help - recovering data from a messed up hard drive.

[dodecahedron]

my father-in-law's computer.
Windows XP Home.

went to the computer yesterday morning, windows is messed up.
when the computer is turned on, there's no graphics WinXP loading screen. instead a black/white progress bar (like that of Win2K) at the bottom.
after a few minutes there's a message about a file missing or corrupted: system32/drivers/ntfs.sys. yikes!
then it hangs.

OK took the drive out of and put in my computer, as a slave to my OS hard drive.

upon bootup, after the black WinXP screen but before the blue logon screen, WinXP says the hard drive needs to be checked. if i let the checker run, it does the checking, for a long time. various error messages there, about some stuff not readable (sectors or something), and deleting of parts of files (if i get a chance i'll edit later and write the errors more accurately).

eventually you do get into WinXP (my WinXP Pro).
everything is sluggish.
clicking drive C (that's the bad one) in My Computer, it takes for ever (= a few minutes) to respond in any way. sometimes i get a Not Resonding on that window. if i double click the C drive i get (at best) that it's not accessible or some kind of error meessage like that.
anyway the whole system is sluggish even clicking on the other drives etc.

OK booting into DOS with a floppy.
used sysinternal's NTFSDOS to see the NTFS partition of that bad hard drive.
i can see the files when i type dir.
at least as long as they are file names in Enlish. when i get to subdirs with files whose names are in Hebrew, it freaks out, lists them with weird gibberish graphics, and get's into infinite loops of listing the same gibberish name on the screen a million times.

i can see the files in directories when the names are in English.
i can even see contents of text files with the 'type' command.

however...copying files with 'copy' doesn't work.
tried copying from that hard drive to another one formatted with FAT32, it just won't copy.

frustrating - the files are there. just can't access them from within WinXP or NTFSODS.

any ideas for help please?
(forgot to say - of course there was no backup )

any help much appreciated. thanks.

[dodecahedron]

any chance of doing some kind of "Recovery" on WinXP?

i'm thinking, maybe just Windows is screwed, not the entire filesystem.

there's some kind of recovery in WinXP i know but i'm not sure how to use it.

booing from the XP CD, clicking R at the first menu you get to the Recovery Console, i've absolutely no idea what to do there.

i believe there's some sort of Recovery feature where it check's alll WinXP's files and replaces bad ones, but i'm not sure how to do it.
i had thought it's one of the options of the WinXP istall process.
i once tried to do it on my XP, clicked NEXT once too many times and ended up resinstalling a new WinXP over the current one! curiously i didn't lose my data. but don't want to go through that again.
anyone know how i can get to the "graphics screen" WinXP repair thingie ?

[pranav81]

dodecahedron,try using Easy Recovery Pro.You can recover the data through Windows.Just dont run CHKDSK as it will overwrite or relink or delete some files that it thinks are corrupt.It also allows you to create a DOS floppy disk and you can then recover your data through the Ontrack OS.


::Pranav::

[dodecahedron]

thanks for your help.

too bad.
already ran CHKDSK (windows insists on doing it at boottime, like i said).

where can i get Easy Recovery Pro? link? is it freeware?

what's "Ontrack OS" ?

[pranav81]

Easy Recovery Pro is not a free utility.I dont know of one which is free.I know this because it came with my computer.It's from Ontrack.Ontrack is a company which develops special recovery softwares.I have had a very good luck with ERP.I simply love it.I have version 5,but version 6 is out for long.I guess you can download a trial from their website.You can try www.ontrack.com

Ontrack OS is a small OS that resides on the boot floppy disk that you prepare in Windows for recovery operation in DOS.You can use mouse and keyboard as you do in Windows.


Hope this helps.


::Pranav::

[pranav81]

By the way,do you know how much part of the HDD is occupied by bad sectors?


::Pranav::

[pranav81]

http://www.ontrack.com/easyrecoverydatarecovery/


The trial edition can only recover zip and doc files,and shows other files that can be recovered.


::Pranav::

[pranav81]

There is a command "scannow" which scans for missing & corrupt system files and replaces them from the original Windows XP CD.I dont remember the full command line,but you can go to DOS and type "scannow/?" for all the command line options.I am now on a Win2K machine so I cant check it right now.


::Pranav::

[dodecahedron]

thanks for all the info.

i might try that Ontrack Easy Recovery Pro.
come to think of it, all the important files are doc files.
pdf too

the way things are looking now, my father-in-law might just take the hard drive to one of those companies that specialize in data recovery.
it might cost around $200-$500.

you learn the importance of backing up the hard way.


thaks for the reminder about scannow. new about it, forgot about it.

[socheat]

I've recovered data from hard drives in much worse condition using Linux. Try downloading Knoppix, booting it with the hard drive in the computer, and see what happens when you try to view the drive through KDE's file manager. If it can still read the drive/data, see if you can copy the files over the network (hopefully Knoppix correctly detected your network card and drivers).

Just so you know it's still possible... A couple years ago, my friend bought two new 60GB hard drives and wanted to raid0 them together. He had two partitions on his existing 30GB. He set up the raid0 and did a clean install on the drives. He copied over his personal files from his 30GB, and for good measure, he duplicated his data on both partitions of the 30GB. A couple days later, he figured the raid0 setup was working fine, and he wiped the 30GB. An hour after he did that, one of the raided disks failed and he lost all his data.

I took his 30GB disk, put it in to my computer, did a disk dump of the entire drive, and began to fgrep the 30GB file. After looking at a few Word, Excel and PDF docs in a text editor, we were able to figure out when a certain file began and ended. We then copied those chunks out of the 30GB file into their own files, and with a little tweaking, were able to get working files. It took over a week, but we were able to recover most of the data he was looking for.

[dodecahedron]

thanks Socheat.

Knoppix - is that one of the "Linux on CD" versions ?
i don't want to install Linux at the moment.

i don't have a network
will Knoppix be able to copy the files (if it sees them) to a FAT32 hard drive hooked to my system?

i don't think i have the expertise to do what you described you did

we'll see how things work out.
maybe i'll try that Ontrack Recovery program.

[socheat]

Knoppix doesn't actually install on your hard drive, it runs purely in memory (which is why I suggested it). Just boot off the CD and go. And yes, if you had another working hard drive in the computer, you should be able to move files from one to the other. I just figured you might want to give it a try before you try the $200-$500 solution.

[dodecahedron]

that's what i meand by a "CD Linux" - doesn't install itself on the HD.
yeah, it's worth a try.

where can i get it?
www.linuxiso.org? i'll give it a shot.

thanks.

[ccb]

I have similar situation. I hooked the damaged drive as a slave to other computer, installed Scavenger v2.1 Rev 14 . I was able to recover most of the files. I was able to recover files even after I deleted the partition, formatted, performed checkdisk on my drive.

Code: Select all

http://file.scavenger.v2.1.revision.14.cracks.lomalka.ru//CRACKS/F/I/File_Scavenger_v2.1_Revision_14.en.html

Click Special button. Be careful, do not click yes to install anything on any popup windows, Just save the file and install it.

Good Luck

[bill]

Hello dodecahedron,
I have had good luck with this program on a few occasions - http://www.runtime.org/ . You can download the program to verify the disk contents and then make the purchase for the recovery. Price isn't to bad either.
If you give it a try make certain to read the FAQ, most important don't let Windows try to fix or use the drive.

Good luck,
Bill

[dodecahedron]

thansk for the tips guys

[robertb]

I's a bit late here and I have maybe missed the point but as a suggestion what about booting to the damaged drive and pressing F8 at the boot.
You can then select safe mode and then the damaged xp operating system. If you can get going in safe mode then you could select Start\programs\accessories\system tools\system restore and select a restore date some days before the crash.
Here is a link with a few tricks at reaching safe restore if XP is proving hard to get at

http://www.kellys-korner-xp.com/xp_restore.htm

I have never used ntfs but can you copy files from an ntfs drive to a fat 32 drive? You mentioned it won't copy. Just a miserable thought I don't know the answer at the moment
good luck

[pranav81]

Yes robertb,you can copy data from NTFS to FAT 32 without any problems.I have FAT32 on my home computer and Win2K NTFS on my network server.I can connect HDD's of either one and can copy data from one HDD to other.


And ccb I guess you read the terms and conditions before joining this forum.Nobody should share information about program cracks.We just dont want to get this forum into a cracking station.So please refrain from posting links that point to illegitimate sites.No abuse intended.

I guess dodecahedron you should download trial version of ERP and then if you like it,buy it.Version 6 adds many features,but I am happy with version 5 for the moment.

See ya later,


::Pranav::

[bill]

Just checking, any luck with the data recovery. What method/methods did you try?

Bill

[dodecahedron]

hi guys.
thaks to you all.

@robertb:
based on your previous record, i was kind of expecting you to show up

anyway, i haven't done anything yet, since i'm very busy with work the last few days.
when i'm done with the work (and a bit of CDRLabs work too ) i'll try to do some recovery work on that hard drive.

i think i'll pass on the booting into safe mode trick.
unfortunately i've already had WinXP do chkdsk on it. i can only hope this didn't mess up too much data.

i think i'll try Socheat's suggestion of booting Knnoppix and trying to read the data off the NTFS drive to a different FAT32 drive.

then i'll try out Ontrack EasyRecovery, the trial version.
most of the important data on the disk is in .doc files anyway, so maybe that free trial version will be good enough.

then we'll see.
i might try BigMonkey's http://www.runtime.org/ suggestion.
also try out ccb's suggestion.

then we'll have to see how things stand.

at some point my father-in-law will have to decide how much money he's willing to spend on the data recovery.


by the way, does anyone know if these programs (EasyRecovery, File Scavenger, Runtime's GetDataBack) only read the hard drive or do some writing to it too?
what i'm getting at is: if i try one of these programs, and it doesn't work out, have i ruined the disk even further preventing any possibility of recovery by "experts" ?

[stix]

I hope you scanned the damaged drive for viruses.

[dodecahedron]

There is a command "scannow" which scans for missing & corrupt system files and replaces them from the original Windows XP CD.I dont remember the full command line,but you can go to DOS and type "scannow/?" for all the command line options.I am now on a Win2K machine so I cant check it right now.

i think its: sfc /scannow
(sfc = system file checker)

[dodecahedron]

I hope you scanned the damaged drive for viruses.

nope, i didn't.

but:
the computer had Norton AntiVirus before it crashed, and i believe it was updated and scanned regularly (once a week or so).
also, i've scanned my system after i removed the ruined hard drive from it.

i'll be sure to back up my system before i start any of the recovery stuff, though.

[bill]

GetDataBack is a read only program. As you have already tried, set the damaged drive as a slave on a working pc. The FAQ's on their web site is very helpful....

In one instance, I lost about 30gigs of programs and saved files on a Windows XP boot drive. The drive wouldn't boot. After a couple of days trying various methods I gave up, cried a little and formatted the drive. Then I read about this program ( better late than never ) on another forum before I reinstalled a new OS. It recovered about 95% of the drive.

I'm new around here, just wanted to let you know what has worked for me... Pranav81's suggestion sounds similar.

Good luck,
Bill

[pranav81]

There is a command "scannow" which scans for missing & corrupt system files and replaces them from the original Windows XP CD.I dont remember the full command line,but you can go to DOS and type "scannow/?" for all the command line options.I am now on a Win2K machine so I cant check it right now.

i think its: sfc /scannow
(sfc = system file checker)

Yeah,I forgot the command and remembered the option only.
Also ERP will ONLY read the HDD and will not write anyting on the HDD.I dont know about any other programs.

Good luck.


::Pranav::