Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Trying to Recover Files from Dead NTFS Partition

Posted on 2009-04-07
13
Medium Priority
?
823 Views
Last Modified: 2013-11-30
I have an old HP tower computer running Windows XP that no longer boots up due to a bad HDD. I pulled the HDD out and put it into an external enclosure. When I attach the enclosure to my Windows laptop, it can only see and read the files on the FAT32 partition that contains the HP Recovery Partition. It does not see the larger NTFS partition that holds the OS.

When I attach the enclosure to my Linux laptop, Konqueror shows  both partitions but it shows no files in the NTFS partition. I used GParted and it shows both partitions A 5.03 Gig Fat32 partition and a 69.5 Gig NTFS partition.

This HDD drive is clearly on its deathbed. But I'd like to be able to read the NTFS volume to see if I can browse and possibly recover some files.

Anybody have any suggestions on how I might be able to do this, either in Linux or Windows?
0
Comment
Question by:anuneznyc
13 Comments
 
LVL 8

Accepted Solution

by:
skywalker39 earned 400 total points
ID: 24092446
0
 
LVL 18

Expert Comment

by:larstr
ID: 24092501
Try booting your system from the System Rescue CD and see if it can read the data. Has helped me save data on several occations.

Lars
0
 
LVL 1

Assisted Solution

by:RecoveryMan
RecoveryMan earned 400 total points
ID: 24092645
I would suggest the drive has some had blocks causing it to fail when attempting to load the OS. If the drive had failed completely the recovery partition would not be visable. If the data on the drive is important the drive should be imaged first...while techs are quick to link recovery software beware if the drive is failing running any retail software will quicken this process and is a risky process. However cloning equipment is expensive so if the data is not vital I would suggest using filescavenger www.quetek.com/prod02.htm as its lean and in my 5 yrs of using it works great. DO NOT download it on the damaged drive. Other option would be to use chkdsk /r /f from XP Recovery console but this is more risky but probably would resolve the issue to. If the data is vital contact me at www.datarecoveryman.com - Good luck!
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 1

Assisted Solution

by:sfcman
sfcman earned 400 total points
ID: 24092729
First things first you need to decide how important that data is to you; ask yourself if that data is worth putting effort into precautionary measures, or if it's of no real significance and you

don't mind going the haphazard way.

If you're data is critical / very important:

1) Then it's highly recommended to create a "raw" image of the HDD/ntfs partition before continuing. You can do this by connecting your hard drive to a computer with linux and using the "dd" command (e.g.

"dd if=/dev/hda1 of=/mnt/backuphdd/hda1.img" (replace the input and output locations to what's relevant for you), if you need more help google "using dd". NB if there're problems creating a raw image with

dd try using ddrescue, again google on usage). Alternatively you could download Knoppix Live CD and use that instead: please note that the target file system must support file sizes greater than 4GB (e.g.

NTFS).

2) Next you'll need to check for (and try to fix) bad sectors using software like Spinrite or HDD Regenerator or a free alternative (google!).

Once this is complete you're safe to move on to the next part.


(You can skip the above if you're data isn't critical and you don't mind potentially losing it or making you're life harder when you try to recovery it!)

3) Either boot into recovery console from a Windows XP installation media (CD) or connect the HDD to another windows computer and then run chkdsk (/r from recovery console or /f from the secondary windows installation) on the broken or empty partition.

4) !IF you can't access the partition from the recovery console or the windows install try using a software like Testdisk (freeware, again google) in either linux or windows, on the hard drive with the missing data. You may be able to rebuild the partition table (if that's corrupt), if this is successful then try running chkdsk on it.

Good luck!
0
 
LVL 35

Assisted Solution

by:torimar
torimar earned 400 total points
ID: 24093652
I suggest this course of action:

1.) Try "TestDisk" (http://www.cgsecurity.org/wiki/TestDisk); it runs under Windows and Linux, and it is one of the best (free) tools around to revive faulty hard drives.

Here's what it is able of doing:
-Fix partition table, recover deleted partition
-Recover FAT32 boot sector from its backup
-Rebuild FAT12/FAT16/FAT32 boot sector
-Fix FAT tables
-Rebuild NTFS boot sector
-Recover NTFS boot sector from its backup
-Fix MFT using MFT mirror
-Locate ext2/ext3 Backup SuperBlock
-Undelete files from FAT, NTFS and ext2 filesystem
-Copy files from deleted FAT, NTFS and ext2/ext3 partitions

Check out this step-by-step guide on using TestDisk:
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step


2.) If TestDisk fails, this means that your hard drive most likely is physically damaged. In this case, the best tool by far for many years has been "Spinrite": http://www.grc.com/spinrite.htm

Spinrite has an impressive record of reviving allegedly lost data from failing drives, but it is commercial.
0
 
LVL 47

Assisted Solution

by:noxcho
noxcho earned 400 total points
ID: 24094599
Try GetDataBack from www.runtime.org, the best data recovery software I've ever used.
Also, good solution for HDD that has bad blocks on it is R-Studio: http://www.r-studio.com/
0
 
LVL 1

Expert Comment

by:RecoveryMan
ID: 24117828
Would like to add if the drive has unc errors or other significant block that cause the drive not to repond when reading (very typical) creating a RAW image whether a raw image from linux, knoppix or ftk etc will typically fail. RAW image mechanisms are not designed to handle failing drives infact even hard ware device like hard-copy II which are hard ware based have a hard time. Operating systems are to high level to handle that kind of low level failure and will quit or make the situation worse. When giving advice of how to recover critical data it is very important that the correct equipment is used - software typically with professional data recovery techniques are used once the drive has been stabilized not first. However I understand that the price of this type of recovery can be prohibitive but you pay for what you get.
Also question for 'torimar' something I've heard many times and don't get. Why would you attempt to fix bad areas on a drive? Bad areas on a drive are a likely a result of the p / g list over flowing with bad areas and these 'spare' blocks not being able to deal with the errors occuring on the media...so in a nut shell the drive is failing. My suggestion is get the data, image the drive if you can and buy a new drive!
0
 
LVL 35

Expert Comment

by:torimar
ID: 24359740
I object to the suggested closing procedure.

I do not see why the recommended comment should be the only possible solution to this problem, especially since it contains only a collection of uncommented links.

I suggest to split points evenly between these posts:
skywalker39 (ID: http:#a24092446)
recoveryman (ID: http:#a24092645)
sfcman (ID: http:#a24092729)
torimar (ID: http:#a24093652)
noxcho (ID: http:#a24094599)
0
 
LVL 1

Expert Comment

by:RecoveryMan
ID: 24359941
I agree - why would you award all points to just links suggested. This is supposed to be experts-exchange not link-exchange...I'm no 'expert' on E-E but have been recovering data professionally for many years to tell you most of those recovery programs suggested are not worth the html they are typed on :-)
0
 

Author Comment

by:anuneznyc
ID: 24360603
Hello Contributing Experts. Thank you all for helpful suggestions. My apologies for the apparent abandonment of this question. It was just that a lot of other things came up since I first posted the question, so this one took a backseat.

I tried a few of the suggestions. Recovery Console & CHKDSK didn't do squat. I think I tried I tried a couple of the programs suggested, but none of them would recognize anything except the HP Recovery partition that has been viewable all along.

I'm going to try Spinrite to see whether it's golden reputation is well-deserved.

rindi: Please do not close this question out just yet. I would like to have time to post the results of my experience w/ Spinrite. Thanks.
0

Featured Post

Ask an Anonymous Question!

Don't feel intimidated by what you don't know. Ask your question anonymously. It's easy! Learn more and upgrade.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Employees depend heavily on their PCs, and new threats like ransomware make it even more critical to protect their important data.
Steps to fix error: “Couldn’t mount the database that you specified. Specified database: HU-DB; Error code: An Active Manager operation fail”
In this Micro Tutorial viewers will learn how to restore their server from Bare Metal Backup image created with Windows Server Backup feature. As an example Windows 2012R2 is used.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…

885 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question