URGENT QUESTION - Using KNOPPIX to recover data

[kopfhorer]

I understand that Knoppix can be used to read files on a corrupted Windows hard drive. The hard drive in question, which was originally set up in a dual-boot system, was installed in an old PIII system (1 Ghz processor, 256 MB RAM, 80 Gig hard drive divided into 2 partitions) which I’d bought used.

Shortly after I got it, the motherboard suffered a catastrophic failure which rendered both partitions unreadable by the usual means (I’ve since trashed that motherboard and re-built the system from scratch with the old processor and RAM. It works decently).

In the malfunction I lost some files which I did not have the chance to back up. I’ve just now tried reading the damaged hard drive using Knoppix. The Linux partition (which I think was called Hda1?) shows up fine, even though it’s no longer bootable. When I tried accessing the Windows partition (Hda0?), I got an error message saying that the drive was unmountable and did not have a detectable file system (it’s possible that I could have re-formatted the Windows partition and forgotten about it).

Is my problem beyond the capabilities of Knoppix? Do I need to purchase a Windows-based undelete/rescue program? Or is the drive partition too badly corrupted for any kind of data recovery?

[Harry Kuhman]

...(it’s possible that I could have re-formatted the Windows partition and forgotten about it...

For all of your typing you didn't really tell us some key things. Like What version of Windows was it and what type partition should there be out there, if you didn't delete it? Knoppix has much better sucess with FAT partitions than with NTFS partitions; which MS seems to be going to great lengths to keep Knoppix from writing safely. That said, you may want to look at the Linux utility (included in Knoppix) "gpart". It can find partitions on the disk and repair a bad partition table (note that this is far different than recovering deleted files or repairing a bad file structure within a partition).

[kopfhorer]

...(it’s possible that I could have re-formatted the Windows partition and forgotten about it...

For all of your typing you didn't really tell us some key things. Like What version of Windows was it and what type partition should there be out there, if you didn't delete it?

Windows 98, Second Edition, FAT32 file system. The Windows partition was FAT32, the Linux partition, Reiser.

Knoppix has much better sucess with FAT partitions than with NTFS partitions; which MS seems to be going to great lengths to keep Knoppix from writing safely. That said, you may want to look at the Linux utility (included in Knoppix) "gpart". It can find partitions on the disk and repair a bad partition table (note that this is far different than recovering deleted files or repairing a bad file structure within a partition).

I'll try that out as soon as I can. Thank you for replying.

[r3dlp]

If you're simply asking whether it's possible to use Knoppix (or any other Linux distro for that matter) to recover data from a HD formatted for Windows (FAT, FAT32, and NTFS), then the answer is yes. Actually, I've used lots of other tools in the past (like Norton's Utilities, Partition Magic, System Commander, Syquest Imager, etc) for performing various recovery, and only Norton's Utilities (especially the Disk Editor) came close to delivering me the kinds of results that I get repeatedly using Linux to perform the recovery. Furthermore, I've also used Linux to recover some data from BSD, Mac OS, and other partitions.

Although there really isn't a "cookbook recipe" that anyone can give you for how to perform the recovery (because each system recovery often differs), I can give you some guidelines for now. And I can help to address specific issues as they arise for you during the recovery. Nevertheless, try to keep in mind that system recovery is as much of an art as it is a science.

Enough of the intro stuff; now let's dig in. Here's a list of some of the equipment that I like to use: another HD (or some other recordable media like CD, DVD, flash drive, etc) with enough free space to copy, compress, or otherwise manipulate the data; another computer (if possible); and a null-modem cable. I prefer to use a bootable, live CD Linux distro--like Knoppix (or RIP because it includes more recovery tools)--to perform the recovery. Here's a list of some of the tools that I tend to use most often: awk, cat, dd, date, echo, fdisk, fdformat, fsck (and the variants of fsck implemented for non-ext2 filesystems), find, gcc (and an ASM like gas in a pinch), grep, hexdump, less, ls, mount, msdosutils, ntfsresize, sed, sfdisk, sort, ssh, tar, touch, and vi.

Out of all of those tools, my work-horses tend to be dd, find, grep, hexdump, ls, less, and vi. I use dd for reading/writing files, partitions, etc. I use find, grep, and ls for searching for files, specific data, etc. I use hexdump for hex-editing, and I use vi for editing anything else.

You have to go into any recovery situation with some kind of plan. What do you plan to recover? How badly do you want/need the data? Do you know where to look (for what you plan to recover)? You'll have a better chance of recovering the data (often quicker) the more that you can narrow the scope of your recovery session. If I don't know what the name of the file(s) is/are, but remember some of the data stored in the file(s), then I'll use something like this: grep -lr "the data I want" /yourMountPoint | sort | less. If I don't remember the name of the file(s), and I don't remember the kind data stored in the file(s), but I remember when I created/modified the data, then I'll use something like this: find /yourMountPoint -type f \( -ctime x -o -mtime x \) (where x is the amount of time in days from today's date when the file was created or modified).

All of that is nice and dandy if none of your files are corrupt or deleted. What do you do if any of them are corrupt or deleted? Assuming that you don't have a backup, you basically have two options--both are painful: 1) use dd and grep together to search the partition for that data, or 2) use a low-level search and low-level read/write utility to search for and recover that data. Your milage will vary with either method; try to avoid the second option if you can, because you can easily destroy your HD if you don't know what you're doing. Nevertheless, in the case of deleted files, Windows (and many other OSs) doesn't immediately remove a deleted file. Usually, whenever a user deletes a file in Windows, Windows renames and hides that file. So, it's often possible to locate a deleted file by searching for the filename using one or more wildcard chars or by searching for your data using one of the aforementioned grep statements. In a crunch, you might have to resort to something like using dd to read/write several sectors, rearrange and concatonate them (via cat) in order to recover one or more files.

In any case, this should be enough to get you started.