Computer First Aid Using Knoppix

[namnemet]

my windows nt would not start - recognises the two partitions i had as one....
heard that i can fix this and more through knoppix

read here that information on this is available in an artical called:"Computer First Aid Using Knoppix"
but the documentation section id down for maintanance....


WHERE CAN I FIND RELEVENT INFORMATION FOR FIXING MY WINDOWS XP?

thanx
thanx

desparately

namnemet

[chris-harry]

fix win xp.... *laugh really really loudly*... FIX XP!!! impossible, not even mirosoft can fix every problem in it, its got more holes in it then a sive...

any way... do you have lilo loaded... because by the sounds of it, you might need lilo... its a program that does duel booting...

[Harry Kuhman]

my windows nt would not start - recognises the two partitions i had as one....
heard that i can fix this and more through knoppix
Can you give a little more detail on what you are and are not seeing? Am I to understand that you had 2 partitions (C and D) and now you can only see C but D seems lost?

You very well may be able to recover data from what windows called D with Knoppix. Then again, the partition may be more damaged than you think or hope. Do you have a copy of Knoppix yet? If not I suggest that you start by following the get Knoppix link near the top of this page and download the iso file (Bittorrent would be a very good choice of how to do that). Get the MD5 file too (it will come automatically if you get by Bittorrent, otherwise get it manually) and confirm that the md5 sum is right before you burn the CD. Burn the CD as an image file. Then try booting Knoppix and see how many hard drive partitions you have on the desktop. Sounds like you want to have both hda1 and hda5, hda5 should contain the missing files.

The next issue is how you're going to recover these files. It's unlikely that you would be able to find what's wrong with the partition and fix it (an exercise beyond the scope of this post). So you most likely will need to move the files you want somewhere else (assuming you can find them). Now come the questions: How big is the partition? Do you need all of it, or just key data? How much do you really need to recover? Where are you going to put that data? Were you running NTSF partitions on your NT system? (Warning: Knoppix can read NTFS partitions just fine, but should not be used to write to NTFS partitions, so don't plan on using available space on "C" if it is NTFS. If it's fat on the other hand, this might be a great place to put the files you need, if there is space.

Other options, depending on your circumstances: Is it a desktop system that you could add another drive to, with one or more nice empty FAT partitions? Do you have a network available that you could transfer the files across to another machine (and space there for them)? Might you hide them somewhere on the Internet for a little while (reasonable if a few hundred megs or so and you have a DSL connection or better, bad idea if you want to save over 100 gig and/or have dial-up). Would the files be small enough to fit on CDRs, USB pen drives, or other storage and have you got the needed hardware? In short, figure out where to move the files while you delete and repartition/reformat the partition.

Then move the files, confirm that you have a good copy of everything you need and can't reinstall, and there are several tools on the Knoppix CD that will let you "fix" the partition by deleteing and recreating it.

If you can't see the hda5 partition under Knoppix, all is not lost. There are other programs that run from Live Linux CDs that can recover data from deleted partitions, but lets get answers to the above before we stray to those solutions.

[namnemet]

Thanx Harry :-)

really good meticulous great reply. Thank You.

i've found both hda1 and hda5 but cannot find my missing files....
you mentioned that there might be another way of retrieving them... live lynux cd's you mentioned... or that not be what i need at all?

i can't say thanks enough - the documentationarea is still down for Maintenance and the documents i found at the download area are in German.... (i was so desperate i even tried giving them a shot :-)

thanx so much

na'aman (namnemet)

[Harry Kuhman]

i've found both hda1 and hda5 but cannot find my missing files....
you mentioned that there might be another way of retrieving them........
Well, if you can see both hda1 and hda5 but the files still seem missing, the first question I would ask (certainly before doing anything with the link I will post later in this message) is "What happened to them?". It would serve you well to try to understand if something deleted them (and if so, what), if they are just not where you think they are, if they are on yet another (missing) partition, or some other issue that I can't think of at the moment. If the missing files have been over-written then you may well be out of luck. The Linux tool I know of to try to get back deleted partitions (and perhaps deleted files, I'm not sure) is Helix (http://www.e-fense.com/helix/download.htm). But please understand that although I've booted it and played with it some, I've never done the recovery that you're looking at with it, so proceeded with great caution and care, and make sure you don't do yourself more harm than good (if there is anything on the disk that you can see that you want to be sure you save, now would be an awful good time to make a backup of it). There are also, of course, a number of DOS based hard drive recovery tools, (including software that is said to let DOS read NTFS partitions, as well as deleted file recovery software). Don't get so caught up in the fix windows problems with Linux approach that you overlook using these if they would be a better fit.

Good Luck,

[gnarvaja]

2 Comments to add to Harry's already detailed information:

1. I recommend you to get a USB memory stick and install autopsy (apt-get install autopsy or equivalent command based on your installation), which also installs the sleuthkit. The sleuthkit has a lot of interesting forensic tools.

2. If you plan in writing to the NTFS partitions, you may want to use the 2.6 kernel. AFAIK it does a better job at handling NTFS. Write to NTFS at your *own* risk and only with proper backups.

Good luck,

--GN

[namnemet]

Thanx Harry and gnarvaja.

I'll try the Helix first and download autopsy with sleuthkit... :-)
thanx

Harry mentioned that there are some DOS recovery tools - i tried searching for one those, gave up and then someone recomended Knnopix.
I would really appreciate if you could tell me the name of one of the DOS based recovery tools...

thank you so much!


na'aman

[Harry Kuhman]

I would really appreciate if you could tell me the name of one of the DOS based recovery tools...
Unfortunately, many DOS recovery tools, particularly ones that claim to be able to recover from NTFS partitions, want a lot of money before they will sell the software to you. The software tends to be only available by download and hard to get a good evaluation of. So I approach all such software with great reservation; I am not recommending any of this software.

That said, a couple of years ago when I last did a search for someone, Google turned up a lot of NTFS recovery software. I'll leave it to you to find the right keywords, but I expect I would have included NTFS and recovery in there.

A lot of the issues may still stem on what happened to cause this. If it's a bad sector or related issue on the hard drive, then Steve Gibson's excelent Spinrite (http://www.grc.com/sr/spinrite.htm) might help. Version 6 has come out recently, and it does have NTFS support. Unfortunately, like others, Steve wants his money up front, and is commanding $90 for this little 170k program (size isn't everything). However, if something has deleted a partition or you have other software issues, then I doubt that Spinrite would help, it's more of a hard disk recovery tool than a partition recovery tool. And let me state flat out that I have not used Spinrite 6 and so I can not recommend it, although Steve is highly regarded in this area.

There is a shareware tool called Active@ Partition Recovery (http://www.partition-recovery.com/partition.htm). Claims to work on NTFS. Again, I make no recommentation, have not used it.

Maybe someone else with experience with some DOS tools will join in.

[gnarvaja]

I would really appreciate if you could tell me the name of one of the DOS based recovery tools...
[...]
That said, a couple of years ago when I last did a search for someone, Google turned up a lot of NTFS recovery software. I'll leave it to you to find the right keywords, but I expect I would have included NTFS and recovery in there.
[...]
Maybe someone else with experience with some DOS tools will join in.
Been there, done that, got the T-shirt and the logos faded.
Keep in mind that most recovery tools are *one-shot* unless you are a corporate customer with thousands of PCs running M$FT software. So, if you don't get your $$$ up front, you're screwed.
What I noticed over the years is 2 facts that may help you in your decisions:
a. Companies and products in this niche come and go really quickly. Check with the real juggernauts like Symantec or McAffee, they have plenty of reasonable priced tools.
b. *nix tools that can read NTFS should be enough to get the data out, back it up on CD or DVD media which you can restore on a healthy machine. If anything, they should be able to burn images that you can repare when restoring to a healthy HD.

My .02 (currency of choice)

--GN

[rrfish72]

What 2 partitions do yo have? What did you do to create this problem? Or is it a M$ prob?