pull data off this poor, corrupted drive?
posted by dejah420 to Computers & Internet (11 answers total)
 
I'm not a godlike system guru but I helped out my little sister in the past in an emergency. The particular files (I only rescued the emergency files, not everything) she was after were relatively small. Norton wouldn't do squat so I looked at good copies of files saved from the same program and figured out a few identifying characteristics (I think they were Quark files).

I then put her drive in my linux box and piped the raw device through a perl script that spat out any ASCII strings and their locations as well as the identifying characteristics.

With that I could rescue the couple of files she needed but it was amazingly painful and error prone. I recall that I didn't rescue the entire file but enough that she had most of the important bits and could rework the rest before the deadline.

The problem is that if the portion of the drive that starts off the directory structure isn't intact it has no way to know where the heads of the files are located. If I redid this feat I'd probably try to create a directory structure pointing at the heads of the few files of interest.
posted by substrate at 10:35 AM on June 1, 2004


i've used dd (unix command) to dump the device to another disk and then gone through looking for source code. copy it off in chunks and use strings (unix) to look for suitable text, then load into an editor and cut+paste the fragments back together. tedious and slow, but better than writing the program again.

that won't work for binary files, and i'm not sure it will help if you've messed up the file system completely (i don't know enough about how disks work at a low level).

what kind of data are you looking for?
posted by andrew cooke at 10:50 AM on June 1, 2004


What file system? NTFS? ext2? JFS? ext3?
posted by cmonkey at 11:07 AM on June 1, 2004


Two words: Swap Platters.
posted by Civil_Disobedient at 2:23 PM on June 1, 2004


Anybody think a format /mbr might work?
posted by Keyser Soze at 4:49 PM on June 1, 2004


format /mbr has worked for me in this situation in the past. No promises, though.
posted by dg at 5:23 PM on June 1, 2004


Response by poster: hiya gang,

Sorry for the delay in response...storms here keep turning off power. I'll try again and hopefully will get this one through before the next blackout. :)

The OS is a Win XP install from Alienware, with a Linux partition...although the flavor of which escapes me at the moment...(we've installed and uninstalled so many trying to get peripherals to work.)

I thought of fdisk /mbr ...but that only seems to work for the primary drive, and not secondary or subsequent drives. (Or I've misunderstood the documentation, and I'm missing an easy drive switch?)

This was the primary drive, but in order to get the system back up, I bought and installed a new drive in slot C:. So, now the flaky drive is in slot d:.

If it was a format command, you could switch the drive letter, but I can't seem to find documentation that you can do that with fdisk commands...unless maybe you stop windows from loading and do it from the pseudo dos that comes with winnt flavors? I dunno. When I've tried, using standard drive switch protocol, it still wants to fdisk the new drive in c:, which while mostly harmless, since it's a virgin drive...doesn't really solve the problem.

No love trying to switch the drive positions either. Machine just blue screens at boot and stays there.
posted by dejah420 at 10:09 PM on June 1, 2004


Best answer: I haven't tried it myself, but if I were in this position tomorrow (fingers crossed, knocking on wood) I would give Knoppix-STD a try, specifically the "forensic" file recovery tools it includes such as Autopsy.
posted by hashashin at 12:16 PM on June 2, 2004


Response by poster: ooooh, hashashin...they may do the trick. Going to try to download and burn a cd before the next set of storms comes rolling through. ( I swear, this neighbhoord goes black if there's a hint of damp...insane. I'm sure that's how I keep blowing up hardware...it's the constant "Surprise! No power!" action. ;)
posted by dejah420 at 12:27 PM on June 2, 2004


Lost & Found, or Recover it All! will do what you need.

HTH. Sorry, they're payware. Oh well.
posted by shepd at 6:59 PM on June 2, 2004


Response by poster: Na, payware isn't that big of a deal. I'll have to go check the "recover it all" site with IE, it's totally weirding out in Mozilla.

But my husband (whose drive it was) got tired of me diddling with it and formatted the drive, so if there was a chance of recovering the data, it's almost nonexistent now.

On the upside, I've now convinced him how important having a cd burner and regular backups are...so that's nice. The plan this weekend is to take the system apart again and install a burner so it's not a crisis point if it happens again. Which, like I said, with the constant power outages we get, is more likely than most people are likely to experience.
posted by dejah420 at 9:59 AM on June 3, 2004


« Older Deliveries in DC   |   How do I deal with spam when running my own email... Newer »
This thread is closed to new comments.