?
Solved

Linux-based Data Recovery

Posted on 2011-10-06
10
Medium Priority
?
381 Views
Last Modified: 2012-05-12
I have a Windows IDE drive that has crashed. I could not get the Windows XP operation system on another computer to recognize it, so R-studio was of no use. I tried detecting it on Mac OSX as well to no avail. I tried booting {Comment edited out} into a Linux session and the drive shows up there. Is there a data recovery program that runs under Linux that I can use to recover the data from this (I assume) NTFS drive? If so, what is it and where may it be found?
0
Comment
Question by:adande3
  • 5
  • 4
10 Comments
 
LVL 88

Expert Comment

by:rindi
ID: 36926173
Boot the PC using PartedMagic, and then run the TestDisk utility on against the bad HD. It should be able to recover data if it is still available. It also contains "PhotoRec" which can sometimes also recover data from corrupt disks:

http://partedmagic.com
0
 

Author Comment

by:adande3
ID: 36926771
rindi: I just happened to be in PartedMagic when I got your message. I found the two apps you mentioned and ran Photorec. I do not see a way to tell the software where to store the recovered data. I have working NTFS drives that are recognized in PartedMagic. How do I point to one of them in Photorec?

In the meantime, I am running a partition discovery in TestDisk. Thanks for the help so far!
0
 
LVL 88

Expert Comment

by:rindi
ID: 36926959
Mount the partition you want to save to before starting photorec. Then start the tool, and during the selection process it also will ask you where found files should be saved. Here you can then navigate to the partition you mounted and select the directory. Mounted partitions you should find within /media/sdxx.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:adande3
ID: 36927041
OK, I clicked media and there they are. Thanks again. I'll post again after I try these two apps. Looks like it's going to run for a long time. I suppose it would be unwise to run Photorec while TestDisk is still running, right?
0
 
LVL 88

Expert Comment

by:rindi
ID: 36927062
Right. It would just cause disk thrashing and take forever.
0
 

Author Comment

by:adande3
ID: 36927698
So TestDisk is done and found no partition. Do you recommend using the deep search?
0
 
LVL 88

Assisted Solution

by:rindi
rindi earned 1200 total points
ID: 36929097
If you have the time and the PC you are running the tests on isn't needed for other things, why not? Chances though are probably not too good.

Maybe what ought to be done first is to run the HD manufacturer's diagnostic utility to get some info on the drive itself (you'll find those tools on the UBCD):

http://ultimatebootcd.com

A really good tool, if the disk has errors, is to run the HF regenerator on it. The free trial can repair the first bad sector it finds, but for more you'd have to register it. I really recommend it. Maybe if it finds bad sectors and can repair them, it may be possible to read the data later:

http://www.dposoft.net/
0
 
LVL 7

Accepted Solution

by:
darrickhartman earned 300 total points
ID: 36931731
You also may want to try a utility such as ddrescue (or dd_rescue) to extract as much information as possible.  This will allow you to backup the existing data (as much as can be accessed) prior to doing anything else on the hard drive which may be destructive.

ddrescue can be run in two steps.  A first pass which reads as much information as possible and a second pass which uses information collected in the first pass to drill down into problem areas of the hard drive using as many re-tries as you specify.  

Here's a link that explains in more detail how to use ddrescue.
http://www.forensicswiki.org/wiki/Ddrescue
0
 

Author Comment

by:adande3
ID: 36932954
Thanks guys. I'll be spending my weekend on this! will post updates at least by Monday. Oh by the way the deep search with TestDisk yielded nothing. Maybe once I verify the geometry things will go better.
0
 

Author Closing Comment

by:adande3
ID: 37706251
Project was unsuccessful. Drive was probably just too far gone.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Stellar Exchange Toolkit: this 5 in 1 toolkit comes loaded with mega-software tool. Here’s an introduction to tools’ usage and advantages:
Eseutil Hard Recovery is part of exchange tool and ensures Exchange mailbox data recovery when mailbox gets corrupt due to some problem on Exchange server.
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question