Knoppix for Data Recovery? Hard Drive Failure!

I agree....I don't want to rush....but then again.....I WANT to rush! It's nice to have a glimmer of hope! ha!

I was running Windows XP Home SP2 on this Sony Vaio laptop. I had been out of town for a few days and when I came back, I was checking email and what not and noticed everything running very slow. All of a sudden the computer just rebooted and I got an error (don't even remember the error now). Turned it off for a bit and turned it back on, and Operating System Not Found....that's about it really. A 4 month old brand new top of the line laptop goes kaput for no reason (which is the BEST reason for them to go!)

On the Knoppix Desktop are: Trash. CD-ROM, Floppy disk and KNOPPIX....that's it....no partition icons :/ Not sure why or how they would have been destroyed. After I shut off the computer, it has sat shut off for a couple of months now until I recently started to work with it. So maybe we are working with destroyed partitions? So Knoppix is meant to auto-detect these partitions? I'm willing to get my hands a little dirty myself before sending it off for the dirty (and expensive) work to get done for me....

Thanks for the book suggestions and the links. I have actually come across most of the threads that you mention, including the one from today where you mentioned Helix. Browsed the Helix site, but was not sure what it was for. My biggest problem is that I have never worked with Linux before, but I think I should pick it up quickly. I have come across a few mentions of gpart but am not sure what to do with it. Will keep reading though.

Quote:

---

until you better understand what caused the problem, what the problem is, and what you really want to do about it.

---

This is my biggest issue....I don't know what caused the problem or what the problem actually is, so I don't KNOW what I want to do about it :P

Sounds like your partition table might be destroyed (maybe more, maybe just that and the MBR).

Just a hunch, but if you don't have a router providing a hardware firewall, or if you do but you opened something nasty in you email, or if you use Microsoft Outlook to read email (the easiest way to infect your computer) then some nasty trojan/virus/worm may have wiped out your partition table (or worse). gpart may help you recover it, but I would at least run some partition software to see what the current partition table looks like (be careful to not write any new partition table with such software, just look but do not write anything).

Of course, from what little we know it could be a complete hard disk failure (although it seems very unlikely that 2 drives failed at once). Do we even know if the hard disks are spinning? Are they identifying themselves to the BIOS? As I said, a lot to be learned before selecting a course of action.

Well, I can pretty safely say that this wasn't caused by me opening any kind of bad attachment in an email. I am quite alert to these kinds of things, though I DO use Microsoft Outlook Express (but will no longer once I get back up and running, when I move to Thunderbird). I have had spyware issues in the past but had completely rid myself of anything residing on my computer that shouldn't have been there. Norton Antivirus was up to date as well, and I have never run into any virus/trojan issues in the past, but you never know these days. Though, this was a pretty new computer, so I felt it was pretty clean....

The laptop should have only one hard drive, but 2 partitions...a C and a D.....total of 80Gb hard drive....

How do I tell if the disks are spinning? When I startup, it sounds like a normal startup, and I get my VAIO screen, and it usually sits there for a bit before coming up with the OPERATING SYSTEM NOT FOUND screen....so it sounds like the disks are spinning. How can I tell if they are identifying themselves to the BIOS?

What partition software should I use to see what it the partition table looks like....though I must admit, I have no clue what a partition table is SUPPOSED to look like....what would happen if I just tried to run gpart right now?

*edit*

Helix is now finished downloading.....should I burn and attempt to work with it rather than Knoppix?

Quote:

---

Originally Posted by OpenIntro

...I have a Sony Vaio laptop that recently crashed and....!

---

Quote:

---

Originally Posted by OpenIntro

Also, I have 2 drives (C and D) that were on this computer...

---

OK, I'm getting tired and obviously somewhat confused as I try to follow multiple threads today. I fanally just caught this. Do you really have a new laptop with two drives, or do you have a laptop with one disk drive that has two partitions on it? And if it is the second case above, just why does a new laptop have two partitions on it? All new laptops I've seen only come with one partition (I had to shrink my NTFS partition to make space for a second FAT partition, but since you didn't know the partition types it seems unlikely that you did this or anything like it). This could matter, since if it is one drive with multiple partitions it is much more likely that it is a drive failure (although I still think it is most likely that some nasty software wiped out your partition table).

This is my last post for a while, I need to get away from the computer.

Here is my computer....

I'm pretty sure it is one 80Gb hard drive with 2 partitions, a C and D drive....this is how it came brand new....I didn't change anything on it drive-wise....The C drive is where Windows was installed and most of my programs....the D drive was strictly for files.....

So if it is:

1) drive failure

where does this leave me (besides a rock and a hard place)

or

2) wiped out partition table

.....where does this leave me? :P Is it Knoppix-able?

Is running gpart going to do me any good right now?

Do you have AIM? Might be easer to chat about this on there if you have time! :)

Quote:

---

Originally Posted by OpenIntro

I'm pretty sure it is one 80Gb hard drive with 2 partitions, a C and D drive....this is how it came brand new....I didn't change anything on it drive-wise...

---

I'm pretty sure it's one large hard drive too, even though you used the term two drives instead of two partitions. Interesting that they would set ot up that way, nost preinstalled systems come with one large partition.

Quote:

---

Originally Posted by OpenIntro

...So if it is:
2) wiped out partition table
.....where does this leave me? :P Is it Knoppix-able?

---

I think this is the far more likely situation, although if it is I would be very surprised if it had not be caused by some form of virus/worm/trojan/malware. I'm not an expert on Knoppix partitoning software (generally use other stuff), but you should be able to determine if whatever comes in Knoppix can see the drive and can see that the partition table is wiped out. This would be enough to convince me that the drive is working and it's a partition table issue. I expect that there is even a point in gpart where it scans the drive, shows you the partition table that is it's best guess, and lets you choose if you want that written to the disk. So everything up to that choice to write should be safe, but see the man pages for gpart to be sure.

I rather expected someone who know this area far better that me to jump in here while I took a break.

Quote:

---

Originally Posted by OpenIntro

.....
So if it is:
1) drive failure
where does this leave me (besides a rock and a hard place)

---

Ithink this is the less likely case, This leaves you wih a choice, neither option is good. One you could return the notebook for warranty replacement of the drive. But that make it very unlikely that they will do anything to help you get your data back (although they could give you the old drive once they confirm it's bad, they just are unlikely to be willing to do that unless you put on a lot of pressure). Two you could send that drive away to the expensive data recovery services, but that will likely void any warranty and make it unlikely that yu will get a replacement for your 80 meg drive. No good option here, but again this could be the case but I think it's less likely that the above.

Quote:

---

Originally Posted by OpenIntro

Is running gpart going to do me any good right now?

---

Read through the gpart man pages. As I said, I expect there is a point where you get to commit, and as long as that is the case then anything up to that should be safe. You should be looking for gpart to come back and tell you that it thinks the disk should have 2 partitions and their reported sizes should make sense. And, of course, if gpart says the disk isn't spinning (or errors to that effect) then that tells us a lot.

Quote:

---

Originally Posted by OpenIntro

Do you have AIM? Might be easer to chat about this on there if you have time! :)

---

Sorry, I don't use AIM or any other IM system. Don't assume I'm some big expert that can talk you through all of your problems though. The truth is closer to I'm just one or two steps ahead of you.

haha....1200+ posts, you've been around the Knoppix block a few times ;) And at this point, two steps ahead is like a MILE ahead right now :P

Warranty replacement is not an option.....I bought it through uBid.com and it only came with a 90 day warranty. So I am SOL on that front. I have already purchased a new drive on eBay, because I had planned to send the computer off to have the data retrieved to a data recovery place.

Now, what exactly IS a partition table, and what does that get me if I can read it with gpart?

So, bu committ, do you mean, possible data loss? Any gpart experts, feel free to chime in!

Quote:

---

Originally Posted by OpenIntro

Now, what exactly IS a partition table, and what does that get me if I can read it with gpart?

---

Boy, what a question, tons could be written on this. I'll try to answer it quickly, beyond this use Google for more information.
Since the early days of PC hard disks, there has been a way to break these disks up into one or more spaces where data is stored on the disk. These are the partitions. The very frist sector of the hard drive (head 0, track 0, sector 0) is defined to hold two important pieces of data. The first part and bulk of this sector is the MBR or Master Boot Record, a short piece of code that is loaded to start booting the disk. The BIOS then jumps into the MBR and that code runs to finish loading whatever software is to be run (usuall an operating system). At the end of this sector, after the MBR proper, is a small table of bytes called the partition table. The partition table defines where the data portions of the drive are. For a single partition on a drive there would be one entry, it usually would start at track one and go to the end of the disk. Sometimes there is a little space reserved at the end of the disk for special engineering use. The partition table entry also contains other information like the type of partition (FAT, FAT12, FAT32, NTFS, Linux swap, and so on) and other things important at boot time. It works out well that it's at the end of the same sector as the MBR because the entire sector is actually loaded into memory at once; the program in the MBR needs the partition table to figure out how to boot the rest of the system.

The choice to make the patition table only a small space at the end of the first sector limited it's size however. Because of it's limited size it can hold only enough information for up to 4 partitions. Thus there can only be 4 physical partitions on a disk (unless you play some games and swap in different partition tables, beyond the scope of this discussion). To get around this limitation, later systems created a patrition type called an extended partiton. If one of the 4 physical partitions is made an extended type, then it points to a block of disk space (partition) that is further subdivided into "logical partitions". Beyond this simple explaination, start using Google if you want a byte by byte breakdown of what the partition table holds, for our purposes it should suffice to understand that it's the space on the disk that holds the information that you set up to define the disk when you run fdisk or other partitioning software. It is key in defining how all of the other bits on the disk are to be interpreted.

So if the partition table or the entire first sector is overwritten, critical information needed to boot and to see the partitions on the disk is lost. Of course, if something really nasty is out to destroy your data it can also write over the data itself, or can at least destroy other key information first (like the directory structure that tracks all of your files), but if all that is lost is the partition table it can make it very hard to recover your data.

Hard, but not imposiable. This is where gpart comes in. gpart looks over the data on the entire disk. There are things stored in partitions that can often be recognized. So gpart looks over the entire disk and tries to make an evaluation of how many partition there are, where they start and stop, what types thay are, and so on. It's only a guess, but it's an educated guess, and it's better than nothing. It's up to the user to decide if the guess looks reasonable and if he wants to accept it. If gpart thinks there are two partitions, one NTFS and one Extended, this sounds like a good guess. If it thinks there is one partition and you know there was a C and D partition (as well as another letter for the CD drive) then that would be a bad guess. It might even say there are 3 partitions and still be right, sometimes vendors add a small hidden partition of service ralated stuff on the disk. And, of ciourse, if it says it can't figure out where any partitions on the disk are, that's not a good sign. If you accept gpart's guess at what the partitions are then it rewrites a new partition table for you.

Note that such a hard drive still isn't bootable if the MBR has been destroyed. But booting from a CD does not require anything in the HD MBR, so you can still boot a Knoppix CD and may now be able to see the data on your partitions. Once you recover your data then reinstalling Xp should rewrite the MBR for you.

I hope this gives you enough to go on. Good luck, and plase post back with your results.

Thanks for the breakdown! That should be quite helpful!

Final 2 questions before I make my bold moves....

1) Is gpart already built into the latest Knoppix that I downloaded?

and

2) Once I committ in gpart and rewrite the partition table based on its guess, am I COMPLETELY committed at that point? If it doesn't work, does that mean that even sending to data recovery is going to be an impossible task? I don't want to really chance destroying things!

you are pretty much COMPLETLY comitted.
if the guess is wrong the data recovery wil cost you 10-50 times as expensive and be MUCH less sucessfull at finding ALL files.
a good recovery from a disk like that can go up to 50 000 euro and still not be 100% of content.