Data Recovery (urgent)

Airan

Better suited to H/A yes, but I'm kinda desparate here.

Alright, so I got my new machine, built it, ran beautifully. I made plenty sure to backup my data onto an old 60gb drive, which I have never touched for over 8 months (last I did was delete some files off it and made it into a page file drive, which was a week ago. Aside from that it was empty). Got 40gb~ of data backed up.
Right, installed SATA, and the 2 IDE drives (the other is my current drive).
Started copying files from the old drive to SATA drive. Worked fine, got about 30gb of my data and then the drive died. I mean, click, whirrr click, etc. Reboot and windows found unreadable sectors.

Right so, I've been looking at recovery methods, and most involve smacking on the side hard or freezing it (I just tried that, unfortunately I think I didn't seal it tight enough, there was some moisture when I grabbed it out to check. putting it to 'dry' atm). Is there any software based recovery methods? Like a Linux LiveCD anyone can recommend? I just need to pull some small files (the rest of the 10gb~ I can probably ditch) and then I can wreck the drive.

Help?

Daedalus

Software methods are always iffy and never very likely to work. That said, I suppose you can give a LiveCD a try. Don't use the Ubuntu liveCD unless you already know how to mount an NTFS drive through the command line. Use something that automounts everything, instead. I think Knoppix would work.



Sending it to a data recovery place will cost an unimaginably large amount of money.

BronzeDuck

I like to use Knoppix (http://www.knoppix.org) for data recovery. It comes with almost every tool you could need to make a box functional again.

mspencer

I think Spinrite (from www.grc.com ) is made for this. Downside, it costs money -- but if you buy it and it doesn't work, just delete all your copies of it and email them (and tell them you have destroyed all copies) and they'll refund the whole amount. On the upside, the tech is solid -- I've personally used Spinrite starting with a 40 MB MFM ("Winchester") 5 1/4" Seagate hard disk, all the way through current versions that understand modern large drives.

If the drive is overall still good but has some damaged regions, Spinrite will use some kind of statistical reading-and-rereading method to try to get the best picture of the data it can, and then it'll make the drive swap in a spare sector and write the data there.

(Personally I think someone should just buy Steve Gibson and incorporate all of that tech into an operating system's IDE subsystem, or reverse engineer it in Australia and add it to the Linux kernel or something -- but that said, it's worth the money. I paid for it.)

Shade

Airan wrote:

Better suited to H/A yes, but I'm kinda desparate here.

Alright, so I got my new machine, built it, ran beautifully. I made plenty sure to backup my data onto an old 60gb drive, which I have never touched for over 8 months (last I did was delete some files off it and made it into a page file drive, which was a week ago. Aside from that it was empty). Got 40gb~ of data backed up.
Right, installed SATA, and the 2 IDE drives (the other is my current drive).
Started copying files from the old drive to SATA drive. Worked fine, got about 30gb of my data and then the drive died. I mean, click, whirrr click, etc. Reboot and windows found unreadable sectors.

Right so, I've been looking at recovery methods, and most involve smacking on the side hard or freezing it (I just tried that, unfortunately I think I didn't seal it tight enough, there was some moisture when I grabbed it out to check. putting it to 'dry' atm). Is there any software based recovery methods? Like a Linux LiveCD anyone can recommend? I just need to pull some small files (the rest of the 10gb~ I can probably ditch) and then I can wreck the drive.

Help?

If all else fails take it to a data recovery center with a sterile room and spin it by hand.

stigweard

Ugh. I would abandon any operating system, even if it gave me a constant orgasm and printed money, if I had to be stuck with his crappy 'firewall'. Spinrite works from time to time, and is good when it does. An alternative would be hdd regenerator, a program that will actively attempt to non destructively fix the bad sectors. Either program could take days to run and end up with no positive results, only further limiting your chances of recovering data should there be a more significant problem. If the data is critical, drop the $2k on a reputable company, otherwise grab what you can get with software recovery programs now, and then give Spinrite a try when you don't have as much to lose.

Airan

Thanks for the suggestion guys, I'm downloading Knoppix at the moment, and will try recovering data tomorrow. While the data is valuable to me, it's not worth spending god knows how much UK companies charge (I don't even know any, for that matter). I mean, if you guys have to pay up $2k~...... :?. I'll give Spinrite a look when all the free options all fail me.

mspencer

stigweard wrote:

Ugh. I would abandon any operating system, even if it gave me a constant orgasm and printed money, if I had to be stuck with his crappy 'firewall'. Spinrite works from time to time, and is good when it does. An alternative would be hdd regenerator, a program that will actively attempt to non destructively fix the bad sectors. Either program could take days to run and end up with no positive results, only further limiting your chances of recovering data should there be a more significant problem. If the data is critical, drop the $2k on a reputable company, otherwise grab what you can get with software recovery programs now, and then give Spinrite a try when you don't have as much to lose.

Whose crappy firewall? I don't think Steve makes a firewall.
So you've used Spinrite? You agree that it's made of win, and if its functionality was built into an operating system that it'd be good for everyone, right?
"Grab what you can get with software recovery programs now" -- Spinrite is the first of these I could think of, so I'd run that first. Which other programs were you thinking of?

stigweard

Zone Alarm was originally his baby iirc. It seems it has changed hands a few times since then. I wouldn't say Spinrite is made of win, but it is alright when it works. I've traditionally had a very low success rate with those types of applications. Usually, by the time I see a drive to get data off it, it is in the freeze / bake stage where every minute the drive is active, it is that much closer to death. When your drive is dying, you don't want to keep it running for days (literally sometimes) in the hopes that a program might recover those lost sectors. You get off what you can using traditional methods first, and then worry about the bits you can't get.

mspencer

Ah yes -- I remember Steve talking about Zone Alarm in Security Now episode 7:

[quote=Transcript from Security Now episode #7]Steve: And in fact I was beta testing ZoneAlarm before it was made publicly available. The guys at Zone Labs knew of my work with ShieldsUP!, and they liked it, and they said, hey, you know, take a look at this firewall. Well, what was significant about it is it did outbound blocking, that is, unlike all other firewalls at the time - actually I think AtGuard was also there before. But the idea was it would catch programs that were using your computer connection without your knowledge. And something was on my machine called TSAdbot.[/quote]

(After G4 bought and killed TechTV, Leo Laporte (host of The Screen Savers and Call For Help) went on to do podcasts at twit.tv, so I started following that. Security Now is one of those podcasts, and Steve Gibson pimps Spinrite at the end of pretty much every show. That pimping doesn't offend me at all -- I've had lots of data recovered from a couple hard disks and from countless poorly-protected floppy disks over the past 12 years by Spinrite.)

All of this matters only because it's important to note: Zone Alarm's lameness shouldn't reflect negatively upon Spinrite. Steve's software isn't that intrusive. You don't even run Spinrite from within Windows, so it doesn't do anything to your Windows install: you create a bootable floppy or CD and boot into Spinrite from that.

There's some background information in that exchange that I should share, so everything makes sense, especially why it can run for hours if you tell it to, why the longer the drive is running the worse things get, and why Spinrite can't fix all problems.

There are two different "levels" that data corruption can happen at. There is a physical disk surface that stores data and reads it back; and there's a Windows filesystem that tells the computer how to find different pieces of data. Spinrite can only fix one of those, and not all the time.

The Windows filesystem really needs to be fixed by Windows. If a drive starts going bad, it's possible that some of the "accounting data" (filesystem data structures) that tells the computer where to find different pieces of data might have been corrupted. Without this "accounting data", the computer won't know which filenames go with what data.

Spinrite doesn't fix filesystem problems directly: it works on the underlying physical data-storing media without caring about filenames or directories. It has several operation modes -- some of them can be quick, and some can take hours or days to complete. If your drive is just not working, you can run 'level 2' and it'll try to read the entire drive, taking maybe 45 minutes to an hour for the parts of the drive that don't have errors, plus extra time to recover data and fix errors. If you have hours or days you can run 'level 5' and it'll take a very long time repeatedly testing each sector of the drive with different bit patterns.

Most importantly, Spinrite does this without Windows or Linux running at all -- it has complete access to the drive. Any utility that runs within Windows or Linux (or any other modern multitasking operating system) can't safely manipulate the drive like Spinrite (or any other boot-into-DOS utility) can. http://www.grc.com/srrecovery.htm A Windows or Linux utility can send 'read' and 'write' commands through the OS -- but those commands don't disable the hard disk's automatic sector relocation when doing so. Spinrite also rereads a bad sector repeatedly, seeking the read head away and back over different distances each time, so the read head ends up at a slightly different position each time.

(You might enjoy reading http://www.grc.com/files/technote.pdf if you're curious about some of the interesting things Spinrite does. The stuff in there is what makes me wish it were possible to build some of this stuff into an OS. When the hard disk reports an error, it'd be great if the OS could do some of this defect analysis while the system isn't using the disk.)

If you have a drive that's having problems spinning up -- that's when the freezer trick is appropriate, and that's when you have limited minutes or hours to get your data off. If your disk is just clicking -- if you don't hear it struggling to maintain RPMs while trying to read data -- I think Spinrite might be worth a try. I know it's a huge hassle to make sure you have money available on a card, buy this, use it and find it didn't help, and request a refund -- so I don't recommend this lightly.

(And because it's sometimes hard to tell the difference between someone who writes a lot because they're paid to, and someone who writes a lot because they feel passionately about something, let me say: I'm a CS grad student who does all of the computer-fixing in our family, and I've also personally used Spinrite starting 12 years ago. I am not being paid or reimbursed for this or any other post on any forum, ever.)

stigweard

I'm not sure why I thought GRC owned Zone Labs at some point, though it might have been his constant pimping of Zone Alarm, which stopped when they were bought up by Check Point. I shouldn't have made the remark about it, but that is past now. And no one has said Spinrite is bad software (it is part of my toolkit), just that it is potentially inappropriate to use when you don't know the severity of the damage to the drive.

It is safer, and smarter to start with something like Knoppix or a recovery program like Easy Recovery Pro from Ontrack (if the file system seems corrupt) to get off what you can. Sometimes it is only one or two files that have parts located in the bad sectors that are causing hiccup and skipping them and coming back to them later makes more sense. That way, should the drive die while trying to recover the bad sectors, you at least have some of that data back. Sure, he might not be having any serious issues at all, but not being there first hand to listen to it, it is better to plan for the worst case scenario.

None of this conjecture on the optimal work flow for data recovery really helps the op though, so if you want to continue the discussion, feel free to pm me.

Airan

Well this is unfortunate. I've burnt Knoppix and booted it, but after it's auto-config it won't display anything. The monitor shuts down to power saving mode. I'm using a 7600GT PCI-E card, it seems to detect the card as an 'AGP bridge' with Nvidia unknown device. Any ideas?

[edit]Never mind, found I had to boot with vga=0