Solved

Trying to Recover Files from Dead NTFS Partition

Posted on 2009-04-07
13
804 Views
Last Modified: 2013-11-30
I have an old HP tower computer running Windows XP that no longer boots up due to a bad HDD. I pulled the HDD out and put it into an external enclosure. When I attach the enclosure to my Windows laptop, it can only see and read the files on the FAT32 partition that contains the HP Recovery Partition. It does not see the larger NTFS partition that holds the OS.

When I attach the enclosure to my Linux laptop, Konqueror shows  both partitions but it shows no files in the NTFS partition. I used GParted and it shows both partitions A 5.03 Gig Fat32 partition and a 69.5 Gig NTFS partition.

This HDD drive is clearly on its deathbed. But I'd like to be able to read the NTFS volume to see if I can browse and possibly recover some files.

Anybody have any suggestions on how I might be able to do this, either in Linux or Windows?
0
Comment
Question by:anuneznyc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
13 Comments
 
LVL 8

Accepted Solution

by:
skywalker39 earned 100 total points
ID: 24092446
0
 
LVL 18

Expert Comment

by:larstr
ID: 24092501
Try booting your system from the System Rescue CD and see if it can read the data. Has helped me save data on several occations.

Lars
0
 
LVL 1

Assisted Solution

by:RecoveryMan
RecoveryMan earned 100 total points
ID: 24092645
I would suggest the drive has some had blocks causing it to fail when attempting to load the OS. If the drive had failed completely the recovery partition would not be visable. If the data on the drive is important the drive should be imaged first...while techs are quick to link recovery software beware if the drive is failing running any retail software will quicken this process and is a risky process. However cloning equipment is expensive so if the data is not vital I would suggest using filescavenger www.quetek.com/prod02.htm as its lean and in my 5 yrs of using it works great. DO NOT download it on the damaged drive. Other option would be to use chkdsk /r /f from XP Recovery console but this is more risky but probably would resolve the issue to. If the data is vital contact me at www.datarecoveryman.com - Good luck!
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 1

Assisted Solution

by:sfcman
sfcman earned 100 total points
ID: 24092729
First things first you need to decide how important that data is to you; ask yourself if that data is worth putting effort into precautionary measures, or if it's of no real significance and you

don't mind going the haphazard way.

If you're data is critical / very important:

1) Then it's highly recommended to create a "raw" image of the HDD/ntfs partition before continuing. You can do this by connecting your hard drive to a computer with linux and using the "dd" command (e.g.

"dd if=/dev/hda1 of=/mnt/backuphdd/hda1.img" (replace the input and output locations to what's relevant for you), if you need more help google "using dd". NB if there're problems creating a raw image with

dd try using ddrescue, again google on usage). Alternatively you could download Knoppix Live CD and use that instead: please note that the target file system must support file sizes greater than 4GB (e.g.

NTFS).

2) Next you'll need to check for (and try to fix) bad sectors using software like Spinrite or HDD Regenerator or a free alternative (google!).

Once this is complete you're safe to move on to the next part.


(You can skip the above if you're data isn't critical and you don't mind potentially losing it or making you're life harder when you try to recovery it!)

3) Either boot into recovery console from a Windows XP installation media (CD) or connect the HDD to another windows computer and then run chkdsk (/r from recovery console or /f from the secondary windows installation) on the broken or empty partition.

4) !IF you can't access the partition from the recovery console or the windows install try using a software like Testdisk (freeware, again google) in either linux or windows, on the hard drive with the missing data. You may be able to rebuild the partition table (if that's corrupt), if this is successful then try running chkdsk on it.

Good luck!
0
 
LVL 35

Assisted Solution

by:torimar
torimar earned 100 total points
ID: 24093652
I suggest this course of action:

1.) Try "TestDisk" (http://www.cgsecurity.org/wiki/TestDisk); it runs under Windows and Linux, and it is one of the best (free) tools around to revive faulty hard drives.

Here's what it is able of doing:
-Fix partition table, recover deleted partition
-Recover FAT32 boot sector from its backup
-Rebuild FAT12/FAT16/FAT32 boot sector
-Fix FAT tables
-Rebuild NTFS boot sector
-Recover NTFS boot sector from its backup
-Fix MFT using MFT mirror
-Locate ext2/ext3 Backup SuperBlock
-Undelete files from FAT, NTFS and ext2 filesystem
-Copy files from deleted FAT, NTFS and ext2/ext3 partitions

Check out this step-by-step guide on using TestDisk:
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step


2.) If TestDisk fails, this means that your hard drive most likely is physically damaged. In this case, the best tool by far for many years has been "Spinrite": http://www.grc.com/spinrite.htm

Spinrite has an impressive record of reviving allegedly lost data from failing drives, but it is commercial.
0
 
LVL 47

Assisted Solution

by:noxcho
noxcho earned 100 total points
ID: 24094599
Try GetDataBack from www.runtime.org, the best data recovery software I've ever used.
Also, good solution for HDD that has bad blocks on it is R-Studio: http://www.r-studio.com/
0
 
LVL 1

Expert Comment

by:RecoveryMan
ID: 24117828
Would like to add if the drive has unc errors or other significant block that cause the drive not to repond when reading (very typical) creating a RAW image whether a raw image from linux, knoppix or ftk etc will typically fail. RAW image mechanisms are not designed to handle failing drives infact even hard ware device like hard-copy II which are hard ware based have a hard time. Operating systems are to high level to handle that kind of low level failure and will quit or make the situation worse. When giving advice of how to recover critical data it is very important that the correct equipment is used - software typically with professional data recovery techniques are used once the drive has been stabilized not first. However I understand that the price of this type of recovery can be prohibitive but you pay for what you get.
Also question for 'torimar' something I've heard many times and don't get. Why would you attempt to fix bad areas on a drive? Bad areas on a drive are a likely a result of the p / g list over flowing with bad areas and these 'spare' blocks not being able to deal with the errors occuring on the media...so in a nut shell the drive is failing. My suggestion is get the data, image the drive if you can and buy a new drive!
0
 
LVL 35

Expert Comment

by:torimar
ID: 24359740
I object to the suggested closing procedure.

I do not see why the recommended comment should be the only possible solution to this problem, especially since it contains only a collection of uncommented links.

I suggest to split points evenly between these posts:
skywalker39 (ID: http:#a24092446)
recoveryman (ID: http:#a24092645)
sfcman (ID: http:#a24092729)
torimar (ID: http:#a24093652)
noxcho (ID: http:#a24094599)
0
 
LVL 1

Expert Comment

by:RecoveryMan
ID: 24359941
I agree - why would you award all points to just links suggested. This is supposed to be experts-exchange not link-exchange...I'm no 'expert' on E-E but have been recovering data professionally for many years to tell you most of those recovery programs suggested are not worth the html they are typed on :-)
0
 

Author Comment

by:anuneznyc
ID: 24360603
Hello Contributing Experts. Thank you all for helpful suggestions. My apologies for the apparent abandonment of this question. It was just that a lot of other things came up since I first posted the question, so this one took a backseat.

I tried a few of the suggestions. Recovery Console & CHKDSK didn't do squat. I think I tried I tried a couple of the programs suggested, but none of them would recognize anything except the HP Recovery partition that has been viewable all along.

I'm going to try Spinrite to see whether it's golden reputation is well-deserved.

rindi: Please do not close this question out just yet. I would like to have time to post the results of my experience w/ Spinrite. Thanks.
0

Featured Post

Secure Your WordPress Site: 5 Essential Approaches

WordPress is the web's most popular CMS, but its dominance also makes it a target for attackers. Our eBook will show you how to:

Prevent costly exploits of core and plugin vulnerabilities
Repel automated attacks
Lock down your dashboard, secure your code, and protect your users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

VM backups can be lost due to a number of reasons: accidental backup deletion, backup file corruption, disk failure, lost or stolen hardware, malicious attack, or due to some other undesired and unpredicted event. Thus, having more than one copy of …
Many businesses neglect disaster recovery and treat it as an after-thought. I can tell you first hand that data will be lost, hard drives die, servers will be hacked, and careless (or malicious) employees can ruin your data.
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question