Help me pull data off this poor, corrupted drive?
June 1, 2004 9:05 AM Subscribe
Ok, I've blown up another hard drive...even knoppix can't help me get the data because the first few sectors are hosed and knoppix can't determine what the file structure is/was. Do anyone of you godlike system gurus have any suggestions that can help me pull data off this poor, corrupted drive?
i've used dd (unix command) to dump the device to another disk and then gone through looking for source code. copy it off in chunks and use strings (unix) to look for suitable text, then load into an editor and cut+paste the fragments back together. tedious and slow, but better than writing the program again.
that won't work for binary files, and i'm not sure it will help if you've messed up the file system completely (i don't know enough about how disks work at a low level).
what kind of data are you looking for?
posted by andrew cooke at 10:50 AM on June 1, 2004
that won't work for binary files, and i'm not sure it will help if you've messed up the file system completely (i don't know enough about how disks work at a low level).
what kind of data are you looking for?
posted by andrew cooke at 10:50 AM on June 1, 2004
Two words: Swap Platters.
posted by Civil_Disobedient at 2:23 PM on June 1, 2004
posted by Civil_Disobedient at 2:23 PM on June 1, 2004
Anybody think a format /mbr might work?
posted by Keyser Soze at 4:49 PM on June 1, 2004
posted by Keyser Soze at 4:49 PM on June 1, 2004
format /mbr has worked for me in this situation in the past. No promises, though.
posted by dg at 5:23 PM on June 1, 2004
posted by dg at 5:23 PM on June 1, 2004
Response by poster: hiya gang,
Sorry for the delay in response...storms here keep turning off power. I'll try again and hopefully will get this one through before the next blackout. :)
The OS is a Win XP install from Alienware, with a Linux partition...although the flavor of which escapes me at the moment...(we've installed and uninstalled so many trying to get peripherals to work.)
I thought of fdisk /mbr ...but that only seems to work for the primary drive, and not secondary or subsequent drives. (Or I've misunderstood the documentation, and I'm missing an easy drive switch?)
This was the primary drive, but in order to get the system back up, I bought and installed a new drive in slot C:. So, now the flaky drive is in slot d:.
If it was a format command, you could switch the drive letter, but I can't seem to find documentation that you can do that with fdisk commands...unless maybe you stop windows from loading and do it from the pseudo dos that comes with winnt flavors? I dunno. When I've tried, using standard drive switch protocol, it still wants to fdisk the new drive in c:, which while mostly harmless, since it's a virgin drive...doesn't really solve the problem.
No love trying to switch the drive positions either. Machine just blue screens at boot and stays there.
posted by dejah420 at 10:09 PM on June 1, 2004
Sorry for the delay in response...storms here keep turning off power. I'll try again and hopefully will get this one through before the next blackout. :)
The OS is a Win XP install from Alienware, with a Linux partition...although the flavor of which escapes me at the moment...(we've installed and uninstalled so many trying to get peripherals to work.)
I thought of fdisk /mbr ...but that only seems to work for the primary drive, and not secondary or subsequent drives. (Or I've misunderstood the documentation, and I'm missing an easy drive switch?)
This was the primary drive, but in order to get the system back up, I bought and installed a new drive in slot C:. So, now the flaky drive is in slot d:.
If it was a format command, you could switch the drive letter, but I can't seem to find documentation that you can do that with fdisk commands...unless maybe you stop windows from loading and do it from the pseudo dos that comes with winnt flavors? I dunno. When I've tried, using standard drive switch protocol, it still wants to fdisk the new drive in c:, which while mostly harmless, since it's a virgin drive...doesn't really solve the problem.
No love trying to switch the drive positions either. Machine just blue screens at boot and stays there.
posted by dejah420 at 10:09 PM on June 1, 2004
Best answer: I haven't tried it myself, but if I were in this position tomorrow (fingers crossed, knocking on wood) I would give Knoppix-STD a try, specifically the "forensic" file recovery tools it includes such as Autopsy.
posted by hashashin at 12:16 PM on June 2, 2004
posted by hashashin at 12:16 PM on June 2, 2004
Response by poster: ooooh, hashashin...they may do the trick. Going to try to download and burn a cd before the next set of storms comes rolling through. ( I swear, this neighbhoord goes black if there's a hint of damp...insane. I'm sure that's how I keep blowing up hardware...it's the constant "Surprise! No power!" action. ;)
posted by dejah420 at 12:27 PM on June 2, 2004
posted by dejah420 at 12:27 PM on June 2, 2004
Lost & Found, or Recover it All! will do what you need.
HTH. Sorry, they're payware. Oh well.
posted by shepd at 6:59 PM on June 2, 2004
HTH. Sorry, they're payware. Oh well.
posted by shepd at 6:59 PM on June 2, 2004
Response by poster: Na, payware isn't that big of a deal. I'll have to go check the "recover it all" site with IE, it's totally weirding out in Mozilla.
But my husband (whose drive it was) got tired of me diddling with it and formatted the drive, so if there was a chance of recovering the data, it's almost nonexistent now.
On the upside, I've now convinced him how important having a cd burner and regular backups are...so that's nice. The plan this weekend is to take the system apart again and install a burner so it's not a crisis point if it happens again. Which, like I said, with the constant power outages we get, is more likely than most people are likely to experience.
posted by dejah420 at 9:59 AM on June 3, 2004
But my husband (whose drive it was) got tired of me diddling with it and formatted the drive, so if there was a chance of recovering the data, it's almost nonexistent now.
On the upside, I've now convinced him how important having a cd burner and regular backups are...so that's nice. The plan this weekend is to take the system apart again and install a burner so it's not a crisis point if it happens again. Which, like I said, with the constant power outages we get, is more likely than most people are likely to experience.
posted by dejah420 at 9:59 AM on June 3, 2004
This thread is closed to new comments.
I then put her drive in my linux box and piped the raw device through a perl script that spat out any ASCII strings and their locations as well as the identifying characteristics.
With that I could rescue the couple of files she needed but it was amazingly painful and error prone. I recall that I didn't rescue the entire file but enough that she had most of the important bits and could rework the rest before the deadline.
The problem is that if the portion of the drive that starts off the directory structure isn't intact it has no way to know where the heads of the files are located. If I redid this feat I'd probably try to create a directory structure pointing at the heads of the few files of interest.
posted by substrate at 10:35 AM on June 1, 2004