Knoppix for Data Recovery? Hard Drive Failure!

[Harry Kuhman]

you are pretty much COMPLETLY comitted.
if the guess is wrong the data recovery wil cost you 10 times as much and be MUCH less sucessfull at finding ALL files.
normally a good recovery from a disk like that can go up to 50 000 euro and still not be 100% of content.

I disagree with this completely. gpart only writes to the partition table. Assume it is bad now (although one wants to be very sure of that before letting gpart change it). It is easy enough to wipe it out again if the gpart does not help, and one would be no worse off than they are now. You could even make a copy of the bad bytes in the partition table now and relace them (if you really wanted to) later if gpart didn't help. Please explain why you believe that accepting a gpart partition table could leave him any worse off than he is now, in actual technical terms, not just in unsupported threats that recovery will cost more and recover less.

[OErjan]

it seems the companies rely on the corupt data to make a quick recovery. the overwritten entries will make it HARDER for them to recover stuff. my sister got her drive trashed, lots of IMPORTANT stuff on it, she used gparted, it did not work right.
as a result of that it took a profesional company and huge amount of cash for her to get data back. the company said they had to work 3-5 times longer on recovering a disk like that as oposed to a "freshly" crashed one, and that the data was less "reliable". otoh it could have been salespitch.

using a dd to repalce an image of the whole disk would work i guess, or just replasing the gpart "damage" as you said.
something SHE did not do.

[Harry Kuhman]

otoh it could have been salespitch.

Yea, it sounds that way to me. Assume for a minute that a virus wiped out his boot sector (a common enough thing for a virus to do). You are simply not going to make anything worse no matter what else you write there. And no data company of any repute is going to claim that it made things harder to recover by not having the bad sector. It seems much more likely to me that your sister ran into someone who, once they had her drive, saw a chance to raise their price and make lots more money off her. But there is absolutely no technical reason for the increased cost, just someone that saw a mark and exploited a problem they were having.

[OpenIntro]

Everytime I run

gpart -c /dev/hda1

it immeidately just pops up a terminal window and does nothing, and the top of the screen says finished.

[fingers99]

Joj!

You're trying to recover a partition table, not check on one partition.

Run

gpart /dev/hda

(The partition table is for the whole drive, not one partition.)

gpart's unassuming home page is here

I can't speak to your problem, but in the past it has recovered partition tables which I've accidentally fdisk /mbr ed (and then remembered I hadn't quite copied everything I needed over).

[jjmac]

The poor old partition table, it's always getting blamed for everything. It's only a set of 4 16 byte records starting at 0x1be in your mbr. People really need to get over this don't touch preception. It is so crucial to your system, but also so benign, with a little closer familiarity.

Having the messed up table as is __might__ give a recovery co some hint as to how the screw up occured ... but that would be all. And wouldn't really concern them either. 

Basically there only going to scan the disk, looking for various signatures, that would suggest the data areas.

Making a very simple copy of the screwed table before any fix is attempted is a good idea. If for any reason, that a person can at least restore the original error state, in case they muck it up further.

People seem to get into more problems over this than is really warrented. And suggests to me, that the role of the table, and __how__ it fits in, isn't understood very well generally.

Once you get a good table, and before any major changes are made such as ... additions, removals, resizing. Why don't people just make a simple "dd" copy to floppy.Reboot to test it's working. Then start working on it.



Even a straight forward ...

]# sfdisk -Pt /dev/hdb

will dump the table for hdb, in a humanised form, but

as it actually is, in the mbr.

With that alone as a backup (written down on paper), a person could just delete the whole thing,then recreate them, using the same numbers.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root:18:06]# cfdisk -Pt /dev/hdb
Partition Table for /dev/hdb

         ---Starting---      ----Ending----    Start     Number of
 # Flags Head Sect Cyl   ID  Head Sect Cyl     Sector    Sectors
-- ----- ---- ---- ---- ---- ---- ---- ---- ----------- -----------
 1  0x80    1    1    0 0x83  254   63    8          63      144522
 2  0x00    0    1    9 0x82  254   63   60      144585      835380
 3  0x00    0    1   61 0x05  254   63 1023      979965    59071005
 4  0x00    0    0    0 0x00    0    0    0           0           0
 5  0x00    1    1   61 0x83  254   63  589          63     8498322
 6  0x00    1    1  590 0x83  254   63 1023          63     8498322
 7  0x00  254   63 1023 0x83  254   63 1023          63     8498322
 8  0x00  254   63 1023 0x83  254   63 1023          63     8498322
 9  0x00  254   63 1023 0x83  254   63 1023          63     8498322
10  0x00  254   63 1023 0x83  254   63 1023          63     8498322
11  0x00  254   63 1023 0x83  254   63 1023          63     8080632
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

All the "fdisk" varients have usefull output formats ...,

but yep, i know, i'm friggin slack myself when it comes to backups
too :).


jm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          If your free,
         And you know it !

      Then, clank those chains
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[OpenIntro]

Ok, so my new hard drive just came in the mail today....so in order to test the hard drive vs. mother board theory, I took out the old hard drive and replaced it with the new hard drive (but have not done anything with it)....

I booted up with Knoppix and upon starting up, I noticed that it said it was a Samsung drive, and somewhere in the startup, I noticed it said hda
When Knoppix came up, I don't see any hda on the desktop, but when I go to the file browser, and click DEVICES, I see hda in the list. When I clicked on it, it said the drive was not mounted....not totally sure what this means, but it looks like it is recognizing the hard drive at least....

Any ideas?

[Harry Kuhman]

.....When Knoppix came up, I don't see any hda on the desktop, but when I go to the file browser, and click DEVICES, I see hda in the list. When I clicked on it, it said the drive was not mounted....not totally sure what this means, but it looks like it is recognizing the hard drive at least....

You will not see hda on the desktop. At the moment the drive likely isn't even formatted, but even after it is you will not see hda. hda is the drive. What you see on the desktop (when they are available) are the partitions on that drive, not the drive itself. So before you can see any icons on the drive you will need to format it (which you could do in Knoppix but you very well may rather do with Windows. I would certainly try windows first, and only use Knoppix if you couldn't get what you want with windows).

Unfortunately, I'm not as comfortable with an Xp install as I am with Win98. My own notebook came preinstalled, I've only ever installed XP once for a friend. So I don't recall all of the formatting details. I think Xp uses something other than the fdisk program I've grown used to. But my suggestion would be to reinstall XP. When it gets to the issue of formatting the drive you very well might want an NTFS partition (FAT partitions, for example, still have the 4 gig file size limit and that might be an isses in a few rare cases. But I would suggest making no more than half the disk NTFS, and putting a FAT partition on the rest. You likely will not notice the difference between the NTFS and FAT partition under XP if you are the only user of the system and don't do fancy access control stuff (I don't notice the difference, 2/3 of my hard drive is FAT). You might want to leave a small amount of space for a Linux swap partition (512 meg to 1 gig, no more), but it's not really needed (I didn't do this). You will not be able to make the swap partition with the XP formatting tool, all you can do is not make the FAT quite fill the hard disk, and then later create the swap partition with Linux.

Of course, this is assuming that you want to reinstall XP, and also that you will be running Knoppix from the Live CD. I personally don't believe in installing Knoppix to hard disk and don't advise people to do so. But you might want to do so, or even better you might want to install Debian Linux (or some other distro) to a hard disk prtition. If so now is the time to plan on how much space you want to leave for a Linux partition and again a small swap partition as stated above. Many Linux systems actually set up a number of partitions, but I'm not comfortable enough with Linux to know how much space I would need in each of several different partitions, so at least for my use I install all parts of Linux to the same partition, and sometimes share data with windows on a FAT partition.

This certainly adds extra evidence that it is the hard drive itself that is giving you the problem. I still think it would be worth a few dollars to try to read the drive in a desktop system before sending it to any recovery company. And, if you really think it is worth sending the drive to a data recovery company, do your homework to be sure you don't send it to some less reputable company who will try to squeeze you for all they can once they have your drive.