Trying to Recover Files from Dead NTFS Partition

I have an old HP tower computer running Windows XP that no longer boots up due to a bad HDD. I pulled the HDD out and put it into an external enclosure. When I attach the enclosure to my Windows laptop, it can only see and read the files on the FAT32 partition that contains the HP Recovery Partition. It does not see the larger NTFS partition that holds the OS.

When I attach the enclosure to my Linux laptop, Konqueror shows  both partitions but it shows no files in the NTFS partition. I used GParted and it shows both partitions A 5.03 Gig Fat32 partition and a 69.5 Gig NTFS partition.

This HDD drive is clearly on its deathbed. But I'd like to be able to read the NTFS volume to see if I can browse and possibly recover some files.

Anybody have any suggestions on how I might be able to do this, either in Linux or Windows?
Who is Participating?
Try booting your system from the System Rescue CD and see if it can read the data. Has helped me save data on several occations.

I would suggest the drive has some had blocks causing it to fail when attempting to load the OS. If the drive had failed completely the recovery partition would not be visable. If the data on the drive is important the drive should be imaged first...while techs are quick to link recovery software beware if the drive is failing running any retail software will quicken this process and is a risky process. However cloning equipment is expensive so if the data is not vital I would suggest using filescavenger as its lean and in my 5 yrs of using it works great. DO NOT download it on the damaged drive. Other option would be to use chkdsk /r /f from XP Recovery console but this is more risky but probably would resolve the issue to. If the data is vital contact me at - Good luck!
Network Scalability - Handle Complex Environments

Monitor your entire network from a single platform. Free 30 Day Trial Now!

First things first you need to decide how important that data is to you; ask yourself if that data is worth putting effort into precautionary measures, or if it's of no real significance and you

don't mind going the haphazard way.

If you're data is critical / very important:

1) Then it's highly recommended to create a "raw" image of the HDD/ntfs partition before continuing. You can do this by connecting your hard drive to a computer with linux and using the "dd" command (e.g.

"dd if=/dev/hda1 of=/mnt/backuphdd/hda1.img" (replace the input and output locations to what's relevant for you), if you need more help google "using dd". NB if there're problems creating a raw image with

dd try using ddrescue, again google on usage). Alternatively you could download Knoppix Live CD and use that instead: please note that the target file system must support file sizes greater than 4GB (e.g.


2) Next you'll need to check for (and try to fix) bad sectors using software like Spinrite or HDD Regenerator or a free alternative (google!).

Once this is complete you're safe to move on to the next part.

(You can skip the above if you're data isn't critical and you don't mind potentially losing it or making you're life harder when you try to recovery it!)

3) Either boot into recovery console from a Windows XP installation media (CD) or connect the HDD to another windows computer and then run chkdsk (/r from recovery console or /f from the secondary windows installation) on the broken or empty partition.

4) !IF you can't access the partition from the recovery console or the windows install try using a software like Testdisk (freeware, again google) in either linux or windows, on the hard drive with the missing data. You may be able to rebuild the partition table (if that's corrupt), if this is successful then try running chkdsk on it.

Good luck!
I suggest this course of action:

1.) Try "TestDisk" (; it runs under Windows and Linux, and it is one of the best (free) tools around to revive faulty hard drives.

Here's what it is able of doing:
-Fix partition table, recover deleted partition
-Recover FAT32 boot sector from its backup
-Rebuild FAT12/FAT16/FAT32 boot sector
-Fix FAT tables
-Rebuild NTFS boot sector
-Recover NTFS boot sector from its backup
-Fix MFT using MFT mirror
-Locate ext2/ext3 Backup SuperBlock
-Undelete files from FAT, NTFS and ext2 filesystem
-Copy files from deleted FAT, NTFS and ext2/ext3 partitions

Check out this step-by-step guide on using TestDisk:

2.) If TestDisk fails, this means that your hard drive most likely is physically damaged. In this case, the best tool by far for many years has been "Spinrite":

Spinrite has an impressive record of reviving allegedly lost data from failing drives, but it is commercial.
noxchoGlobal Support CoordinatorCommented:
Try GetDataBack from, the best data recovery software I've ever used.
Also, good solution for HDD that has bad blocks on it is R-Studio:
Would like to add if the drive has unc errors or other significant block that cause the drive not to repond when reading (very typical) creating a RAW image whether a raw image from linux, knoppix or ftk etc will typically fail. RAW image mechanisms are not designed to handle failing drives infact even hard ware device like hard-copy II which are hard ware based have a hard time. Operating systems are to high level to handle that kind of low level failure and will quit or make the situation worse. When giving advice of how to recover critical data it is very important that the correct equipment is used - software typically with professional data recovery techniques are used once the drive has been stabilized not first. However I understand that the price of this type of recovery can be prohibitive but you pay for what you get.
Also question for 'torimar' something I've heard many times and don't get. Why would you attempt to fix bad areas on a drive? Bad areas on a drive are a likely a result of the p / g list over flowing with bad areas and these 'spare' blocks not being able to deal with the errors occuring on the in a nut shell the drive is failing. My suggestion is get the data, image the drive if you can and buy a new drive!
I object to the suggested closing procedure.

I do not see why the recommended comment should be the only possible solution to this problem, especially since it contains only a collection of uncommented links.

I suggest to split points evenly between these posts:
skywalker39 (ID: http:#a24092446)
recoveryman (ID: http:#a24092645)
sfcman (ID: http:#a24092729)
torimar (ID: http:#a24093652)
noxcho (ID: http:#a24094599)
I agree - why would you award all points to just links suggested. This is supposed to be experts-exchange not link-exchange...I'm no 'expert' on E-E but have been recovering data professionally for many years to tell you most of those recovery programs suggested are not worth the html they are typed on :-)
anuneznycAuthor Commented:
Hello Contributing Experts. Thank you all for helpful suggestions. My apologies for the apparent abandonment of this question. It was just that a lot of other things came up since I first posted the question, so this one took a backseat.

I tried a few of the suggestions. Recovery Console & CHKDSK didn't do squat. I think I tried I tried a couple of the programs suggested, but none of them would recognize anything except the HP Recovery partition that has been viewable all along.

I'm going to try Spinrite to see whether it's golden reputation is well-deserved.

rindi: Please do not close this question out just yet. I would like to have time to post the results of my experience w/ Spinrite. Thanks.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.