File Recovery from NTFS using liveCD. Need guidance.
Here's the story: I have a crashed/crashing win2k laptop hard drive. It is not bootable and making wierd snapping noises. There are client's business-critical documents on the drive. Drive is under warranty, but data recovery is not. I want to attempt to recover files before sending to the pros (could cost upwards of $2500, if we go that way.)
My idea is to use a linux liveCD to boot and then copy files (read-only) from the crashed win2k NTFS partition and copy files to a USB key drive.
Of course, before I try it on the crashing hard drive (which could cause more damage, I know)... I want to try it on a working laptop -- mine. So, I have a liveCD called BackTrack which works on my test machine. You can see backtrack here: http://www.remote-exploit.org/index.php/BackTrack
Once in the linux xwindow desktop, or command line, I am getting access denied errors when trying to access both the ntfs hard drive and the usb key drive. I have about five weeks of linux experience, so need all the help I can get mounting the ntfs with read only access and then copying windows office documents to a usb drive.
Can you help??
My idea is to use a linux liveCD to boot and then copy files (read-only) from the crashed win2k NTFS partition and copy files to a USB key drive.
Of course, before I try it on the crashing hard drive (which could cause more damage, I know)... I want to try it on a working laptop -- mine. So, I have a liveCD called BackTrack which works on my test machine. You can see backtrack here: http://www.remote-exploit.org/index.php/BackTrack
Once in the linux xwindow desktop, or command line, I am getting access denied errors when trying to access both the ntfs hard drive and the usb key drive. I have about five weeks of linux experience, so need all the help I can get mounting the ntfs with read only access and then copying windows office documents to a usb drive.
Can you help??
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I have knoppix around here somewhere.... lol! I will give above a try and post back.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks for the input Glenn; well taken.
Okay, here's an update:
On my working test laptop, I can get the Backtrack and Knoppix liveCD scenarios to work 100%. Both USB and NTFS were auto mounted and the fstab was automatically updated. I used Konqueror to navigate and copied files off to the USB drive no problem because USB is formatted as FAT.
On subject laptop, both Backtrack and Knoppix have problems mounting the crashed drive, with lots of segment errors popping up. Finally, after some time, Backtrack will come up to the login and let me into the root command line. At this point I believe the drives are mounted. However, I normally type "startx" to invoke the graphical user desktop.
This time, I get errors as follows:
(EE) VESA(0): No matching modes
(EE) Screen(s) found, but none have a useable configuration.
Fatal server error:
No screens found.
I rebooted and let the drive thrash around more, and came up with the exact same results the second time. This leads me to believe that the sectors that are bad will remain bad and hopefully not spread.
So, what I need now are instructions on how to navigate folders and how to copy files *from the linux command line*.
Okay, here's an update:
On my working test laptop, I can get the Backtrack and Knoppix liveCD scenarios to work 100%. Both USB and NTFS were auto mounted and the fstab was automatically updated. I used Konqueror to navigate and copied files off to the USB drive no problem because USB is formatted as FAT.
On subject laptop, both Backtrack and Knoppix have problems mounting the crashed drive, with lots of segment errors popping up. Finally, after some time, Backtrack will come up to the login and let me into the root command line. At this point I believe the drives are mounted. However, I normally type "startx" to invoke the graphical user desktop.
This time, I get errors as follows:
(EE) VESA(0): No matching modes
(EE) Screen(s) found, but none have a useable configuration.
Fatal server error:
No screens found.
I rebooted and let the drive thrash around more, and came up with the exact same results the second time. This leads me to believe that the sectors that are bad will remain bad and hopefully not spread.
So, what I need now are instructions on how to navigate folders and how to copy files *from the linux command line*.
This time, I get errors as follows:
(EE) VESA(0): No matching modes
(EE) Screen(s) found, but none have a useable configuration.
Fatal server error:
No screens found.
--------------------------
This error message leads me to beleive X server isn't configurred properly so you might wish to do that first
simply because even minimal GUI is better than CLI ( command-line-interface). I know, I know, Linux
gurus here at EE would say something quite opposite.
But , as I said, youshould at least try to get minimal GUI by properly configuring X server.
SO navigate to /etc/X11/ and run xorgconfigure tool and follow instructions and questions.
Once you have new ( and hopefully properly configured) xorg.conf file you can run : startx to get GUI up and running on that failing laptop.
GUI will help you avoid typing long file names and other problems related to navigating through directory structure in W2K e.g. cd /mnt/w2k/Documents and Settings/username/My Documents/
cp /mnt/w2k/Documents and Settings/username/My Documents/*.* /mnt/sda1
and so on
--------------------------
(EE) VESA(0): No matching modes
(EE) Screen(s) found, but none have a useable configuration.
Fatal server error:
No screens found.
--------------------------
This error message leads me to beleive X server isn't configurred properly so you might wish to do that first
simply because even minimal GUI is better than CLI ( command-line-interface). I know, I know, Linux
gurus here at EE would say something quite opposite.
But , as I said, youshould at least try to get minimal GUI by properly configuring X server.
SO navigate to /etc/X11/ and run xorgconfigure tool and follow instructions and questions.
Once you have new ( and hopefully properly configured) xorg.conf file you can run : startx to get GUI up and running on that failing laptop.
GUI will help you avoid typing long file names and other problems related to navigating through directory structure in W2K e.g. cd /mnt/w2k/Documents and Settings/username/My Documents/
cp /mnt/w2k/Documents and Settings/username/My Documents/*.* /mnt/sda1
and so on
--------------------------
ASKER
Hmm, I don't have an X11 inside the etc directory. I have a vga.
I'm sorry,my bad!
xorgconfig executable file for configuring Xserver is usually located in /usr/X11R6/bin folder
xorgconfig executable file for configuring Xserver is usually located in /usr/X11R6/bin folder
Since I'm not familiar with BackTrack and Knoppix LiveCD file systems and directory structure while they are running in Live CD mode nor I can tell you for sure from top of my head whether they keep same directory layout as when the're installed on hard-disk, you should try to locate xorgconf file by typing this command:
locate xorgconf
locate xorgconf
ASKER
'nother update:
Knoppix is now able to boot without problems. BackTrack takes forever, and has xwindow problems.
When in Knoppix, I made the USB drive writeable and created a new folder and html doc to test.
However, my mounted hard drive (hda1 and hda2) show 0 files and appears empty.
BackTrack is able to list the directory of hda1 without problem. hda2, of course, is the one I want.
Why is Knoppix not seeing anything in either NTFS partition?
Knoppix is now able to boot without problems. BackTrack takes forever, and has xwindow problems.
When in Knoppix, I made the USB drive writeable and created a new folder and html doc to test.
However, my mounted hard drive (hda1 and hda2) show 0 files and appears empty.
BackTrack is able to list the directory of hda1 without problem. hda2, of course, is the one I want.
Why is Knoppix not seeing anything in either NTFS partition?
"Why is Knoppix not seeing anything in either NTFS partition?"
What version Knoppix do you have ? If it's an older one it may be related to the missing kernel support for NTFS?!?
Or you just have to mount partitions first manually to get directory lisiting.
While in Knoppix open terminal console and type :
uname -a
or uname -r
to get Knoppix version number
What version Knoppix do you have ? If it's an older one it may be related to the missing kernel support for NTFS?!?
Or you just have to mount partitions first manually to get directory lisiting.
While in Knoppix open terminal console and type :
uname -a
or uname -r
to get Knoppix version number
ASKER
Wow, I had a streak of good luck, thanks to you guys, nedvis, gns and alextoft! After literally massaging the breaking drive, I GOT THE FILES I NEEDED ONTO USB!
I even started to grab other files I found here and there. The drive miraculously was almost bootable again! I saw Windows trying to start. So I jumped in with Knoppix and grabbed the entire My Documents folder of the user I needed.
The tips above should get anyone saved as long as the platter in the disk is not toast.
On the next boot after I got the files off... nothing shows up again on hda2 or hda1. LOL! Just AWESOME GUYS!! Thanks!
I even started to grab other files I found here and there. The drive miraculously was almost bootable again! I saw Windows trying to start. So I jumped in with Knoppix and grabbed the entire My Documents folder of the user I needed.
The tips above should get anyone saved as long as the platter in the disk is not toast.
On the next boot after I got the files off... nothing shows up again on hda2 or hda1. LOL! Just AWESOME GUYS!! Thanks!
That's exactly what I meant by "I don't think it's the most suitable LiveCD for what you actually need to do ( data recovery)" in my previous post.
So,yes, downloading Knoppix LiveCD would be worth a try.