Knoppix for Data Recovery? Hard Drive Failure!

Printable View

04-02-2005, 12:04 AM
OpenIntro

Knoppix for Data Recovery? Hard Drive Failure!

I was searching eBay (only half serious) for data recovery solutions and came upon some selling a CD with something called Knoppix on it and saying that it could be used for data recovery on crashed hard drives. After a little searching, I see that I can download and burn to a CD myself. But I am not sure if Knoppix is something that will be useful to my plight or not.....

I have a Sony Vaio laptop that recently crashed and when I turn it on, it now says OPERATING SYSTEM NOT FOUND. I desperately need to get some of the files off of my computer but would RATHER not spend the $400 to $500 (or more) to send to data recovery places if I can help it!

So can I use Knoppix to boot up and get access to the files on my hard drive? What is the best method for doing this? I tried a search and the FAQs, but didn't find much. Any help would be appreciated! Thanks!
04-02-2005, 12:32 AM
Harry Kuhman

Re: Knoppix for Data Recovery?

Quote:

Originally Posted by OpenIntro

So can I use Knoppix to boot up and get access to the files on my hard drive? What is the best method for doing this? I tried a search and the FAQs, but didn't find much. Any help would be appreciated! Thanks!

Follow the Get Knoppix link at the top of this page. Your best bet is to use the Bittorrent link. If you don't do that and use the mirrors instead, be very sure to download the md5 file also and to check the md5 sum.

If you have never burnt an ISO file before, do NOT assume that you know how to burn the disk. Follow the documentation link at the top of this page and read the downloading faq. Important things to understand: Burn it as an image (exact way to do this depends on your burning software), Do not just drag the ISO into the file area, do not extract any files from the ISO, do not use any option in your burning software to make it bootable. Burn the CDR at a slow speed like 4x and use a 700 meg CDRW the first time if you have one.
04-02-2005, 12:35 AM
Harry Kuhman

Re: Knoppix for Data Recovery?

Quote:

Originally Posted by OpenIntro

I was searching eBay ....

One additional thought:
I'm pretty sure that just like email and ecommerce, ebay get the e in it's name from electronic and the bay from bay of thieves.
04-02-2005, 12:56 AM
OpenIntro

haha....thanks for the reply....and I totally concur with you regarding eBay :P

I have downloaded the entire file from one of the mirrors....I will make sure I get the md5 file as well. I have burned iso files before, but will still follow the steps in the documentation so as to no screw it up :) I am using Nero Burning Rom to burn the CD. One problem...the iso file seems to be 715Mb....how can I get this on a 700Mb CD?

Getting it on the disk is the first step....but my main question was, can I use Knoppix to retrieve the files off of my hard drive? And once I get it up and running, how can I go about this?
04-02-2005, 01:06 AM
Harry Kuhman

Quote:

Originally Posted by OpenIntro

I am using Nero Burning Rom to burn the CD. One problem...the iso file seems to be 715Mb....how can I get this on a 700Mb CD?

It's not as big as you think it is, you're looking at it wrong. Do confirm the file with the md5 sum, it's very important when using the mirrors. If the md5 is right then the file absolutely is smaller than 700 meg and will fit on the CD.

You didn't say which version of Nero, burning differes for different version. Version 5 has an option something like "load from Image" under the file menu. Normal version 6 requires you to use the regular open under the file menu. Nero for Dummies interfaces have an option hidden somewhere not obvious on the top page to burn an image.

How you back up files depends on your hardware. Maybe you can transfer files across a network. Maybe you can store them to a USB flash device or another USB drive. Maybe you can save them to another FAT partition or even to a FAT partition on an extra drive you add to the system. In some cases you can write the data to CD's or DVD's. It's all been discussed many times before, you might want to read through the forums or search for the information (as a guess, the keyword "recover" might be a good search starting point).
04-02-2005, 01:14 AM
OpenIntro

Thanks again for the reply Harry.....

I actually need to redownload Nero, so I will make sure I have the latest version. I think I can get that part figured out.

As for WHERE to recover the files to, I can probably figure that one out. Is it possible to transfer them across a wireless lan since the laptop is equipped with a wireless lan card (built in)? I think the hard drive is failing, so I need to get them OFF the drive rather than recover them to somewhere else on the drive. I have an external hard drive, but it is Firewire, and I doubt I would be able to use my Firewire adapter?

I searched for recover, but as you probably know, it came up with quite a few results :P And none that I found had a definitive thread subject like mine here, so I would help myself and future searchers! :)

Again though, I am curious as to how the recovery works. When I get Knoppix up, will I just have a Windows Explorer style interface where I can drag and drop files?
04-02-2005, 01:36 AM
Harry Kuhman

Quote:

Originally Posted by OpenIntro

As for WHERE to recover the files to, I can probably figure that one out. Is it possible to transfer them across a wireless lan since the laptop is equipped with a wireless lan card (built in)? I think the hard drive is failing, so I need to get them OFF the drive rather than recover them to somewhere else on the drive. I have an external hard drive, but it is Firewire, and I doubt I would be able to use my Firewire adapter?

It's good to be working with Knoppix now rather than after you have to deal with it in a panic. As to the wireless link, maybe but don't get your hopes up. Some people have managed to get wireless networking working with Knoppix, but the support is not great, the vendors usually will not release information and only provide Windows drivers. I've tried a couple of different cards but so far can't get my wireless networking working (not that it's been a high priority). If I did ever need to recover something from my notebook I would just jack it into an ethernet port, but if you get networking going now then you have it when and if you need it. All in all I expect you'll find the firewire support is much better that the wireless support.

Quote:

Originally Posted by OpenIntro

I searched for recover, but as you probably know, it came up with quite a few results :P And none that I found had a definitive thread subject like mine here, so I would help myself and future searchers!

Actually, I didn't do the search myself, it was only a guess at a keyword to start with. But this has been talked about over and over again. You might want to look at the documentation and see if there is anything in the wiki about it. If not you might even want to take on the project of adding that topic to the wiki. And obviously there are lots more keywords and keyword combinations that can be tried to find discussions of this, or just read through the subject lines (yea, some subject lines are pretty useless, it may be most efficent to jut skip past them).

Quote:

Originally Posted by OpenIntro

Again though, I am curious as to how the recovery works. When I get Knoppix up, will I just have a Windows Explorer style interface where I can drag and drop files?

Knoppix doesn't do anything particularly special for "recovery". It just happens that many times when windows (particularly XP) can't boot, Knoppix can boot just fine and the hard drive is still readable. Obviously if the partition is damaged or completely deleted then Knoppix will not see the files, but there are still some Live CD recovery tools that may help save people even in these cases. Helix is one that you might want to look at if you have an interest in this area after you get Knoppix working (Please include mention of this in any Wiki article that you write).

And yes, you will be able to drag and drop files, but don't ever drop them on an NTFS type partition.
04-02-2005, 08:18 AM
OpenIntro

Harry,

I've downloaded, burned and booted to Knoppix, and I am now in....it actually almost brings me to tears to see ANYTHING on my screen right now, as I have seen nothing but "Operating System Not Found" for 3 months, and not sure what to do about it! The penguin is bringing me great joy! :D

Now here is where I am a bit lost....I am perusing around Knoppix and have found the file manager (which I assume is where I need to be to see my files) but am not sure exactly WHERE or HOW to look for the files. I see a ROOT FOLDER, but that just looks like the files off of the CD. I have been browsing the forums via the search but have yet to find a definitive HOW TO on how to recover files. Any chance you can help or at least point me in the right direction?

Also, I have 2 drives (C and D) that were on this computer, and I BELIEVE they were FAT, but am not 100% sure....is there any way for me to tell?

*edit*

Ok, I have clicked on DEVICES in the File Manager and see:

CD-ROM (cdrom) [/mnt/auto/cdrom] Mounted CD-Rom
CD-ROM (scd0) [/cdrom] Mounted CD-Rom
Floppy Unmounted Floppy
Hard Disc [/mnt/auto] Mounted Hard Disc Partition
Hard Disc (cloop) [/KNOPPIX] Mounted Hard Disc Partition
Hard Disc (root) [/] Mounted Hard Disc Partition
Hard Disc (sda) [/mnt/sda] Unmounted Hard Disc Partition
Hard Disc (sys) [/sys] Unmounted Hard Disc Partition
04-02-2005, 08:48 AM
Harry Kuhman

Quote:

Originally Posted by OpenIntro

Harry,

I've downloaded, burned and booted to Knoppix, and I am now in....it actually almost brings me to tears to see ANYTHING on my screen right now, as I have seen nothing but "Operating System Not Found" for 3 months, and not sure what to do about it! The penguin is bringing me great joy! :D

Now here is where I am a bit lost....I am perusing around Knoppix and have found the file manager (which I assume is where I need to be to see my files) but am not sure exactly WHERE or HOW to look for the files. I see a ROOT FOLDER, but that just looks like the files off of the CD. I have been browsing the forums via the search but have yet to find a definitive HOW TO on how to recover files. Any chance you can help or at least point me in the right direction?

Also, I have 2 drives (C and D) that were on this computer, and I BELIEVE they were FAT, but am not 100% sure....is there any way for me to tell?

Congratulations.

There is a lot more information in these forums than I can rewrite here, you may have to dig a little to find all of your answers. I'll try to give a few quick replies to get you started.

As to partition types, what OS did you have? If it was XP and you don't know what partiion type you have/(had) then it almost certainly NTFS. If it was Win98 (or 95 or me) then you certainly have FAT partitions since those systems didn't support NTFS.

Usually you will find a desktop icon for each partition, double clicking it opens the partition (in read only mode). If these are missing it might be a sign that the partitions have been destroyed (what happened in the first place to cause your problems?) Knoppix can read the partitions if they are still there, but really doesn't do anything magic to recover information from partitions that have been destroyed. Well, it does, I'll get to that below....

But wait! There is at least one other Live CD that does do magic to recover files from partitions that have been destroyed. It's called Helix. Curiously, there was another thread similar to yours today and I gave a link to it there. Here's a link to that thread, I'll leave it to you to find the link to helix inside it: http://www.knoppix.net/forum/viewtopic.php?t=18038 Of course, you're stating to mess with powerful magic here, so I would urge you to go carefully and slowly. Better to be sure that you know where you stand than rush into things.

As I said there is an awful lot of information in these forums and in the wiki that I can't duplicate for you tonight. Read through stuff and learn. There is a good book that someone (sorry, I forget who) wrote and published on-line as a beginners guide to Knoppix (not sure of the exact title). You should be able to find it with a little searching for the word book (there is also a hard cover book on Knoppix called Knoppix Hacks. This is not the same thing. I have not seen it but it is said to be good. I would suggest that you start with the on-line book, as I understand it that is more of a beginners resource.

If you can't find the lost partitions anywhere on your desktop (likely hda1 and hdb1) then it might help to know what happened to cause this and to know the current status of the partition table. This will help determine the next step. It might be to try to use Helix. Or actually (I just remembered) Knoppix does have a utility that can try to recover lost partitions from a hard drive that might do the job. It's called gpart and you might want to read more about it in the man pages (open a "shell" and type man gpart at a prompt. But again I would urge you to move slowly here, don't rush to actually run gpart until you better understand what caused the problem, what the problem is, and what you really want to do about it. Caution here is important to prevent data loss.
04-02-2005, 08:50 AM
Harry Kuhman

Never mind about the other thread with the link to Helix in it; I got my two threads mixed up. This is the one wth the Helix link, it's a few posts above this one.
04-02-2005, 09:05 AM
OpenIntro

I agree....I don't want to rush....but then again.....I WANT to rush! It's nice to have a glimmer of hope! ha!

I was running Windows XP Home SP2 on this Sony Vaio laptop. I had been out of town for a few days and when I came back, I was checking email and what not and noticed everything running very slow. All of a sudden the computer just rebooted and I got an error (don't even remember the error now). Turned it off for a bit and turned it back on, and Operating System Not Found....that's about it really. A 4 month old brand new top of the line laptop goes kaput for no reason (which is the BEST reason for them to go!)

On the Knoppix Desktop are: Trash. CD-ROM, Floppy disk and KNOPPIX....that's it....no partition icons :/ Not sure why or how they would have been destroyed. After I shut off the computer, it has sat shut off for a couple of months now until I recently started to work with it. So maybe we are working with destroyed partitions? So Knoppix is meant to auto-detect these partitions? I'm willing to get my hands a little dirty myself before sending it off for the dirty (and expensive) work to get done for me....

Thanks for the book suggestions and the links. I have actually come across most of the threads that you mention, including the one from today where you mentioned Helix. Browsed the Helix site, but was not sure what it was for. My biggest problem is that I have never worked with Linux before, but I think I should pick it up quickly. I have come across a few mentions of gpart but am not sure what to do with it. Will keep reading though.

Quote:

until you better understand what caused the problem, what the problem is, and what you really want to do about it.

This is my biggest issue....I don't know what caused the problem or what the problem actually is, so I don't KNOW what I want to do about it :P
04-02-2005, 09:20 AM
Harry Kuhman

Sounds like your partition table might be destroyed (maybe more, maybe just that and the MBR).

Just a hunch, but if you don't have a router providing a hardware firewall, or if you do but you opened something nasty in you email, or if you use Microsoft Outlook to read email (the easiest way to infect your computer) then some nasty trojan/virus/worm may have wiped out your partition table (or worse). gpart may help you recover it, but I would at least run some partition software to see what the current partition table looks like (be careful to not write any new partition table with such software, just look but do not write anything).

Of course, from what little we know it could be a complete hard disk failure (although it seems very unlikely that 2 drives failed at once). Do we even know if the hard disks are spinning? Are they identifying themselves to the BIOS? As I said, a lot to be learned before selecting a course of action.
04-02-2005, 09:30 AM
OpenIntro

Well, I can pretty safely say that this wasn't caused by me opening any kind of bad attachment in an email. I am quite alert to these kinds of things, though I DO use Microsoft Outlook Express (but will no longer once I get back up and running, when I move to Thunderbird). I have had spyware issues in the past but had completely rid myself of anything residing on my computer that shouldn't have been there. Norton Antivirus was up to date as well, and I have never run into any virus/trojan issues in the past, but you never know these days. Though, this was a pretty new computer, so I felt it was pretty clean....

The laptop should have only one hard drive, but 2 partitions...a C and a D.....total of 80Gb hard drive....

How do I tell if the disks are spinning? When I startup, it sounds like a normal startup, and I get my VAIO screen, and it usually sits there for a bit before coming up with the OPERATING SYSTEM NOT FOUND screen....so it sounds like the disks are spinning. How can I tell if they are identifying themselves to the BIOS?

What partition software should I use to see what it the partition table looks like....though I must admit, I have no clue what a partition table is SUPPOSED to look like....what would happen if I just tried to run gpart right now?

*edit*

Helix is now finished downloading.....should I burn and attempt to work with it rather than Knoppix?
04-02-2005, 09:31 AM
Harry Kuhman

Re: Knoppix for Data Recovery?

Quote:

Originally Posted by OpenIntro

...I have a Sony Vaio laptop that recently crashed and....!

Quote:

Originally Posted by OpenIntro

Also, I have 2 drives (C and D) that were on this computer...

OK, I'm getting tired and obviously somewhat confused as I try to follow multiple threads today. I fanally just caught this. Do you really have a new laptop with two drives, or do you have a laptop with one disk drive that has two partitions on it? And if it is the second case above, just why does a new laptop have two partitions on it? All new laptops I've seen only come with one partition (I had to shrink my NTFS partition to make space for a second FAT partition, but since you didn't know the partition types it seems unlikely that you did this or anything like it). This could matter, since if it is one drive with multiple partitions it is much more likely that it is a drive failure (although I still think it is most likely that some nasty software wiped out your partition table).

This is my last post for a while, I need to get away from the computer.
04-02-2005, 09:46 AM
OpenIntro

Here is my computer....

I'm pretty sure it is one 80Gb hard drive with 2 partitions, a C and D drive....this is how it came brand new....I didn't change anything on it drive-wise....The C drive is where Windows was installed and most of my programs....the D drive was strictly for files.....

So if it is:

1) drive failure

where does this leave me (besides a rock and a hard place)

or

2) wiped out partition table

.....where does this leave me? :P Is it Knoppix-able?

Is running gpart going to do me any good right now?

Do you have AIM? Might be easer to chat about this on there if you have time! :)
04-02-2005, 10:22 PM
Harry Kuhman

Quote:

Originally Posted by OpenIntro

I'm pretty sure it is one 80Gb hard drive with 2 partitions, a C and D drive....this is how it came brand new....I didn't change anything on it drive-wise...

I'm pretty sure it's one large hard drive too, even though you used the term two drives instead of two partitions. Interesting that they would set ot up that way, nost preinstalled systems come with one large partition.

Quote:

Originally Posted by OpenIntro

...So if it is:
2) wiped out partition table
.....where does this leave me? :P Is it Knoppix-able?

I think this is the far more likely situation, although if it is I would be very surprised if it had not be caused by some form of virus/worm/trojan/malware. I'm not an expert on Knoppix partitoning software (generally use other stuff), but you should be able to determine if whatever comes in Knoppix can see the drive and can see that the partition table is wiped out. This would be enough to convince me that the drive is working and it's a partition table issue. I expect that there is even a point in gpart where it scans the drive, shows you the partition table that is it's best guess, and lets you choose if you want that written to the disk. So everything up to that choice to write should be safe, but see the man pages for gpart to be sure.

I rather expected someone who know this area far better that me to jump in here while I took a break.

Quote:

Originally Posted by OpenIntro

.....
So if it is:
1) drive failure
where does this leave me (besides a rock and a hard place)

Ithink this is the less likely case, This leaves you wih a choice, neither option is good. One you could return the notebook for warranty replacement of the drive. But that make it very unlikely that they will do anything to help you get your data back (although they could give you the old drive once they confirm it's bad, they just are unlikely to be willing to do that unless you put on a lot of pressure). Two you could send that drive away to the expensive data recovery services, but that will likely void any warranty and make it unlikely that yu will get a replacement for your 80 meg drive. No good option here, but again this could be the case but I think it's less likely that the above.

Quote:

Originally Posted by OpenIntro

Is running gpart going to do me any good right now?

Read through the gpart man pages. As I said, I expect there is a point where you get to commit, and as long as that is the case then anything up to that should be safe. You should be looking for gpart to come back and tell you that it thinks the disk should have 2 partitions and their reported sizes should make sense. And, of course, if gpart says the disk isn't spinning (or errors to that effect) then that tells us a lot.

Quote:

Originally Posted by OpenIntro

Do you have AIM? Might be easer to chat about this on there if you have time! :)

Sorry, I don't use AIM or any other IM system. Don't assume I'm some big expert that can talk you through all of your problems though. The truth is closer to I'm just one or two steps ahead of you.
04-03-2005, 01:29 AM
OpenIntro

haha....1200+ posts, you've been around the Knoppix block a few times ;) And at this point, two steps ahead is like a MILE ahead right now :P

Warranty replacement is not an option.....I bought it through uBid.com and it only came with a 90 day warranty. So I am SOL on that front. I have already purchased a new drive on eBay, because I had planned to send the computer off to have the data retrieved to a data recovery place.

Now, what exactly IS a partition table, and what does that get me if I can read it with gpart?

So, bu committ, do you mean, possible data loss? Any gpart experts, feel free to chime in!
04-03-2005, 02:46 AM
Harry Kuhman

Quote:

Originally Posted by OpenIntro

Now, what exactly IS a partition table, and what does that get me if I can read it with gpart?

Boy, what a question, tons could be written on this. I'll try to answer it quickly, beyond this use Google for more information.
Since the early days of PC hard disks, there has been a way to break these disks up into one or more spaces where data is stored on the disk. These are the partitions. The very frist sector of the hard drive (head 0, track 0, sector 0) is defined to hold two important pieces of data. The first part and bulk of this sector is the MBR or Master Boot Record, a short piece of code that is loaded to start booting the disk. The BIOS then jumps into the MBR and that code runs to finish loading whatever software is to be run (usuall an operating system). At the end of this sector, after the MBR proper, is a small table of bytes called the partition table. The partition table defines where the data portions of the drive are. For a single partition on a drive there would be one entry, it usually would start at track one and go to the end of the disk. Sometimes there is a little space reserved at the end of the disk for special engineering use. The partition table entry also contains other information like the type of partition (FAT, FAT12, FAT32, NTFS, Linux swap, and so on) and other things important at boot time. It works out well that it's at the end of the same sector as the MBR because the entire sector is actually loaded into memory at once; the program in the MBR needs the partition table to figure out how to boot the rest of the system.

The choice to make the patition table only a small space at the end of the first sector limited it's size however. Because of it's limited size it can hold only enough information for up to 4 partitions. Thus there can only be 4 physical partitions on a disk (unless you play some games and swap in different partition tables, beyond the scope of this discussion). To get around this limitation, later systems created a patrition type called an extended partiton. If one of the 4 physical partitions is made an extended type, then it points to a block of disk space (partition) that is further subdivided into "logical partitions". Beyond this simple explaination, start using Google if you want a byte by byte breakdown of what the partition table holds, for our purposes it should suffice to understand that it's the space on the disk that holds the information that you set up to define the disk when you run fdisk or other partitioning software. It is key in defining how all of the other bits on the disk are to be interpreted.

So if the partition table or the entire first sector is overwritten, critical information needed to boot and to see the partitions on the disk is lost. Of course, if something really nasty is out to destroy your data it can also write over the data itself, or can at least destroy other key information first (like the directory structure that tracks all of your files), but if all that is lost is the partition table it can make it very hard to recover your data.

Hard, but not imposiable. This is where gpart comes in. gpart looks over the data on the entire disk. There are things stored in partitions that can often be recognized. So gpart looks over the entire disk and tries to make an evaluation of how many partition there are, where they start and stop, what types thay are, and so on. It's only a guess, but it's an educated guess, and it's better than nothing. It's up to the user to decide if the guess looks reasonable and if he wants to accept it. If gpart thinks there are two partitions, one NTFS and one Extended, this sounds like a good guess. If it thinks there is one partition and you know there was a C and D partition (as well as another letter for the CD drive) then that would be a bad guess. It might even say there are 3 partitions and still be right, sometimes vendors add a small hidden partition of service ralated stuff on the disk. And, of ciourse, if it says it can't figure out where any partitions on the disk are, that's not a good sign. If you accept gpart's guess at what the partitions are then it rewrites a new partition table for you.

Note that such a hard drive still isn't bootable if the MBR has been destroyed. But booting from a CD does not require anything in the HD MBR, so you can still boot a Knoppix CD and may now be able to see the data on your partitions. Once you recover your data then reinstalling Xp should rewrite the MBR for you.

I hope this gives you enough to go on. Good luck, and plase post back with your results.
04-03-2005, 05:33 AM
OpenIntro

Thanks for the breakdown! That should be quite helpful!

Final 2 questions before I make my bold moves....

1) Is gpart already built into the latest Knoppix that I downloaded?

and

2) Once I committ in gpart and rewrite the partition table based on its guess, am I COMPLETELY committed at that point? If it doesn't work, does that mean that even sending to data recovery is going to be an impossible task? I don't want to really chance destroying things!
04-03-2005, 07:55 AM
OErjan

you are pretty much COMPLETLY comitted.
if the guess is wrong the data recovery wil cost you 10-50 times as expensive and be MUCH less sucessfull at finding ALL files.
a good recovery from a disk like that can go up to 50 000 euro and still not be 100% of content.
04-03-2005, 08:15 AM
Harry Kuhman

Quote:

Originally Posted by OErjan

you are pretty much COMPLETLY comitted.
if the guess is wrong the data recovery wil cost you 10 times as much and be MUCH less sucessfull at finding ALL files.
normally a good recovery from a disk like that can go up to 50 000 euro and still not be 100% of content.

I disagree with this completely. gpart only writes to the partition table. Assume it is bad now (although one wants to be very sure of that before letting gpart change it). It is easy enough to wipe it out again if the gpart does not help, and one would be no worse off than they are now. You could even make a copy of the bad bytes in the partition table now and relace them (if you really wanted to) later if gpart didn't help. Please explain why you believe that accepting a gpart partition table could leave him any worse off than he is now, in actual technical terms, not just in unsupported threats that recovery will cost more and recover less.
04-03-2005, 09:34 AM
OErjan

it seems the companies rely on the corupt data to make a quick recovery. the overwritten entries will make it HARDER for them to recover stuff. my sister got her drive trashed, lots of IMPORTANT stuff on it, she used gparted, it did not work right.
as a result of that it took a profesional company and huge amount of cash for her to get data back. the company said they had to work 3-5 times longer on recovering a disk like that as oposed to a "freshly" crashed one, and that the data was less "reliable". otoh it could have been salespitch.

using a dd to repalce an image of the whole disk would work i guess, or just replasing the gpart "damage" as you said.
something SHE did not do.
04-03-2005, 09:48 AM
Harry Kuhman

Quote:

Originally Posted by OErjan

otoh it could have been salespitch.

Yea, it sounds that way to me. Assume for a minute that a virus wiped out his boot sector (a common enough thing for a virus to do). You are simply not going to make anything worse no matter what else you write there. And no data company of any repute is going to claim that it made things harder to recover by not having the bad sector. It seems much more likely to me that your sister ran into someone who, once they had her drive, saw a chance to raise their price and make lots more money off her. But there is absolutely no technical reason for the increased cost, just someone that saw a mark and exploited a problem they were having.
04-03-2005, 06:52 PM
OpenIntro

Everytime I run

gpart -c /dev/hda1

it immeidately just pops up a terminal window and does nothing, and the top of the screen says finished.
04-03-2005, 08:26 PM
fingers99

Joj!

You're trying to recover a partition table, not check on one partition.

Run

gpart /dev/hda

(The partition table is for the whole drive, not one partition.)

gpart's unassuming home page is here

I can't speak to your problem, but in the past it has recovered partition tables which I've accidentally fdisk /mbr ed (and then remembered I hadn't quite copied everything I needed over).
04-04-2005, 09:30 AM
jjmac

Code:

The poor old partition table, it's always getting blamed for everything. It's only a set of 4 16 byte records starting at 0x1be in your mbr. People really need to get over this don't touch preception. It is so crucial to your system, but also so benign, with a little closer familiarity. Having the messed up table as is __might__ give a recovery co some hint as to how the screw up occured ... but that would be all. And wouldn't really concern them either. Basically there only going to scan the disk, looking for various signatures, that would suggest the data areas. Making a very simple copy of the screwed table before any fix is attempted is a good idea. If for any reason, that a person can at least restore the original error state, in case they muck it up further. People seem to get into more problems over this than is really warrented. And suggests to me, that the role of the table, and __how__ it fits in, isn't understood very well generally. Once you get a good table, and before any major changes are made such as ... additions, removals, resizing. Why don't people just make a simple "dd" copy to floppy.Reboot to test it's working. Then start working on it. Even a straight forward ... ]# sfdisk -Pt /dev/hdb will dump the table for hdb, in a humanised form, but as it actually is, in the mbr. With that alone as a backup (written down on paper), a person could just delete the whole thing,then recreate them, using the same numbers. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [root:18:06]# cfdisk -Pt /dev/hdb Partition Table for /dev/hdb ---Starting--- ----Ending---- Start Number of # Flags Head Sect Cyl ID Head Sect Cyl Sector Sectors -- ----- ---- ---- ---- ---- ---- ---- ---- ----------- ----------- 1 0x80 1 1 0 0x83 254 63 8 63 144522 2 0x00 0 1 9 0x82 254 63 60 144585 835380 3 0x00 0 1 61 0x05 254 63 1023 979965 59071005 4 0x00 0 0 0 0x00 0 0 0 0 0 5 0x00 1 1 61 0x83 254 63 589 63 8498322 6 0x00 1 1 590 0x83 254 63 1023 63 8498322 7 0x00 254 63 1023 0x83 254 63 1023 63 8498322 8 0x00 254 63 1023 0x83 254 63 1023 63 8498322 9 0x00 254 63 1023 0x83 254 63 1023 63 8498322 10 0x00 254 63 1023 0x83 254 63 1023 63 8498322 11 0x00 254 63 1023 0x83 254 63 1023 63 8080632 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ All the "fdisk" varients have usefull output formats ..., but yep, i know, i'm friggin slack myself when it comes to backups too :). jm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If your free, And you know it ! Then, clank those chains ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
04-05-2005, 10:24 PM
OpenIntro

Ok, so my new hard drive just came in the mail today....so in order to test the hard drive vs. mother board theory, I took out the old hard drive and replaced it with the new hard drive (but have not done anything with it)....

I booted up with Knoppix and upon starting up, I noticed that it said it was a Samsung drive, and somewhere in the startup, I noticed it said hda :)
When Knoppix came up, I don't see any hda on the desktop, but when I go to the file browser, and click DEVICES, I see hda in the list. When I clicked on it, it said the drive was not mounted....not totally sure what this means, but it looks like it is recognizing the hard drive at least....

Any ideas?
04-05-2005, 10:59 PM
Harry Kuhman

Quote:

Originally Posted by OpenIntro

.....When Knoppix came up, I don't see any hda on the desktop, but when I go to the file browser, and click DEVICES, I see hda in the list. When I clicked on it, it said the drive was not mounted....not totally sure what this means, but it looks like it is recognizing the hard drive at least....

You will not see hda on the desktop. At the moment the drive likely isn't even formatted, but even after it is you will not see hda. hda is the drive. What you see on the desktop (when they are available) are the partitions on that drive, not the drive itself. So before you can see any icons on the drive you will need to format it (which you could do in Knoppix but you very well may rather do with Windows. I would certainly try windows first, and only use Knoppix if you couldn't get what you want with windows).

Unfortunately, I'm not as comfortable with an Xp install as I am with Win98. My own notebook came preinstalled, I've only ever installed XP once for a friend. So I don't recall all of the formatting details. I think Xp uses something other than the fdisk program I've grown used to. But my suggestion would be to reinstall XP. When it gets to the issue of formatting the drive you very well might want an NTFS partition (FAT partitions, for example, still have the 4 gig file size limit and that might be an isses in a few rare cases. But I would suggest making no more than half the disk NTFS, and putting a FAT partition on the rest. You likely will not notice the difference between the NTFS and FAT partition under XP if you are the only user of the system and don't do fancy access control stuff (I don't notice the difference, 2/3 of my hard drive is FAT). You might want to leave a small amount of space for a Linux swap partition (512 meg to 1 gig, no more), but it's not really needed (I didn't do this). You will not be able to make the swap partition with the XP formatting tool, all you can do is not make the FAT quite fill the hard disk, and then later create the swap partition with Linux.

Of course, this is assuming that you want to reinstall XP, and also that you will be running Knoppix from the Live CD. I personally don't believe in installing Knoppix to hard disk and don't advise people to do so. But you might want to do so, or even better you might want to install Debian Linux (or some other distro) to a hard disk prtition. If so now is the time to plan on how much space you want to leave for a Linux partition and again a small swap partition as stated above. Many Linux systems actually set up a number of partitions, but I'm not comfortable enough with Linux to know how much space I would need in each of several different partitions, so at least for my use I install all parts of Linux to the same partition, and sometimes share data with windows on a FAT partition.

This certainly adds extra evidence that it is the hard drive itself that is giving you the problem. I still think it would be worth a few dollars to try to read the drive in a desktop system before sending it to any recovery company. And, if you really think it is worth sending the drive to a data recovery company, do your homework to be sure you don't send it to some less reputable company who will try to squeeze you for all they can once they have your drive.