Data recovery from HDD

[Metallo]

Hi,

Background

My brother brought me an old Samsung WU 33205A HDD of 3.5 GB that suddenly stopped to work on his PC (WXP PRO).

The scope here is to save the data on that HDD.

I have installed it on my system with the intent to help him solving the problem.
My OS is WXP PRO.

My system has recognized that a new hw was about to be installed and found the proper driver.

If I browse explorer I cannot see the hdd, therefore I went into Device Manager and saw that the "device is working properly".
Then I clicked Disk Management and I read:

Disk 1
Unknown
3,01 GB
Not Initialized

3,01 GB Unallocated

It looks like the HDD needs to be formatted.

Knoppix & myself

I am totally new to Knoppix and I was suggested to try it as a possibility to recover the data from the Samsung HDD.
I succeeded to burn a Live DVD and booted my PC.

I can see the HDD on the desktop, as well as the other HDDs on my system, in fact, if I click on them, they open neatly, but when I get to the Samsung HDD, I get a message that I cannot quote with the exact words but more or less is: the drive cannot be mounted because the file system is unknown.

The only thing I can say from my investigations is that the file system is FAT32.

Now, I am stuck and have absolutely no clou how to proceed, but I am confident someone here will help :roll:

Thank you!

Alex

[Harry Kuhman]

The good news is that it sounds like the hardware is working.

The bad news is that it seems like the data on the drive is now bad. We obviously can't be sure at this point if the files are still there at all, but there is a good chance that the partition table is just bad.

And the really good news is that Knoppix has tools that can examine the disk and recreate the partition table. Two such tools (I have no idea why there are two tools to do this) are gpart and testcd. There are man pages that you can read for each (at a command prompt type man gpart or man testcd). So far I've only used gpart, but testcd looks simpler to use.

If Knoppix can't repair the partition table for you, don't give up quite yet. There are other live CDs that have tools to pull data off such drives. One is Helix (http://www.e-fense.com/helix/).

If you post back it would be helpful to have more information about what you think was on that disk. Important information would include what OS your brother was running and what type of partition or partitions it should have. Information about what was happening when it stopped working may be helpful too.

[Metallo]

The good news is that it sounds like the hardware is working.

The bad news is that it seems like the data on the drive is now bad. We obviously can't be sure at this point if the files are still there at all, but there is a good chance that the partition table is just bad.

And the really good news is that Knoppix has tools that can examine the disk and recreate the partition table. Two such tools (I have no idea why there are two tools to do this) are gpart and testcd. There are man pages that you can read for each (at a command prompt type man gpart or man testcd). So far I've only used gpart, but testcd looks simpler to use.

If Knoppix can't repair the partition table for you, don't give up quite yet. There are other live CDs that have tools to pull data off such drives. One is Helix (http://www.e-fense.com/helix/).

If you post back it would be helpful to have more information about what you think was on that disk. Important information would include what OS your brother was running and what type of partition or partitions it should have. Information about what was happening when it stopped working may be helpful too.

Hi Harry,

Thanks for your quick reply.

Well, the OS my brother is using is WXP PRO and he realized the HDD stopped working simply because he could not see the drive letter on his PC anymore :x
The file system is FAT32.
The disc contains many .doc files but more important many .dwg files from Autocad.

I tried to recover the data with PC Inspector, I managed to get about 50%, the rest seems to be corrupted.

That's why I'd like to give another try with Knoppix.

I will have a look at the two methods you suggest and hope to understand how the whole thing work.

Thank you
Alex

[Metallo]

Follow up...

Well, I am trying to see if gpart can see the partition of my HDD, therefore I typed gpart/dev/hdb but I get the following message: no such file or directory

Can anybody help me ?

Thank you
Alex

[Metallo]

OK, here I am again...

Well, I just could not get the partition because I forgot to type a spage between gpart and /dev/hdb, which may be clear for those who are used to command but unknown to me :(

However, here is what I got:

root@Knoppix:/ramdisk/home/knoppix# gpart /dev/hdb

Begin scan...
Possible partition(DOS FAT), size(3090mb), offset(0mb)
End scan.

Checking partitions...
Partition(DOS or Windows 95 with 32 bit FAT): primary
Ok.

Guessed primary partition table:
Primary partition(1)
type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT)
size: 3090mb #s(6330177) s(63-6330239)
chs: (0/1/1)-(1023/15/63)d (0/1/1)-(6279/15/63)r

Primary partition(2)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r


AFAIK there is only one partition in the HDD, therefore what-s reported looks OK.

Now, I could go for the -W option, isn't that better to save the original partition first?
Cannot I save it on a separate folder of one of my disks?
Being into knoppix by means of a live DVD, can I write into my windows HDDs_

Thank you
Alex

[rusty]

gpart -w will write the guessed partition table, not the entire partition to a device. I'm not sure if your partition table is compromised as it seems that knoppix sees the partition?

Have you tried fsck'ing the drive? man fsck, at a command line to see options including the -n option which will not repair anything.

Another tool I hope you won't have to use is lde (linux disk editor), theres a man page for it too, and a web page : http://lde.sourceforge.net/

HTH

[Metallo]

gpart -w will write the guessed partition table, not the entire partition to a device. I'm not sure if your partition table is compromised as it seems that knoppix sees the partition?

Have you tried fsck'ing the drive? man fsck, at a command line to see options including the -n option which will not repair anything.

Another tool I hope you won't have to use is lde (linux disk editor), theres a man page for it too, and a web page : http://lde.sourceforge.net/

HTH

Hi,

Well, if my partition table is not compromised, why doesn't the HDD show up neither in WXP or cannot be open with Knoppix?

I can try fsck but I'd apprecciate if you write me the exact command because I cannot succeed :(

Thank you
Alex

[OErjan]

there are a multitude of possible answers to all your questions.
on the last one, one that i think is close to home, there may actually be too much damage on the disk for windows to read it. and even Linux would be hard pressed and likely fail to work well on a disk with physical damage.

[Metallo]

At least, can anybody tell me how to save the partition before writing the guessed one_

I need a step by step approach in order to save it on a separate folder, at least if the guessed partition does not work I can still restore the old one.

Thank you
Alex

[rusty]

to use fsck

Make sure the drive is NOT mounted
open a shell
type: man fsck

then: fsck -N /dev/hdb, which will tell you what fsck would do

read the man page for other options to use as you see fit.

[Metallo]

Rusty,

What do you exactly mean by not mounted?
Knoppix refused to mount it because it could not recognize its file system, so it should not be mounted if this is what you mean??

Thank you
Alex

[Metallo]

That's what I get if run

fsck 1.40-WIP (14-Nov-2006)
[/sbin/fsck.ext2 (1) -- /media/hdb] fsck.ext2 /dev/hdb

Nothing else :(

Alex

[Harry Kuhman]

At least, can anybody tell me how to save the partition before writing the guessed one_

You can back up a MBR (of which the partition table is a part) with


$dd if=/dev/hdx of=MBR-backup bs=512 count=1

and restore it with


$dd if=MBR-backup of=/dev/hdx bs=512 count=1

whexe x is replaced by rhe proper number and hd is for regular parallel ide drives. Clearly with Knoppix you have to be sure that you write the backup file to a partition that is writeable, and having a backup on ram disk is of minimal use.

[Metallo]

At least, can anybody tell me how to save the partition before writing the guessed one_

Yoy can back up a MBR (of which the partition table is a part) with


$dd if=/dev/hdx of=MBR-backup bs=512 count=1

and restore it with


$dd if=MBR-backup of=/dev/hdx bs=512 count=1

whexe x is replaced by rhe proper number and hd is for regular parallel ide drives. Clearly with Knoppix you have to be sure that you write the backup file to a partition that is writeable, and having a backup on ram disk is of minimal use.

Harry,

A question, the disk is for me the hdb and there is only one partition, should I then write $dd if=/dev/hdb of=MBR-backup bs=512 count=1?
I tried and the mbr has been saved into HOME Personal Filesr of knoppix, is this OK?

Thank you
Alex

[Harry Kuhman]

I tried and the mbr has been saved into HOME Personal Filesr of knoppix, is this OK?
OK for making the backup file, but I would copy it to a flash drive or even a floppy to be sure it would still be around when needed.

[rusty]

try fsck -N /dev/hdb1

[Metallo]

Hi guys,

Just wanted to let you know that gpart did a perfect guess of what the partition table of my HDD should be, in fact, after rebooting I could open the drive and save 100% of all my data :D

A big thank to you who took the time and patience to answer my "beginner's" questions.

Cheers
Alex

[alek6cu]

Hi Metallo:
I know this is a Linux forum and all, but i had a similar problem once (i had overwritten the partition table) and solved it with a software called "Active Partition recovery" thats for Windows (DOS Actually) the program creates a boot floppy with tools which guess the partition table and even allow you to see the files on the disk as if the guessed partition was used (that way you can be sure to write it to the disk).

Luck.

[Metallo]

Hi Metallo:
I know this is a Linux forum and all, but i had a similar problem once (i had overwritten the partition table) and solved it with a software called "Active Partition recovery" thats for Windows (DOS Actually) the program creates a boot floppy with tools which guess the partition table and even allow you to see the files on the disk as if the guessed partition was used (that way you can be sure to write it to the disk).

Luck.

Thank you for your advice, it is always useful to have alternatives :)

Regards
Alex