Page 3 of 3 FirstFirst 123
Results 21 to 28 of 28

Thread: Knoppix for Data Recovery? Hard Drive Failure!

  1. #21
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    Quote Originally Posted by OErjan
    you are pretty much COMPLETLY comitted.
    if the guess is wrong the data recovery wil cost you 10 times as much and be MUCH less sucessfull at finding ALL files.
    normally a good recovery from a disk like that can go up to 50 000 euro and still not be 100% of content.
    I disagree with this completely. gpart only writes to the partition table. Assume it is bad now (although one wants to be very sure of that before letting gpart change it). It is easy enough to wipe it out again if the gpart does not help, and one would be no worse off than they are now. You could even make a copy of the bad bytes in the partition table now and relace them (if you really wanted to) later if gpart didn't help. Please explain why you believe that accepting a gpart partition table could leave him any worse off than he is now, in actual technical terms, not just in unsupported threats that recovery will cost more and recover less.

  2. #22
    Senior Member registered user
    Join Date
    Mar 2004
    Posts
    1,516
    it seems the companies rely on the corupt data to make a quick recovery. the overwritten entries will make it HARDER for them to recover stuff. my sister got her drive trashed, lots of IMPORTANT stuff on it, she used gparted, it did not work right.
    as a result of that it took a profesional company and huge amount of cash for her to get data back. the company said they had to work 3-5 times longer on recovering a disk like that as oposed to a "freshly" crashed one, and that the data was less "reliable". otoh it could have been salespitch.

    using a dd to repalce an image of the whole disk would work i guess, or just replasing the gpart "damage" as you said.
    something SHE did not do.

  3. #23
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    Quote Originally Posted by OErjan
    otoh it could have been salespitch.
    Yea, it sounds that way to me. Assume for a minute that a virus wiped out his boot sector (a common enough thing for a virus to do). You are simply not going to make anything worse no matter what else you write there. And no data company of any repute is going to claim that it made things harder to recover by not having the bad sector. It seems much more likely to me that your sister ran into someone who, once they had her drive, saw a chance to raise their price and make lots more money off her. But there is absolutely no technical reason for the increased cost, just someone that saw a mark and exploited a problem they were having.

  4. #24
    Junior Member registered user
    Join Date
    Apr 2005
    Posts
    23
    Everytime I run

    gpart -c /dev/hda1

    it immeidately just pops up a terminal window and does nothing, and the top of the screen says finished.

  5. #25
    Senior Member registered user
    Join Date
    Feb 2003
    Posts
    929
    Joj!

    You're trying to recover a partition table, not check on one partition.

    Run

    gpart /dev/hda

    (The partition table is for the whole drive, not one partition.)

    gpart's unassuming home page is here

    I can't speak to your problem, but in the past it has recovered partition tables which I've accidentally fdisk /mbr ed (and then remembered I hadn't quite copied everything I needed over).

  6. #26
    Senior Member registered user
    Join Date
    Aug 2004
    Location
    Sydney/Australia
    Posts
    311
    Code:
    The poor old partition table, it's always getting blamed for everything. It's only a set of 4 16 byte records starting at 0x1be in your mbr. People really need to get over this don't touch preception. It is so crucial to your system, but also so benign, with a little closer familiarity.
    
    Having the messed up table as is __might__ give a recovery co some hint as to how the screw up occured ... but that would be all. And wouldn't really concern them either. 
    
    Basically there only going to scan the disk, looking for various signatures, that would suggest the data areas.
    
    Making a very simple copy of the screwed table before any fix is attempted is a good idea. If for any reason, that a person can at least restore the original error state, in case they muck it up further.
    
    People seem to get into more problems over this than is really warrented. And suggests to me, that the role of the table, and __how__ it fits in, isn't understood very well generally.
    
    Once you get a good table, and before any major changes are made such as ... additions, removals, resizing. Why don't people just make a simple "dd" copy to floppy.Reboot to test it's working. Then start working on it.
    
    
    
    Even a straight forward ...
    
    ]# sfdisk -Pt /dev/hdb
    
    will dump the table for hdb, in a humanised form, but
    
    as it actually is, in the mbr.
    
    With that alone as a backup (written down on paper), a person could just delete the whole thing,then recreate them, using the same numbers.
    
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    [root:18:06]# cfdisk -Pt /dev/hdb
    Partition Table for /dev/hdb
    
             ---Starting---      ----Ending----    Start     Number of
     # Flags Head Sect Cyl   ID  Head Sect Cyl     Sector    Sectors
    -- ----- ---- ---- ---- ---- ---- ---- ---- ----------- -----------
     1  0x80    1    1    0 0x83  254   63    8          63      144522
     2  0x00    0    1    9 0x82  254   63   60      144585      835380
     3  0x00    0    1   61 0x05  254   63 1023      979965    59071005
     4  0x00    0    0    0 0x00    0    0    0           0           0
     5  0x00    1    1   61 0x83  254   63  589          63     8498322
     6  0x00    1    1  590 0x83  254   63 1023          63     8498322
     7  0x00  254   63 1023 0x83  254   63 1023          63     8498322
     8  0x00  254   63 1023 0x83  254   63 1023          63     8498322
     9  0x00  254   63 1023 0x83  254   63 1023          63     8498322
    10  0x00  254   63 1023 0x83  254   63 1023          63     8498322
    11  0x00  254   63 1023 0x83  254   63 1023          63     8080632
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    All the "fdisk" varients have usefull output formats ...,
    
    but yep, i know, i'm friggin slack myself when it comes to backups
    too :).
    
    
    jm
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
              If your free,
             And you know it !
    
          Then, clank those chains
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  7. #27
    Junior Member registered user
    Join Date
    Apr 2005
    Posts
    23
    Ok, so my new hard drive just came in the mail today....so in order to test the hard drive vs. mother board theory, I took out the old hard drive and replaced it with the new hard drive (but have not done anything with it)....

    I booted up with Knoppix and upon starting up, I noticed that it said it was a Samsung drive, and somewhere in the startup, I noticed it said hda
    When Knoppix came up, I don't see any hda on the desktop, but when I go to the file browser, and click DEVICES, I see hda in the list. When I clicked on it, it said the drive was not mounted....not totally sure what this means, but it looks like it is recognizing the hard drive at least....

    Any ideas?

  8. #28
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    Quote Originally Posted by OpenIntro
    .....When Knoppix came up, I don't see any hda on the desktop, but when I go to the file browser, and click DEVICES, I see hda in the list. When I clicked on it, it said the drive was not mounted....not totally sure what this means, but it looks like it is recognizing the hard drive at least....
    You will not see hda on the desktop. At the moment the drive likely isn't even formatted, but even after it is you will not see hda. hda is the drive. What you see on the desktop (when they are available) are the partitions on that drive, not the drive itself. So before you can see any icons on the drive you will need to format it (which you could do in Knoppix but you very well may rather do with Windows. I would certainly try windows first, and only use Knoppix if you couldn't get what you want with windows).

    Unfortunately, I'm not as comfortable with an Xp install as I am with Win98. My own notebook came preinstalled, I've only ever installed XP once for a friend. So I don't recall all of the formatting details. I think Xp uses something other than the fdisk program I've grown used to. But my suggestion would be to reinstall XP. When it gets to the issue of formatting the drive you very well might want an NTFS partition (FAT partitions, for example, still have the 4 gig file size limit and that might be an isses in a few rare cases. But I would suggest making no more than half the disk NTFS, and putting a FAT partition on the rest. You likely will not notice the difference between the NTFS and FAT partition under XP if you are the only user of the system and don't do fancy access control stuff (I don't notice the difference, 2/3 of my hard drive is FAT). You might want to leave a small amount of space for a Linux swap partition (512 meg to 1 gig, no more), but it's not really needed (I didn't do this). You will not be able to make the swap partition with the XP formatting tool, all you can do is not make the FAT quite fill the hard disk, and then later create the swap partition with Linux.

    Of course, this is assuming that you want to reinstall XP, and also that you will be running Knoppix from the Live CD. I personally don't believe in installing Knoppix to hard disk and don't advise people to do so. But you might want to do so, or even better you might want to install Debian Linux (or some other distro) to a hard disk prtition. If so now is the time to plan on how much space you want to leave for a Linux partition and again a small swap partition as stated above. Many Linux systems actually set up a number of partitions, but I'm not comfortable enough with Linux to know how much space I would need in each of several different partitions, so at least for my use I install all parts of Linux to the same partition, and sometimes share data with windows on a FAT partition.

    This certainly adds extra evidence that it is the hard drive itself that is giving you the problem. I still think it would be worth a few dollars to try to read the drive in a desktop system before sending it to any recovery company. And, if you really think it is worth sending the drive to a data recovery company, do your homework to be sure you don't send it to some less reputable company who will try to squeeze you for all they can once they have your drive.

Page 3 of 3 FirstFirst 123

Similar Threads

  1. Please help.. USB Hard Drive .. need to recover data
    By Chris2222 in forum General Support
    Replies: 1
    Last Post: 03-11-2008, 03:01 PM
  2. help using knoppix 3.2 to retrieve data from hard drive
    By adamj in forum Hardware & Booting
    Replies: 1
    Last Post: 04-06-2007, 10:47 PM
  3. Recovery of bad hard drive
    By dagatorman in forum General Support
    Replies: 1
    Last Post: 09-14-2006, 02:11 PM
  4. Hard drive / data recovery / force show drive
    By Lintu in forum Hdd Install / Debian / Apt
    Replies: 1
    Last Post: 10-20-2005, 06:13 PM
  5. help getting data off of a hard drive...
    By thebyrd in forum General Support
    Replies: 6
    Last Post: 12-09-2004, 10:18 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •