Solved

Trying to Recover Files from Dead NTFS Partition

Posted on 2009-04-07
13
780 Views
Last Modified: 2013-11-30
I have an old HP tower computer running Windows XP that no longer boots up due to a bad HDD. I pulled the HDD out and put it into an external enclosure. When I attach the enclosure to my Windows laptop, it can only see and read the files on the FAT32 partition that contains the HP Recovery Partition. It does not see the larger NTFS partition that holds the OS.

When I attach the enclosure to my Linux laptop, Konqueror shows  both partitions but it shows no files in the NTFS partition. I used GParted and it shows both partitions A 5.03 Gig Fat32 partition and a 69.5 Gig NTFS partition.

This HDD drive is clearly on its deathbed. But I'd like to be able to read the NTFS volume to see if I can browse and possibly recover some files.

Anybody have any suggestions on how I might be able to do this, either in Linux or Windows?
0
Comment
Question by:anuneznyc
13 Comments
 
LVL 8

Accepted Solution

by:
skywalker39 earned 100 total points
ID: 24092446
0
 
LVL 18

Expert Comment

by:larstr
ID: 24092501
Try booting your system from the System Rescue CD and see if it can read the data. Has helped me save data on several occations.

Lars
0
 
LVL 1

Assisted Solution

by:RecoveryMan
RecoveryMan earned 100 total points
ID: 24092645
I would suggest the drive has some had blocks causing it to fail when attempting to load the OS. If the drive had failed completely the recovery partition would not be visable. If the data on the drive is important the drive should be imaged first...while techs are quick to link recovery software beware if the drive is failing running any retail software will quicken this process and is a risky process. However cloning equipment is expensive so if the data is not vital I would suggest using filescavenger www.quetek.com/prod02.htm as its lean and in my 5 yrs of using it works great. DO NOT download it on the damaged drive. Other option would be to use chkdsk /r /f from XP Recovery console but this is more risky but probably would resolve the issue to. If the data is vital contact me at www.datarecoveryman.com - Good luck!
0
 
LVL 1

Assisted Solution

by:sfcman
sfcman earned 100 total points
ID: 24092729
First things first you need to decide how important that data is to you; ask yourself if that data is worth putting effort into precautionary measures, or if it's of no real significance and you

don't mind going the haphazard way.

If you're data is critical / very important:

1) Then it's highly recommended to create a "raw" image of the HDD/ntfs partition before continuing. You can do this by connecting your hard drive to a computer with linux and using the "dd" command (e.g.

"dd if=/dev/hda1 of=/mnt/backuphdd/hda1.img" (replace the input and output locations to what's relevant for you), if you need more help google "using dd". NB if there're problems creating a raw image with

dd try using ddrescue, again google on usage). Alternatively you could download Knoppix Live CD and use that instead: please note that the target file system must support file sizes greater than 4GB (e.g.

NTFS).

2) Next you'll need to check for (and try to fix) bad sectors using software like Spinrite or HDD Regenerator or a free alternative (google!).

Once this is complete you're safe to move on to the next part.


(You can skip the above if you're data isn't critical and you don't mind potentially losing it or making you're life harder when you try to recovery it!)

3) Either boot into recovery console from a Windows XP installation media (CD) or connect the HDD to another windows computer and then run chkdsk (/r from recovery console or /f from the secondary windows installation) on the broken or empty partition.

4) !IF you can't access the partition from the recovery console or the windows install try using a software like Testdisk (freeware, again google) in either linux or windows, on the hard drive with the missing data. You may be able to rebuild the partition table (if that's corrupt), if this is successful then try running chkdsk on it.

Good luck!
0
 
LVL 35

Assisted Solution

by:torimar
torimar earned 100 total points
ID: 24093652
I suggest this course of action:

1.) Try "TestDisk" (http://www.cgsecurity.org/wiki/TestDisk); it runs under Windows and Linux, and it is one of the best (free) tools around to revive faulty hard drives.

Here's what it is able of doing:
-Fix partition table, recover deleted partition
-Recover FAT32 boot sector from its backup
-Rebuild FAT12/FAT16/FAT32 boot sector
-Fix FAT tables
-Rebuild NTFS boot sector
-Recover NTFS boot sector from its backup
-Fix MFT using MFT mirror
-Locate ext2/ext3 Backup SuperBlock
-Undelete files from FAT, NTFS and ext2 filesystem
-Copy files from deleted FAT, NTFS and ext2/ext3 partitions

Check out this step-by-step guide on using TestDisk:
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step


2.) If TestDisk fails, this means that your hard drive most likely is physically damaged. In this case, the best tool by far for many years has been "Spinrite": http://www.grc.com/spinrite.htm

Spinrite has an impressive record of reviving allegedly lost data from failing drives, but it is commercial.
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 46

Assisted Solution

by:noxcho
noxcho earned 100 total points
ID: 24094599
Try GetDataBack from www.runtime.org, the best data recovery software I've ever used.
Also, good solution for HDD that has bad blocks on it is R-Studio: http://www.r-studio.com/
0
 
LVL 1

Expert Comment

by:RecoveryMan
ID: 24117828
Would like to add if the drive has unc errors or other significant block that cause the drive not to repond when reading (very typical) creating a RAW image whether a raw image from linux, knoppix or ftk etc will typically fail. RAW image mechanisms are not designed to handle failing drives infact even hard ware device like hard-copy II which are hard ware based have a hard time. Operating systems are to high level to handle that kind of low level failure and will quit or make the situation worse. When giving advice of how to recover critical data it is very important that the correct equipment is used - software typically with professional data recovery techniques are used once the drive has been stabilized not first. However I understand that the price of this type of recovery can be prohibitive but you pay for what you get.
Also question for 'torimar' something I've heard many times and don't get. Why would you attempt to fix bad areas on a drive? Bad areas on a drive are a likely a result of the p / g list over flowing with bad areas and these 'spare' blocks not being able to deal with the errors occuring on the media...so in a nut shell the drive is failing. My suggestion is get the data, image the drive if you can and buy a new drive!
0
 
LVL 35

Expert Comment

by:torimar
ID: 24359740
I object to the suggested closing procedure.

I do not see why the recommended comment should be the only possible solution to this problem, especially since it contains only a collection of uncommented links.

I suggest to split points evenly between these posts:
skywalker39 (ID: http:#a24092446)
recoveryman (ID: http:#a24092645)
sfcman (ID: http:#a24092729)
torimar (ID: http:#a24093652)
noxcho (ID: http:#a24094599)
0
 
LVL 1

Expert Comment

by:RecoveryMan
ID: 24359941
I agree - why would you award all points to just links suggested. This is supposed to be experts-exchange not link-exchange...I'm no 'expert' on E-E but have been recovering data professionally for many years to tell you most of those recovery programs suggested are not worth the html they are typed on :-)
0
 

Author Comment

by:anuneznyc
ID: 24360603
Hello Contributing Experts. Thank you all for helpful suggestions. My apologies for the apparent abandonment of this question. It was just that a lot of other things came up since I first posted the question, so this one took a backseat.

I tried a few of the suggestions. Recovery Console & CHKDSK didn't do squat. I think I tried I tried a couple of the programs suggested, but none of them would recognize anything except the HP Recovery partition that has been viewable all along.

I'm going to try Spinrite to see whether it's golden reputation is well-deserved.

rindi: Please do not close this question out just yet. I would like to have time to post the results of my experience w/ Spinrite. Thanks.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

I wrote an article (http://www.experts-exchange.com/articles/2245/Anti-rootkit-software.html) some time ago with a reference to nLite  (http://www.nliteos.com/)slipstreaming software.  I recently changed that link to point to NTLite (https://www.ntl…
Storage devices are generally used to save the data or sometime transfer the data from one computer system to another system. However, sometimes user accidentally erased their important data from the Storage devices. Users have to know how data reco…
In this Micro Tutorial viewers will learn how they can get their files copied out from their unbootable system without need to use recovery services. As an example non-bootable Windows 2012R2 installation is used which has boot problems.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now