Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 28

Thread: Knoppix for Data Recovery? Hard Drive Failure!

  1. #11
    Junior Member registered user
    Join Date
    Apr 2005
    Posts
    23
    I agree....I don't want to rush....but then again.....I WANT to rush! It's nice to have a glimmer of hope! ha!

    I was running Windows XP Home SP2 on this Sony Vaio laptop. I had been out of town for a few days and when I came back, I was checking email and what not and noticed everything running very slow. All of a sudden the computer just rebooted and I got an error (don't even remember the error now). Turned it off for a bit and turned it back on, and Operating System Not Found....that's about it really. A 4 month old brand new top of the line laptop goes kaput for no reason (which is the BEST reason for them to go!)

    On the Knoppix Desktop are: Trash. CD-ROM, Floppy disk and KNOPPIX....that's it....no partition icons :/ Not sure why or how they would have been destroyed. After I shut off the computer, it has sat shut off for a couple of months now until I recently started to work with it. So maybe we are working with destroyed partitions? So Knoppix is meant to auto-detect these partitions? I'm willing to get my hands a little dirty myself before sending it off for the dirty (and expensive) work to get done for me....

    Thanks for the book suggestions and the links. I have actually come across most of the threads that you mention, including the one from today where you mentioned Helix. Browsed the Helix site, but was not sure what it was for. My biggest problem is that I have never worked with Linux before, but I think I should pick it up quickly. I have come across a few mentions of gpart but am not sure what to do with it. Will keep reading though.

    until you better understand what caused the problem, what the problem is, and what you really want to do about it.
    This is my biggest issue....I don't know what caused the problem or what the problem actually is, so I don't KNOW what I want to do about it :P

  2. #12
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    Sounds like your partition table might be destroyed (maybe more, maybe just that and the MBR).

    Just a hunch, but if you don't have a router providing a hardware firewall, or if you do but you opened something nasty in you email, or if you use Microsoft Outlook to read email (the easiest way to infect your computer) then some nasty trojan/virus/worm may have wiped out your partition table (or worse). gpart may help you recover it, but I would at least run some partition software to see what the current partition table looks like (be careful to not write any new partition table with such software, just look but do not write anything).

    Of course, from what little we know it could be a complete hard disk failure (although it seems very unlikely that 2 drives failed at once). Do we even know if the hard disks are spinning? Are they identifying themselves to the BIOS? As I said, a lot to be learned before selecting a course of action.

  3. #13
    Junior Member registered user
    Join Date
    Apr 2005
    Posts
    23
    Well, I can pretty safely say that this wasn't caused by me opening any kind of bad attachment in an email. I am quite alert to these kinds of things, though I DO use Microsoft Outlook Express (but will no longer once I get back up and running, when I move to Thunderbird). I have had spyware issues in the past but had completely rid myself of anything residing on my computer that shouldn't have been there. Norton Antivirus was up to date as well, and I have never run into any virus/trojan issues in the past, but you never know these days. Though, this was a pretty new computer, so I felt it was pretty clean....

    The laptop should have only one hard drive, but 2 partitions...a C and a D.....total of 80Gb hard drive....

    How do I tell if the disks are spinning? When I startup, it sounds like a normal startup, and I get my VAIO screen, and it usually sits there for a bit before coming up with the OPERATING SYSTEM NOT FOUND screen....so it sounds like the disks are spinning. How can I tell if they are identifying themselves to the BIOS?

    What partition software should I use to see what it the partition table looks like....though I must admit, I have no clue what a partition table is SUPPOSED to look like....what would happen if I just tried to run gpart right now?

    *edit*

    Helix is now finished downloading.....should I burn and attempt to work with it rather than Knoppix?

  4. #14
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441

    Re: Knoppix for Data Recovery?

    Quote Originally Posted by OpenIntro
    ...I have a Sony Vaio laptop that recently crashed and....!
    Quote Originally Posted by OpenIntro
    Also, I have 2 drives (C and D) that were on this computer...
    OK, I'm getting tired and obviously somewhat confused as I try to follow multiple threads today. I fanally just caught this. Do you really have a new laptop with two drives, or do you have a laptop with one disk drive that has two partitions on it? And if it is the second case above, just why does a new laptop have two partitions on it? All new laptops I've seen only come with one partition (I had to shrink my NTFS partition to make space for a second FAT partition, but since you didn't know the partition types it seems unlikely that you did this or anything like it). This could matter, since if it is one drive with multiple partitions it is much more likely that it is a drive failure (although I still think it is most likely that some nasty software wiped out your partition table).

    This is my last post for a while, I need to get away from the computer.

  5. #15
    Junior Member registered user
    Join Date
    Apr 2005
    Posts
    23
    Here is my computer....

    I'm pretty sure it is one 80Gb hard drive with 2 partitions, a C and D drive....this is how it came brand new....I didn't change anything on it drive-wise....The C drive is where Windows was installed and most of my programs....the D drive was strictly for files.....

    So if it is:

    1) drive failure

    where does this leave me (besides a rock and a hard place)

    or

    2) wiped out partition table

    .....where does this leave me? :P Is it Knoppix-able?

    Is running gpart going to do me any good right now?

    Do you have AIM? Might be easer to chat about this on there if you have time!

  6. #16
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    Quote Originally Posted by OpenIntro
    I'm pretty sure it is one 80Gb hard drive with 2 partitions, a C and D drive....this is how it came brand new....I didn't change anything on it drive-wise...
    I'm pretty sure it's one large hard drive too, even though you used the term two drives instead of two partitions. Interesting that they would set ot up that way, nost preinstalled systems come with one large partition.

    Quote Originally Posted by OpenIntro
    ...So if it is:
    2) wiped out partition table
    .....where does this leave me? :P Is it Knoppix-able?
    I think this is the far more likely situation, although if it is I would be very surprised if it had not be caused by some form of virus/worm/trojan/malware. I'm not an expert on Knoppix partitoning software (generally use other stuff), but you should be able to determine if whatever comes in Knoppix can see the drive and can see that the partition table is wiped out. This would be enough to convince me that the drive is working and it's a partition table issue. I expect that there is even a point in gpart where it scans the drive, shows you the partition table that is it's best guess, and lets you choose if you want that written to the disk. So everything up to that choice to write should be safe, but see the man pages for gpart to be sure.

    I rather expected someone who know this area far better that me to jump in here while I took a break.

    Quote Originally Posted by OpenIntro
    .....
    So if it is:
    1) drive failure
    where does this leave me (besides a rock and a hard place)
    Ithink this is the less likely case, This leaves you wih a choice, neither option is good. One you could return the notebook for warranty replacement of the drive. But that make it very unlikely that they will do anything to help you get your data back (although they could give you the old drive once they confirm it's bad, they just are unlikely to be willing to do that unless you put on a lot of pressure). Two you could send that drive away to the expensive data recovery services, but that will likely void any warranty and make it unlikely that yu will get a replacement for your 80 meg drive. No good option here, but again this could be the case but I think it's less likely that the above.

    Quote Originally Posted by OpenIntro
    Is running gpart going to do me any good right now?
    Read through the gpart man pages. As I said, I expect there is a point where you get to commit, and as long as that is the case then anything up to that should be safe. You should be looking for gpart to come back and tell you that it thinks the disk should have 2 partitions and their reported sizes should make sense. And, of course, if gpart says the disk isn't spinning (or errors to that effect) then that tells us a lot.

    Quote Originally Posted by OpenIntro
    Do you have AIM? Might be easer to chat about this on there if you have time!
    Sorry, I don't use AIM or any other IM system. Don't assume I'm some big expert that can talk you through all of your problems though. The truth is closer to I'm just one or two steps ahead of you.

  7. #17
    Junior Member registered user
    Join Date
    Apr 2005
    Posts
    23
    haha....1200+ posts, you've been around the Knoppix block a few times And at this point, two steps ahead is like a MILE ahead right now :P

    Warranty replacement is not an option.....I bought it through uBid.com and it only came with a 90 day warranty. So I am SOL on that front. I have already purchased a new drive on eBay, because I had planned to send the computer off to have the data retrieved to a data recovery place.

    Now, what exactly IS a partition table, and what does that get me if I can read it with gpart?

    So, bu committ, do you mean, possible data loss? Any gpart experts, feel free to chime in!

  8. #18
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    Quote Originally Posted by OpenIntro
    Now, what exactly IS a partition table, and what does that get me if I can read it with gpart?
    Boy, what a question, tons could be written on this. I'll try to answer it quickly, beyond this use Google for more information.
    Since the early days of PC hard disks, there has been a way to break these disks up into one or more spaces where data is stored on the disk. These are the partitions. The very frist sector of the hard drive (head 0, track 0, sector 0) is defined to hold two important pieces of data. The first part and bulk of this sector is the MBR or Master Boot Record, a short piece of code that is loaded to start booting the disk. The BIOS then jumps into the MBR and that code runs to finish loading whatever software is to be run (usuall an operating system). At the end of this sector, after the MBR proper, is a small table of bytes called the partition table. The partition table defines where the data portions of the drive are. For a single partition on a drive there would be one entry, it usually would start at track one and go to the end of the disk. Sometimes there is a little space reserved at the end of the disk for special engineering use. The partition table entry also contains other information like the type of partition (FAT, FAT12, FAT32, NTFS, Linux swap, and so on) and other things important at boot time. It works out well that it's at the end of the same sector as the MBR because the entire sector is actually loaded into memory at once; the program in the MBR needs the partition table to figure out how to boot the rest of the system.

    The choice to make the patition table only a small space at the end of the first sector limited it's size however. Because of it's limited size it can hold only enough information for up to 4 partitions. Thus there can only be 4 physical partitions on a disk (unless you play some games and swap in different partition tables, beyond the scope of this discussion). To get around this limitation, later systems created a patrition type called an extended partiton. If one of the 4 physical partitions is made an extended type, then it points to a block of disk space (partition) that is further subdivided into "logical partitions". Beyond this simple explaination, start using Google if you want a byte by byte breakdown of what the partition table holds, for our purposes it should suffice to understand that it's the space on the disk that holds the information that you set up to define the disk when you run fdisk or other partitioning software. It is key in defining how all of the other bits on the disk are to be interpreted.

    So if the partition table or the entire first sector is overwritten, critical information needed to boot and to see the partitions on the disk is lost. Of course, if something really nasty is out to destroy your data it can also write over the data itself, or can at least destroy other key information first (like the directory structure that tracks all of your files), but if all that is lost is the partition table it can make it very hard to recover your data.

    Hard, but not imposiable. This is where gpart comes in. gpart looks over the data on the entire disk. There are things stored in partitions that can often be recognized. So gpart looks over the entire disk and tries to make an evaluation of how many partition there are, where they start and stop, what types thay are, and so on. It's only a guess, but it's an educated guess, and it's better than nothing. It's up to the user to decide if the guess looks reasonable and if he wants to accept it. If gpart thinks there are two partitions, one NTFS and one Extended, this sounds like a good guess. If it thinks there is one partition and you know there was a C and D partition (as well as another letter for the CD drive) then that would be a bad guess. It might even say there are 3 partitions and still be right, sometimes vendors add a small hidden partition of service ralated stuff on the disk. And, of ciourse, if it says it can't figure out where any partitions on the disk are, that's not a good sign. If you accept gpart's guess at what the partitions are then it rewrites a new partition table for you.

    Note that such a hard drive still isn't bootable if the MBR has been destroyed. But booting from a CD does not require anything in the HD MBR, so you can still boot a Knoppix CD and may now be able to see the data on your partitions. Once you recover your data then reinstalling Xp should rewrite the MBR for you.

    I hope this gives you enough to go on. Good luck, and plase post back with your results.

  9. #19
    Junior Member registered user
    Join Date
    Apr 2005
    Posts
    23
    Thanks for the breakdown! That should be quite helpful!

    Final 2 questions before I make my bold moves....

    1) Is gpart already built into the latest Knoppix that I downloaded?

    and

    2) Once I committ in gpart and rewrite the partition table based on its guess, am I COMPLETELY committed at that point? If it doesn't work, does that mean that even sending to data recovery is going to be an impossible task? I don't want to really chance destroying things!

  10. #20
    Senior Member registered user
    Join Date
    Mar 2004
    Posts
    1,516
    you are pretty much COMPLETLY comitted.
    if the guess is wrong the data recovery wil cost you 10-50 times as expensive and be MUCH less sucessfull at finding ALL files.
    a good recovery from a disk like that can go up to 50 000 euro and still not be 100% of content.

Page 2 of 3 FirstFirst 123 LastLast

Similar Threads

  1. Please help.. USB Hard Drive .. need to recover data
    By Chris2222 in forum General Support
    Replies: 1
    Last Post: 03-11-2008, 03:01 PM
  2. help using knoppix 3.2 to retrieve data from hard drive
    By adamj in forum Hardware & Booting
    Replies: 1
    Last Post: 04-06-2007, 10:47 PM
  3. Recovery of bad hard drive
    By dagatorman in forum General Support
    Replies: 1
    Last Post: 09-14-2006, 02:11 PM
  4. Hard drive / data recovery / force show drive
    By Lintu in forum Hdd Install / Debian / Apt
    Replies: 1
    Last Post: 10-20-2005, 06:13 PM
  5. help getting data off of a hard drive...
    By thebyrd in forum General Support
    Replies: 6
    Last Post: 12-09-2004, 10:18 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  


A-Tech 8GB DDR3 1600 PC3-12800 Laptop SODIMM 204-Pin Memory RAM PC3L DDR3L 1x 8G picture

A-Tech 8GB DDR3 1600 PC3-12800 Laptop SODIMM 204-Pin Memory RAM PC3L DDR3L 1x 8G

$13.99



HyperX FURY RAM DDR4 16GB 8GB 32GB 4GB 3200 2666 2400 2133 Desktop Memory DIMM picture

HyperX FURY RAM DDR4 16GB 8GB 32GB 4GB 3200 2666 2400 2133 Desktop Memory DIMM

$9.64



CRUCIAL DDR3L 8GB 16GB 32GB 1600 MHz PC3-12800 Laptop Memory RAM SODIMM 204-Pin picture

CRUCIAL DDR3L 8GB 16GB 32GB 1600 MHz PC3-12800 Laptop Memory RAM SODIMM 204-Pin

$14.35



A-Tech 8GB PC3-12800 Desktop DDR3 1600 MHz Non ECC 240-Pin DIMM Memory RAM 1x 8G picture

A-Tech 8GB PC3-12800 Desktop DDR3 1600 MHz Non ECC 240-Pin DIMM Memory RAM 1x 8G

$13.99



A-Tech 16GB 2 x 8GB PC3-12800 Laptop SODIMM DDR3 1600 Memory RAM PC3L 16G DDR3L picture

A-Tech 16GB 2 x 8GB PC3-12800 Laptop SODIMM DDR3 1600 Memory RAM PC3L 16G DDR3L

$27.98



Team T-FORCE VULCAN Z 16GB (2 x 8GB) 288-Pin PC RAM DDR4 3200 (PC4 25600) Intel picture

Team T-FORCE VULCAN Z 16GB (2 x 8GB) 288-Pin PC RAM DDR4 3200 (PC4 25600) Intel

$35.99



HMT84GL7AMR4C-RD 32GB DDR3 Server Memory RAM 14900L ECC REG 4Rx4 SK Hynix Cisco picture

HMT84GL7AMR4C-RD 32GB DDR3 Server Memory RAM 14900L ECC REG 4Rx4 SK Hynix Cisco

$13.99



HyperX FURY DDR4 4GB 8GB 16GB 32GB 3200 2400 2666 Desktop RAM Memory DIMM 288pin picture

HyperX FURY DDR4 4GB 8GB 16GB 32GB 3200 2400 2666 Desktop RAM Memory DIMM 288pin

$23.15



Hynix 64GB 4Rx4 PC4-2133P-L LRDIMM DDR4-17000 ECC Load Reduced Server Memory RAM picture

Hynix 64GB 4Rx4 PC4-2133P-L LRDIMM DDR4-17000 ECC Load Reduced Server Memory RAM

$64.99



Kingston HyperX FURY DDR3 8GB 16GB 32G 1600 1866 1333 Desktop Memory RAM DIMM picture

Kingston HyperX FURY DDR3 8GB 16GB 32G 1600 1866 1333 Desktop Memory RAM DIMM

$39.95