Hi everyone,

I've successfully recovered data off of dead disks by replacing the controller board from another disk. My GF lost a disk with some not yet backed up stuff on it. I tried the controller board replacement but the drive exhibits the same symptoms, which are:

Disk is recognized by the BIOS

Windows XP runs chkdisk at boot, which eventually finishes with errors. Chkdisk recognizes the drive as NTFS and has the correct disk label. There are read errors 34% of the way into the file check (step 1).

After boot, the drive is recognized by the system, but as unformatted. Disk Management shows it as "healty" but with no filesystem. Any attempt to access the drive gives the "Would you like to format" dialog box.

Obviously, this disk is *somewhat* readable. What would a professional data restorer do at this point? I'm trying to bring it up in Knoppix and see if I can get some files off that way. What other software or procedures do these guys use after a controller board swap doesn't fix the problem? Anyone know?

Best,

Jim

Typically our team will start off the same way you have described. Sometimes it is worth looking for exact same controller board revisions (just for tolerances)
Then, if we are sticking with sensible cost options, try EnCase, if you have access to it. Failing that, try the stick it in a plastic bag in the freezer for a couple of hours method - this works way more than you might think. We have used it for a couple of global banks within the last few months.
Beyond that you start getting into serious money options, which end up at scanning the entire disk with an electron microscope (many hundreds of thousands of pounds!)

Thanks for this helpful response. I did try the freezer trick, but no luck. I'll ask a couple of friends who work in big data centers if they have this EnCase and will run it for me (I'm assuming that's software?)

Thanks again.

Jim
Edit: the board is an exact match -- no reflashing or different versions or anything.

I have a friend who swears by Stellar Phoenix. But I know nothing about it and have no experience with it.

I do know that if you have pr0n on your drive (even deleted pr0n), then don't *ever* send in a drive for professional data recovery. If any of the pictures turn out to be of girls under 18, you can be prosecuted rather severely. Data recovery companies *do* report this stuff to the FBI. The Patriot act is one excuse they use to snoop for this kind of stuff, believe it or not.

No squealing or clicking and drive recognized. If I encountered the conditions you describe at work, the first thing I would try would be R-Studio

It was recommended to me a few years ago by a grad student assistant who had good industry experience, and I have had very good luck with it. Completely worth the $80, but sounds like you might get by with the $50 version.

Trinity:

http://trinityhome.org/Home/index.php?wpid=1&front_id=12

The first thing is to get all the data off the disk
Then you can start to repair the filesystem or recover data

Getting the data:
There are a couple of programs on there that will allow you to copy one disk to another a byte at a time. ddrescue is my tool of choice.
If it gets read errors it skips ahead until it can read again. Having recovered as much data as possible as quickly as possible, it then goes back to the 'holes' and uses a binary search approach to recover the data there. It then retries on errors.

I've recovered several failing disks this way.

Of course it's free - ain't community a wonderful thing
I mean - who'd want to profit from someone else's misfortune?

Oh, there are docs too:
http://trinityhome.org/Home/index.php?wpid=59&front_id=12

And it does antivirus etc etc...

I can recommend dd_rescue as well, I recover all the data from a failed disk recently with it. It does take a long, long time to run though.

One thing that's worth mentioning - once you do manage to get data off the disk - *MAKE AN IMAGE BACKUP*

Then if you run recovery tools that screw things up you don't have to resort to the freezer again.

I once ran ddrescue for about 5 days. I'd cool the disk (not freeze, just power off). Run for a few hours, repeat. I aimed big fans into the case whilst it retried sectors again and again - in the end I recovered it completely (well, there were a few hundred Kb of errors but they could have been in unused space).

My small group uses Trinity from day-to-day but if ever I referred one of our customers to the Trinity Web site with the idea that it could help them to fix their problem, I would expect them to come back and shoot me. I think the Trinity folks have CMS disease. How abouut a "Here's what it does" page with details for ordinary citizens? The CD is great, but you'd better have some idea of what you are doing.

Quote:
I mean - who'd want to profit from someone else's misfortune?

If somebody wants to build a kick-ass data recovery product that works very well, saves me time, and helps them pay for a new deck or swimming pool, sign me up. Now, I haven't used enough products to know that there isn't a better choice than what I have used, but I won't begrudge anybody $80 if they solve my problem consistently and bundle it in a way that it is easy to use. With R-Studio, I am even prepared to suffer the indignity that it runs on Windows!

I am trying to think of the list of open-source product that make up the day-to-day underpinnings of my present working life:

PHP, perl, MySQL, CentOS/Redhat, Fedora Directory Services, Samba, Apache, PubCookie, OpenOffice, KDE, Drupal, PHPMyAdmin, PhpLDAPAdmin, OpenFiler to offer/mention an incomplete list

But I'll gladly pay if I feel a vendor is producing something exceptional in my interest. It's a pretty short list -- what I am glad to pay for. The aforementioned R-Studio and ....VMWare. Scratching my head to think of what else!

I'm still working on this. Thanks a ton for the great suggestions here. Its cooling down again and I'll try the new ideas...

Thanks again you guys!

Jim

I've used Spinrite to recover several laptop drives that were on their way out (still spinning, but many many read errors).

Also, during my forays with Carbon CF cards I found a decent free hex (windows) hex editor. Some bugs, but you can't argue with the price: HxD

<edit - nevermind about the hex editor - I just reread where you state NTFS - harder to cope with than FAT32>
<edit edit - and nevermind about Spinrite for the same reason. However R-Studio NTFS ($50) might be what you're looking for.)

-Zeke

Wow, this thread is exactly what I need. My wife's laptop hard drive is generating errors in the XP System Log. (She tells me that she noticed it going dog slow two days ago and asked me to investigate today. And, naturally, we haven't been doing any backups.)

Tomorrow, I'll go out and get a new hard drive. The question is, of course, how to evacuate and how to restore. I've got a backup running right now to see how much I can evacuate without too much pain. It's slowing down horribly on the bad blocks. Hopefully it will succeed. If not, I'll have to look into these various tools. SpinRite sounds a bit like awesome genius and a bit like technobabble, but if I can spend $49, wave a magic wand, and get the drive into sane enough shape for a standard backup tool to do the job, that would be fantastic.

Just to complicate things further, we don't have the original Dell recovery media handy (they're at home in storage, somewhere). That means that I'd really like to use one of these automagical tools that saves me from needing to reinstall XP and all the applications from scratch. So far, I'm using the 15-day trial of Acronis True Image, since it claims to be able to make this sort of thing magically work (assuming it can get the bits off the disk in the first place).

Oh, and I'm leaving Tuesday on a business trip. My wife would quite like to have all of this resolved before I leave. Grumble.

I had excellent luck with www.ontrackdatarecovery.com 's EasyRecovery™ Professional.

I was amazed!

Update: the backup completed "successfully" after skipping just over 1000 bad disk blocks. Not pretty.

I've used Spinrite many times with very good results. Sometimes it takes days to get there, though.

-jk

I started Spinrite first thing this morning. It blasted through the clean part of the disk (the first 3/4 of it) in 30 minutes. Since then (~12 hours and counting), it's progressed a whopping 3% further. Slow, slow, slow, but we'll see what happens. According to its logs, it's been able to correct a rather sizable number of errors, but there are still many uncorrectable errors remaining.

At least I've got that "complete" backup from before starting Spinrite. And, I've now got a shiny new hard drive from Frys (Fujitsu 120GB 2.5" PATA, $100 and a $20 mail-in rebate -- not a bad deal).

When I used Spinrite, it took over a week on a 250GB SATA drive but I managed to get everything off it afterwards. It appears my drive's problem was simply unmapped surface defects. The symptoms were that XP would take a long time to boot and, if it booted at all, would BSOD within minutes.

ISTR Spinrite finding a lot of problems in 'patches' on the disk - my layman's diagnosis led me to thinking it was probably just one 'physical' area of the drive with a surface defect even though it appeared to be 'logically' all over the disk.

That drive is still in use 2 years later as a secondary 'dump' area and with no apparent problems.

SpinRite got the first 75% of the disk done in 30 minutes. The next 1% took it a solid week, and I got tired of waiting. I pulled the plug, dropped in the new hard drive, and restored the backup I'd made with Acronis True Image (said backup having generated thousands of errors in the Windows logs, and thus leading me to the need for SpinRite to hopefully rectify the old disk and allow for a better backup). Lo and behold, the computer booted up the first time and seemingly without any problems.

So... maybe I just got lucky. There were basically no bad blocks at all in the front 3/4 of the disk. Problems were a recent phenomenon, probably relating to disk usage touching the back quarter, where the bad blocks may have been all along with anybody noticing.

Hmmm. Now I just need to get my wife hooked into regularly backing up her system. I'd want something as painless as Time Machine (which is definitely *not* Acronis True Image). Vista's Shadow Copy business would be perfect, but I don't think this two year old laptop can handle Vista.

Just wanted to say thanks for posting this. It saved a few bacons tonight. Took me a few minutes to find out what to do after I burned the disk and booted it in the target system (answer: "mountallfs" followed by "mc"), but once I did that, bam, it was copying files off the dead system onto the portable USB hard drive like nobody's business. Awesome.