recovery problems

[mrbst39]

ok, so i've been searching around and have seen some posts very similar to this, but not quite addressing my problem. hope i'm not repeating, and if so *please* just point me in the right direction.

same old story, windows crashed, can't boot in safe mode or anything, so i burnt a knoppix disk for the purpose of data recovery.

i got into knoppix desktop without problems, and on the desktop i see hda1, hda2, and hda3. however, when i go into hda1 and hda3, i don't see any of my folders or files. when i try to open hda2 it tells me that the device couldn't be mounted, and that it couldn't determine the filesystem type and none was specified.

tried: mount -t reiserfs -o rw /dev/hda5 /mnt/hda5
and got a long error including wrong fs type, bad option, bad superblock on dev/hda2

tried: mount /dev/hda2 /mnt/hda2
and it told me i must specify the filesystem

i am COMPLETELY in the dark with linux (this bootup with knoppix is literally the first time i've seen it and i'm learning by reading this forum) and i really appreciate any help that you could give me. i just want to recover some .word documents and family pics that mean a lot to me, and then i'll reinstall windows (or maybe ubuntu if i have a good experience with knoppix). do i have any chance of doing this? thanks again, matt

[Harry Kuhman]

First of all, I want to repeat the sad truth that while Knoppix can often read files on a Windows partition even when windows itself can't or refuses to boot, it is also quite posiable for Windows to destroy a partition so bad that even Knoppix can't read it. This may be your case.

But I'm wondering what is really going on here for a number of reasons. You don't say what was on those partitions that you can read but can't find your files on. And I'm wondering what partitioning you think was on your disk before you ever ran Knoppix. It's pretty typical for Xp to just be installed to one large partition on the disk, which would be called hda1 by Linux in this case. Alternately many OEMs now waste the customer's precious disk space by creating a recovery partition on the disk and not giving the buyer the actual discs that he need to recover and reinstall. But since these are also Windows partitons, one would expect them to be on hda5, the first logical partition. AFAIK windows will not normally let you have multiple real windows partitions on the disk, it insists on extra partitions be logical drives in an extended partition. Linux names the 4 real physical partition on the first IDE hard drive hda1, hda2, hda3 and hda4 and uses hda5 and above for the logical paritions. In this case hda2 might be the extended partition that contains logical drive hda5 (and perhaps others), but I have no idea why you have both an hda2 and an hda3. If you could shed some light on what you think was on the disk we might be able to help you better.

[mrbst39]

thanks for replying! unfortunately, i have no idea what was on the partitions before having the problem (honestly, i didn't even know what a partition was before having the problem...) i ran checkdisk through windows, and ever since then i couldn't boot (error:bad pbr). how can i tell you what was on the disk? i really want to give you the information you need, but i'm clueless here. thanks again for you're patience, matt

[Harry Kuhman]

Give us any information that you can about the system. Is it a brand name? If so give us not just the brand but the model number. Do you at least know the size of the disk? Give us that too. If not a brand name, was it made by a local computer store? Did you make it yourself? (I build up all of mine and those for many friend but that doesn't seem likely in this case). What do you remember seeing under "my computer". You almost certainly had a "C" partition. Do you remember having other partition letters for hard drive partitions? (There will also have been a drive letter for the CD or DVD drive, do you remember what that letter was?) If you remember other hard drive partitions do you recall how large each of the partitions were? The total should approach the total size of the disk drive, although it will not match it due to the absurd way hard drive makers rate the size of their drives and perhaps because of space unused in the formatting process. I guess I should also ask if the computer has only one hard drive or if there are multiple hard drives there.

And I really hope that you don't reply that you had something called a RAID array. That would explain a lot of your problems now.

[mrbst39]

it's a dell inspiron b130 laptop (it seems like a lot of dell's have this pbr error, from googling it). it only had the one hard drive that i'm aware of (although their could have been more space tucked away in drives i'm not aware of), and i'm pretty sure it was 80 gig. under my computer would have been the basics: documents and settings, program files, etc. is that any help? is there anything i can do to get you more informaton in the shape that it's in?

[Harry Kuhman]

I don't know the dell line myself, but it may help a knowledgable Dell user if one comes across this thread. There will be only one drive. Not sure how Dell partitions it though.

You didn't say what you see on hda1 or what you are looking for. Could it be that you're looking for those damn hard to find directories like My Documents or My Pictures? They very well may be there, just a bitch to find the way Windows (and Xp in particular) hides things.

[mrbst39]

i'm looking for the my documents folder and my pictures folder. but none of my files are there. none at all =(

as for what i see in hda1:
files: dell (folder) adaptec, adeptec2, ami_raid, autoexe, biomp, cables, cache, command, config, copyup, cpu, ddinit, dellboot, delldiag, dellrmk, dellsys, delltbui, dir, disk, diskette, dvd, genaudio, hdaudio, laudio, ieee1394, imchecc, int1588, ioapic, ir, keyboard, lsi, memory, miscpci, mouse, mpcache, nbbatt, nbfan, nbsvc, nbthem, mic, nic8254x, parallel, pci, perc2ada, pm, raid, scsi, seal, serial, smbios, smbus, smi, symtree, sysbdmo, system, usb, usb2, usbdevid, usbkbd, usbmass, usbmouse, usbohci, usbtm, video

most of these are.mdm files

hda3 has:
folders-bat, bin, img, src1, src2, src3, src4, src5
files-autoexe, config, dellbio, comman, dellrmk

what about mounting and opening up hda2? could my stuff be there? again, i tried doing mount -t reiserfs -o rw /dev/hda2 /mnt/hda2
and got a long error including wrong fs type, bad option, bad superblock on dev/hda2 and i also tried mount /dev/hda2 /mnt/hda2
and it told me i must specify the filesystem. so no luck seeing hda2's contents still.

starting to get that sinking feeling that all my files are gone for good. any help is highly appreciated, matt

[mrbst39]

i just ran fdisk -l and it showed me the 3 hda's, and hda2 has 74959290 blocks (compared to 40131 in hda1 and 3148740 in hda3). so now i really want to figure out the whole mounting issue so i can see if my files are still in there. i'll keep trying.

[mrbst39]

ok, i've now tried:

mkfs.ext3 /dev/hdb1
then
mount -t ext3 /dev/hda2 /mnt/hda2

this made a whole lot of stuff happen

when i click on hda2 i no longer get the mounting error, and it opens up. inside is a locked folder called lost + found. i do not have permission to open it. am i making my problem worse?

[Harry Kuhman]

mount -t ext3 /dev/hda2 /mnt/hda2
. am i making my problem worse?

You very well could be. I don't know where you are coming up with these awful mount lines, but hda2 seems to be your main Xp partition. It is not a ext3 partition. I's also not a reiserfs partition, as you seemed to want to force in a previous thread. I don't know if you have caused any harm or not by mounting the partition as the wrong type. Damage could occur if Linux writes to it.

From what you have posted both hda1 and hda3 seem to be partituins that Dell created to hide their recovery software. Why two different partitons I don't know. Why they do this is because they would rather waste $20 of your precious and limited hard disk space than provide 10 cents worth of CDs (and maybe that 10 cents is a high estimate). They also likely filled windows with lots of crapware that you didn't really want either, but I degress.....

As I think I said at the beginning, Windows may well have destroyed your hda2 partition beyond the ability of Knoppix to read. However, one thing that sometimes happens is that Windows doesn't destroy the partition at all, it destroys the partition table that points to the partition, making it unreadable. I don't know if that has happened in this case or not. One thing you could try is running testdisk and see if it will recover the partition table. It can't (AFAIK) repair the hda2 partition itself, but it can recover the hda2 partition table entry if it is incorrect. Try running Knoppix, opening a comand prompt and typing
sudo testdisk
or
su
testdisk

Good luck, but there may not be anything that Knoppix can do to help you.