[Gllug] Data Recovery

[James Courtier-Dutton]

2009/1/25 Stephen Nelson-Smith <sanelson at gmail.com>:
> It's a sad tale... and cautionary.... people, this is why we take backups...
>
> Anyway - I need to recover a bunch of critical files from an NTFS
> partition on a disk which has been damaged by being dropped.
>
> The disk in question was set up as a dual boot, and I was able to boot
> into her Linux system, but it's painfully slow, and there are lots of
> error messages indicating that the disk is damaged.
>
> I can't boot into windows.  I can't mount the partition.  I've tried
> running ntfsfix, and I've tried using the windows recovery console on
> the windows CD, and while I have been able to run chkdsk, after it
> completes I still can't mount it, and Windows claims to be missing a
> vital file, and won't boot.
>
> I've tried using dd_rescue to image the disk, but it ran for a whole
> day and only managed 2G of data.
>
> What next?  Money isn't really an issue - the data needs to be
> recovered.  Can anyone recommend a specialist who might, for example,
> remove the platter, or extract data electrostatically?  Any other
> suggestions?
>
> Thanks guys,
>
> S.
> --

If cost is not a problem:
If you are getting sector errors, power off the computer immediately.
HARD power off, no waiting for it to write changes to disc.
Call a well know data recovery service like Ontrack and follow their
instructions for sending to them.
They will open the HD in a clean room, remove any dust (that was
created when the disc was damaged) that might cause further damage and
then place the disc platters in a brand new unit that is un-damaged
and recover as much data possible.

Once you get sector errors visible to the user, the disc has probably
already lost over 100 sectors using its internal bad-sector
reallocation process.
I.e. The disc is really damaged by now so any more use of it will
damage it further.

If cost is an issue.
Place the disc in an external USB attached container. Do not connect
it yet. Boot into Linux. Turn off all HD readahead caching, and then
plug in the USB cable and do a ddrescue with no auto retries. This
will give you an image of the HD with the minimum of new damage.

Then make extra copies of the dd image and then try various repair
processes on the copies, but not the original image.

Good luck

James
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug