Data recovery from HDD

[Metallo]

Hi,

Background

My brother brought me an old Samsung WU 33205A HDD of 3.5 GB that suddenly stopped to work on his PC (WXP PRO).

The scope here is to save the data on that HDD.

I have installed it on my system with the intent to help him solving the problem.
My OS is WXP PRO.

My system has recognized that a new hw was about to be installed and found the proper driver.

If I browse explorer I cannot see the hdd, therefore I went into Device Manager and saw that the "device is working properly".
Then I clicked Disk Management and I read:

Disk 1
Unknown
3,01 GB
Not Initialized

3,01 GB Unallocated

It looks like the HDD needs to be formatted.

Knoppix & myself

I am totally new to Knoppix and I was suggested to try it as a possibility to recover the data from the Samsung HDD.
I succeeded to burn a Live DVD and booted my PC.

I can see the HDD on the desktop, as well as the other HDDs on my system, in fact, if I click on them, they open neatly, but when I get to the Samsung HDD, I get a message that I cannot quote with the exact words but more or less is: the drive cannot be mounted because the file system is unknown.

The only thing I can say from my investigations is that the file system is FAT32.

Now, I am stuck and have absolutely no clou how to proceed, but I am confident someone here will help

Thank you!

Alex

[Harry Kuhman]

The good news is that it sounds like the hardware is working.

The bad news is that it seems like the data on the drive is now bad. We obviously can't be sure at this point if the files are still there at all, but there is a good chance that the partition table is just bad.

And the really good news is that Knoppix has tools that can examine the disk and recreate the partition table. Two such tools (I have no idea why there are two tools to do this) are gpart and testcd. There are man pages that you can read for each (at a command prompt type man gpart or man testcd). So far I've only used gpart, but testcd looks simpler to use.

If Knoppix can't repair the partition table for you, don't give up quite yet. There are other live CDs that have tools to pull data off such drives. One is Helix.

If you post back it would be helpful to have more information about what you think was on that disk. Important information would include what OS your brother was running and what type of partition or partitions it should have. Information about what was happening when it stopped working may be helpful too.

[Metallo]

The good news is that it sounds like the hardware is working.

The bad news is that it seems like the data on the drive is now bad. We obviously can't be sure at this point if the files are still there at all, but there is a good chance that the partition table is just bad.

And the really good news is that Knoppix has tools that can examine the disk and recreate the partition table. Two such tools (I have no idea why there are two tools to do this) are gpart and testcd. There are man pages that you can read for each (at a command prompt type man gpart or man testcd). So far I've only used gpart, but testcd looks simpler to use.

If Knoppix can't repair the partition table for you, don't give up quite yet. There are other live CDs that have tools to pull data off such drives. One is Helix.

If you post back it would be helpful to have more information about what you think was on that disk. Important information would include what OS your brother was running and what type of partition or partitions it should have. Information about what was happening when it stopped working may be helpful too.

Hi Harry,

Thanks for your quick reply.

Well, the OS my brother is using is WXP PRO and he realized the HDD stopped working simply because he could not see the drive letter on his PC anymore
The file system is FAT32.
The disc contains many .doc files but more important many .dwg files from Autocad.

I tried to recover the data with PC Inspector, I managed to get about 50%, the rest seems to be corrupted.

That's why I'd like to give another try with Knoppix.

I will have a look at the two methods you suggest and hope to understand how the whole thing work.

Thank you
Alex

[Metallo]

Follow up...

Well, I am trying to see if gpart can see the partition of my HDD, therefore I typed gpart/dev/hdb but I get the following message: no such file or directory

Can anybody help me ?

Thank you
Alex

[Metallo]

OK, here I am again...

Well, I just could not get the partition because I forgot to type a spage between gpart and /dev/hdb, which may be clear for those who are used to command but unknown to me

However, here is what I got:

root@Knoppix:/ramdisk/home/knoppix# gpart /dev/hdb

Begin scan...
Possible partition(DOS FAT), size(3090mb), offset(0mb)
End scan.

Checking partitions...
Partition(DOS or Windows 95 with 32 bit FAT): primary
Ok.

Guessed primary partition table:
Primary partition(1)
type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT)
size: 3090mb #s(6330177) s(63-6330239)
chs: (0/1/1)-(1023/15/63)d (0/1/1)-(6279/15/63)r

Primary partition(2)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r


AFAIK there is only one partition in the HDD, therefore what-s reported looks OK.

Now, I could go for the -W option, isn't that better to save the original partition first?
Cannot I save it on a separate folder of one of my disks?
Being into knoppix by means of a live DVD, can I write into my windows HDDs_

Thank you
Alex

[rusty]

gpart -w will write the guessed partition table, not the entire partition to a device. I'm not sure if your partition table is compromised as it seems that knoppix sees the partition?

Have you tried fsck'ing the drive? man fsck, at a command line to see options including the -n option which will not repair anything.

Another tool I hope you won't have to use is lde (linux disk editor), theres a man page for it too, and a web page : http://lde.sourceforge.net/

HTH

[Metallo]

gpart -w will write the guessed partition table, not the entire partition to a device. I'm not sure if your partition table is compromised as it seems that knoppix sees the partition?

Have you tried fsck'ing the drive? man fsck, at a command line to see options including the -n option which will not repair anything.

Another tool I hope you won't have to use is lde (linux disk editor), theres a man page for it too, and a web page : http://lde.sourceforge.net/

HTH

Hi,

Well, if my partition table is not compromised, why doesn't the HDD show up neither in WXP or cannot be open with Knoppix?

I can try fsck but I'd apprecciate if you write me the exact command because I cannot succeed

Thank you
Alex

[OErjan]

there are a multitude of possible answers to all your questions.
on the last one, one that i think is close to home, there may actually be too much damage on the disk for windows to read it. and even Linux would be hard pressed and likely fail to work well on a disk with physical damage.

[Metallo]

At least, can anybody tell me how to save the partition before writing the guessed one_

I need a step by step approach in order to save it on a separate folder, at least if the guessed partition does not work I can still restore the old one.

Thank you
Alex

[rusty]

to use fsck

Make sure the drive is NOT mounted
open a shell
type: man fsck

then: fsck -N /dev/hdb, which will tell you what fsck would do

read the man page for other options to use as you see fit.