Data recovery from HDD

Printable View

04-29-2007, 09:54 PM
Metallo

Data recovery from HDD

Hi,

Background

My brother brought me an old Samsung WU 33205A HDD of 3.5 GB that suddenly stopped to work on his PC (WXP PRO).

The scope here is to save the data on that HDD.

I have installed it on my system with the intent to help him solving the problem.
My OS is WXP PRO.

My system has recognized that a new hw was about to be installed and found the proper driver.

If I browse explorer I cannot see the hdd, therefore I went into Device Manager and saw that the "device is working properly".
Then I clicked Disk Management and I read:

Disk 1
Unknown
3,01 GB
Not Initialized

3,01 GB Unallocated

It looks like the HDD needs to be formatted.

Knoppix & myself

I am totally new to Knoppix and I was suggested to try it as a possibility to recover the data from the Samsung HDD.
I succeeded to burn a Live DVD and booted my PC.

I can see the HDD on the desktop, as well as the other HDDs on my system, in fact, if I click on them, they open neatly, but when I get to the Samsung HDD, I get a message that I cannot quote with the exact words but more or less is: the drive cannot be mounted because the file system is unknown.

The only thing I can say from my investigations is that the file system is FAT32.

Now, I am stuck and have absolutely no clou how to proceed, but I am confident someone here will help :roll:

Thank you!

Alex
04-29-2007, 10:16 PM
Harry Kuhman

The good news is that it sounds like the hardware is working.

The bad news is that it seems like the data on the drive is now bad. We obviously can't be sure at this point if the files are still there at all, but there is a good chance that the partition table is just bad.

And the really good news is that Knoppix has tools that can examine the disk and recreate the partition table. Two such tools (I have no idea why there are two tools to do this) are gpart and testcd. There are man pages that you can read for each (at a command prompt type man gpart or man testcd). So far I've only used gpart, but testcd looks simpler to use.

If Knoppix can't repair the partition table for you, don't give up quite yet. There are other live CDs that have tools to pull data off such drives. One is Helix.

If you post back it would be helpful to have more information about what you think was on that disk. Important information would include what OS your brother was running and what type of partition or partitions it should have. Information about what was happening when it stopped working may be helpful too.
04-29-2007, 10:33 PM
Metallo

Quote:

Originally Posted by Harry Kuhman

The good news is that it sounds like the hardware is working.

The bad news is that it seems like the data on the drive is now bad. We obviously can't be sure at this point if the files are still there at all, but there is a good chance that the partition table is just bad.

And the really good news is that Knoppix has tools that can examine the disk and recreate the partition table. Two such tools (I have no idea why there are two tools to do this) are gpart and testcd. There are man pages that you can read for each (at a command prompt type man gpart or man testcd). So far I've only used gpart, but testcd looks simpler to use.

If Knoppix can't repair the partition table for you, don't give up quite yet. There are other live CDs that have tools to pull data off such drives. One is Helix.

If you post back it would be helpful to have more information about what you think was on that disk. Important information would include what OS your brother was running and what type of partition or partitions it should have. Information about what was happening when it stopped working may be helpful too.

Hi Harry,

Thanks for your quick reply.

Well, the OS my brother is using is WXP PRO and he realized the HDD stopped working simply because he could not see the drive letter on his PC anymore :x
The file system is FAT32.
The disc contains many .doc files but more important many .dwg files from Autocad.

I tried to recover the data with PC Inspector, I managed to get about 50%, the rest seems to be corrupted.

That's why I'd like to give another try with Knoppix.

I will have a look at the two methods you suggest and hope to understand how the whole thing work.

Thank you
Alex
04-30-2007, 10:05 AM
Metallo

Follow up...

Well, I am trying to see if gpart can see the partition of my HDD, therefore I typed gpart/dev/hdb but I get the following message: no such file or directory

Can anybody help me ?

Thank you
Alex
04-30-2007, 01:34 PM
Metallo

OK, here I am again...

Well, I just could not get the partition because I forgot to type a spage between gpart and /dev/hdb, which may be clear for those who are used to command but unknown to me :(

However, here is what I got:

root@Knoppix:/ramdisk/home/knoppix# gpart /dev/hdb

Begin scan...
Possible partition(DOS FAT), size(3090mb), offset(0mb)
End scan.

Checking partitions...
Partition(DOS or Windows 95 with 32 bit FAT): primary
Ok.

Guessed primary partition table:
Primary partition(1)
type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT)
size: 3090mb #s(6330177) s(63-6330239)
chs: (0/1/1)-(1023/15/63)d (0/1/1)-(6279/15/63)r

Primary partition(2)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

AFAIK there is only one partition in the HDD, therefore what-s reported looks OK.

Now, I could go for the -W option, isn't that better to save the original partition first?
Cannot I save it on a separate folder of one of my disks?
Being into knoppix by means of a live DVD, can I write into my windows HDDs_

Thank you
Alex
04-30-2007, 02:23 PM
rusty

gpart -w will write the guessed partition table, not the entire partition to a device. I'm not sure if your partition table is compromised as it seems that knoppix sees the partition?

Have you tried fsck'ing the drive? man fsck, at a command line to see options including the -n option which will not repair anything.

Another tool I hope you won't have to use is lde (linux disk editor), theres a man page for it too, and a web page : http://lde.sourceforge.net/

HTH
04-30-2007, 03:10 PM
Metallo

Quote:

Originally Posted by rusty

gpart -w will write the guessed partition table, not the entire partition to a device. I'm not sure if your partition table is compromised as it seems that knoppix sees the partition?

Have you tried fsck'ing the drive? man fsck, at a command line to see options including the -n option which will not repair anything.

Another tool I hope you won't have to use is lde (linux disk editor), theres a man page for it too, and a web page : http://lde.sourceforge.net/

HTH

Hi,

Well, if my partition table is not compromised, why doesn't the HDD show up neither in WXP or cannot be open with Knoppix?

I can try fsck but I'd apprecciate if you write me the exact command because I cannot succeed :(

Thank you
Alex
04-30-2007, 03:41 PM
OErjan

there are a multitude of possible answers to all your questions.
on the last one, one that i think is close to home, there may actually be too much damage on the disk for windows to read it. and even Linux would be hard pressed and likely fail to work well on a disk with physical damage.
04-30-2007, 03:45 PM
Metallo

At least, can anybody tell me how to save the partition before writing the guessed one_

I need a step by step approach in order to save it on a separate folder, at least if the guessed partition does not work I can still restore the old one.

Thank you
Alex
04-30-2007, 03:57 PM
rusty

to use fsck

Make sure the drive is NOT mounted
open a shell
type: man fsck

then: fsck -N /dev/hdb, which will tell you what fsck would do

read the man page for other options to use as you see fit.
04-30-2007, 04:42 PM
Metallo

Rusty,

What do you exactly mean by not mounted?
Knoppix refused to mount it because it could not recognize its file system, so it should not be mounted if this is what you mean??

Thank you
Alex
04-30-2007, 04:49 PM
Metallo

That's what I get if run

fsck 1.40-WIP (14-Nov-2006)
[/sbin/fsck.ext2 (1) -- /media/hdb] fsck.ext2 /dev/hdb

Nothing else :(

Alex
04-30-2007, 04:53 PM
Harry Kuhman

Quote:

Originally Posted by Metallo

At least, can anybody tell me how to save the partition before writing the guessed one_

You can back up a MBR (of which the partition table is a part) with

Code:

$dd if=/dev/hdx of=MBR-backup bs=512 count=1

and restore it with

Code:

$dd if=MBR-backup of=/dev/hdx bs=512 count=1

whexe x is replaced by rhe proper number and hd is for regular parallel ide drives. Clearly with Knoppix you have to be sure that you write the backup file to a partition that is writeable, and having a backup on ram disk is of minimal use.
04-30-2007, 05:02 PM
Metallo

Quote:

Originally Posted by Harry Kuhman

Quote:

Originally Posted by Metallo

At least, can anybody tell me how to save the partition before writing the guessed one_

Yoy can back up a MBR (of which the partition table is a part) with

Code:

$dd if=/dev/hdx of=MBR-backup bs=512 count=1

and restore it with

Code:

$dd if=MBR-backup of=/dev/hdx bs=512 count=1

whexe x is replaced by rhe proper number and hd is for regular parallel ide drives. Clearly with Knoppix you have to be sure that you write the backup file to a partition that is writeable, and having a backup on ram disk is of minimal use.

Harry,

A question, the disk is for me the hdb and there is only one partition, should I then write $dd if=/dev/hdb of=MBR-backup bs=512 count=1?
I tried and the mbr has been saved into HOME Personal Filesr of knoppix, is this OK?

Thank you
Alex
04-30-2007, 05:17 PM
Harry Kuhman

Quote:

Originally Posted by Metallo

I tried and the mbr has been saved into HOME Personal Filesr of knoppix, is this OK?

OK for making the backup file, but I would copy it to a flash drive or even a floppy to be sure it would still be around when needed.
04-30-2007, 05:34 PM
rusty

try fsck -N /dev/hdb1
04-30-2007, 09:06 PM
Metallo

Hi guys,

Just wanted to let you know that gpart did a perfect guess of what the partition table of my HDD should be, in fact, after rebooting I could open the drive and save 100% of all my data :D

A big thank to you who took the time and patience to answer my "beginner's" questions.

Cheers
Alex
05-04-2007, 02:02 PM
alek6cu

Hi Metallo:
I know this is a Linux forum and all, but i had a similar problem once (i had overwritten the partition table) and solved it with a software called "Active Partition recovery" thats for Windows (DOS Actually) the program creates a boot floppy with tools which guess the partition table and even allow you to see the files on the disk as if the guessed partition was used (that way you can be sure to write it to the disk).

Luck.
05-04-2007, 02:10 PM
Metallo

Quote:

Originally Posted by alek6cu

Hi Metallo:
I know this is a Linux forum and all, but i had a similar problem once (i had overwritten the partition table) and solved it with a software called "Active Partition recovery" thats for Windows (DOS Actually) the program creates a boot floppy with tools which guess the partition table and even allow you to see the files on the disk as if the guessed partition was used (that way you can be sure to write it to the disk).

Luck.

Thank you for your advice, it is always useful to have alternatives :)

Regards
Alex