Recovering data from a hard drive

[tad]

Yes, I've gone all geeky

After ripping out my infected hard drive (windows was totally inoperable) I bought a hard-drive caddy and connected up.
The caddy promptly blew up. (I guess I'm jinxed)
I ordered another one which came this morning which I'm viewing now. It doesn't add up though. When I click on properties it shows 160GB used out of 320GB however when I open it all the files only add up to ~20GB

My daughters' documents are all there. Mine and Mrs. tad's cannot be accessed and show 0MB content. I know that missing 140GB must be there somewhere. Me and the wife were the administrators on the old computer and I'm wondering if they are protected still for this reason (which would explain why my daughters' files are there -they were not administrators)

I have quite a few photos in there that I didn't back up :( (and 4 series of LOST) :o

Yes after last time I bought an external hard drive but I thought it just copied everything automatically -how stupid is that? (That's a rhetorical question by the way)

Anyone any ideas on how I can access the missing files?

[eldeano]

Anyone any ideas on how I can access the missing files?

Is that a rhetorical question? I could answer the one before it. :smug:

[tad]

Is that a rhetorical question? I could answer the one before it. :smug:
This thread is a smug-green-face-free-zone:naughty:

[gtappend]

Do you know how the hard disc was formatted? Have a look in the properties if not.

If it is NTFS then it may be a problem with access rights preventing you getting to your own files.

Have I understood correctly, that the disc is now in a USB casing attached to a Windows PC? Which Windows is running on it?

[tad]

Do you know how the hard disc was formatted? Have a look in the properties if not.

If it is NTFS then it may be a problem with access rights preventing you getting to your own files.

Have I understood correctly, that the disc is now in a USB casing attached to a Windows PC? Which Windows is running on it?

I assume it is NTFS as it was formatted through xp
I viewed it at work on my 64mb laptop. When I got home I put it on my (currently) ubuntu system which said 'volume could not be mounted' -which just sounds rude.

Then I tried it on my friends VAIO (a small one) which could not open it due to errors (I can't remember the exact message now)
Iĺl try it on a 'big' windows computer tomorrow, but yes it is in that USB casing attached to any computer I can get hold of at the moment.

[gtappend]

I assume it is NTFS as it was formatted through xp

XP doesn't (well didn't use to) format as NTFS be default. You usually get the choice of NTFS or FAT332.


I viewed it at work on my 64mb laptop. When I got home I put it on my (currently) ubuntu system which said 'volume could not be mounted' -which just sounds rude.


That doesn't sound good. You might want to try Knoppix (http://www.knoppix.org/) - this can usually mount most hard discs if there is anything left to read on them (even NTFS ones).

[tad]

NTFS
I'm scanning it now (on windows xp) using the 'automatically fix file system errors' and 'scan for and attempt recovery of bad sectors' options
Don't suppose it will do any good....:(

I'll try knoppix when I get a moment.

[gtappend]

NTFS
I'm scanning it now (on windows xp) using the 'automatically fix file system errors' and 'scan for and attempt recovery of bad sectors' options
Don't suppose it will do any good....:(

Actually, it might do more worse than good. If you want to recover the files, then it is usually better to try and copy them off the disc using tools such as knoppix, acronis, ghost, etc. than repairing the disc itself. If Windows redefines the directory entries then recovering the data becomes a lot more difficult.

[tad]

Actually, it might do more worse than good. If you want to recover the files, then it is usually better to try and copy them off the disc using tools such as knoppix, acronis, ghost, etc. than repairing the disc itself. If Windows redefines the directory entries then recovering the data becomes a lot more difficult.
...oh bollocks.

[gtappend]

So did Windows "automatically" fix anything? Or is your hard drive now in need of an urgent holiday in Germany? :rolleyes:

[tad]

So did Windows "automatically" fix anything?
no.

Or is your hard drive now in need of an urgent holiday in Germany? :rolleyes:
Why, can you fix it?

[gary]

no.


Why, can you fix it?

Yes he can!!!

This is turning into an episode of Bob the builder.. seriously, having sat next to Graham at dinner and talked computer for at least some of the time I am certain that he will have access to the tools needed to recover your episodes of LOST. Though why anyone would actually want to do this is way beyond my pay grade.

For those on the 'irony' thread - did you spot this one?

[Chiny]

It may be too late after the Windoze scan but many have praised the magic powers of Spinrite (http://www.grc.com/sr/spinrite.htm).

Coincidentally, I have just received an email of woe from a friend who has managed to delete 10 years' of emails.

Backups :cool:

[tad]

Yes he can!!!

This is turning into an episode of Bob the builder.. seriously, having sat next to Graham at dinner and talked computer for at least some of the time I am certain that he will have access to the tools needed to recover your episodes of LOST. Though why anyone would actually want to do this is way beyond my pay grade
Philistine.
Actually it's just the photos on there that are of any importance

It may be too late after the Windoze scan but many have praised the magic powers of Spinrite (http://www.grc.com/sr/spinrite.htm).

Thanks, I think I should try a couple of things before shipping it off to Germany.

[Jules]

Actually it's just the photos on there that are of any importance

Does this mean all your avatars are lost as well? :D

[tad]

Does this mean all your avatars are lost as well? :D
I'm glad that you are concerned with this serious dimension, Jules, but you can breathe a big sigh of relief as I had those on my memory stick.:smug:

[gtappend]

Why, can you fix it?

I don't know, but I'd take a look if you want me to.

Philistine.
Actually it's just the photos on there that are of any importance

Thanks, I think I should try a couple of things before shipping it off to Germany.

NTFS
I'll try knoppix when I get a moment.

I can't comment too much on SpinRite as I have other ways of recovering data, but I guess I'll make a note of it in case they don't work one day.

Back to the original problem...

In this case the hard disc is (or at least was) readable on a Windows XP PC with it attached via USB. The problem was that not all of the data was visible.

If the files that are visible are also readable, ie. documents load propery, pictures are not distorted, etc. then I would assume that they can be recovered by just copying them across to the PC.

The problem comes if the drive was formatted with NTFS and when the users were setup at the very beginning, someone selected the option "protect users files to stop other users accessing them" or whatever the English text really is.

The XP PC is probably observing these access rights and not letting tad see all of the files.

Hence the suggestion with Knoppix (http://www.knopper.net/knoppix/index-en.html). Knoppix is a Linux system that you can boot from a CD (there is also a DVD version with more applications on it, but for our purposes the CD is fine). You download the .ISO image from the Knoppix website and use your CD writing software to make the CD image.

Then you boot from this CD and it should have an icon on the desktop for your drive. If you re-attach it internally then it will be called something like hda. If it is in the USB case then it will probably be called sda.

Double-clicking this icon will mount the drive and should allow you access to the entire hard drive. Then you just need to copy the files to another drive or usb stick, or write them onto a cd (chose "k3b" in the Knoppix menu).

[tad]

Thanks Graham , I'll let you know how I get on, though I'm not even sure how to boot from cd on this computer...

[eldeano]

Actually it's just the photos on there that are of any importance

;) :thumbs-up:

[g00se]

You can begin the diagnosis easily enough using the Ubuntu system you've already got. Open a terminal and type in the following commands, consecutively, recording the output of each (where there is output) to post back to this thread. The 'xx' (and maybe even the 'sd') will depend on where the device is placed by the OS. You might get some clues from your file manager.

It might be a good idea to look at your partitions later, but start with the below

sudo su

mkdir -p /mnt/c

mount -t ntfs -o ro /dev/sdxx /mnt/c

df -h /mnt/c

exit

exit

[tad]

Thanks for the input here, I tried a proprietory 'fixer' on the Windows computer at work and was able to view most of the files and stuff on the disk (to copy the files you have to pay for the application). Once I knew that I could recover the files I've been a bit lax actually doing anything. g00se the below means nothing to me. Graham I downloaded the Knoppix .ISO image but wasn't sure how to convert it to a bootable CD but I think I know have it so will try that out.

sudo su

mkdir -p /mnt/c

mount -t ntfs -o ro /dev/sdxx /mnt/c

df -h /mnt/c

exit

exit

tad@tad-desktop:~$ sudo su
[sudo] password for tad:
root@tad-desktop:/home/tad#
root@tad-desktop:/home/tad# sudo su
root@tad-desktop:/home/tad# mkdir -p /mnt/c
root@tad-desktop:/home/tad# df -h /mnt/c
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 73G 8.1G 61G 12% /
root@tad-desktop:/home/tad#
root@tad-desktop:/home/tad# mount -t ntfs -o ro /dev/sdxx /mnt/c
ntfs-3g: Failed to access volume '/dev/sdxx': No such file or directory
Please type '/sbin/mount.ntfs --help' for more information.
root@tad-desktop:/home/tad# df -h /mnt/c
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 73G 8.1G 61G 12% /
root@tad-desktop:/home/tad# exit
exit
root@tad-desktop:/home/tad# exit
exit
tad@tad-desktop:~$ ??

[greytop]

mount -t ntfs -o ro /dev/sdxx /mnt/c

I think the xx needs to be replaced by a1

as that's what the disk mounted as
(Mounted on /dev/sda1 73G 8.1G 61G 12% /)

[tad]

mount -t ntfs -o ro /dev/sdxx /mnt/c

I think the xx needs to be replaced by a1

as that's what the disk mounted as
(Mounted on /dev/sda1 73G 8.1G 61G 12% /)

Gosh greytop I'm impressed!

Graham I got the Knoppix running and it said:

Failed to mount '/dev/sda1': Operation not supported
Mount is denied because NTFS is unclean. Choose one of these actions:
Boot Windows and shutdown it cleanly, or if you have a removable
device then click the 'Safely Remove Hardware' icon in the Windows
taskbar notification area before disconnecting it.
Or
Run 'ntfsfix' on Linux unless you have Vista, then mount NTFS with
the 'force' option read-write, or with the 'ro' option read-only.
Or
Mount the NTFS volume with the 'ro' option in read-only mode.
What does that mean then?

[gary]

This (http://www.dvdcollections.co.uk/lost/lost-series-dvd-box-set.htm) might solve the problem Tad - thinking inside the box!!

[Edmundo]

This happened to me recently as well. The problem is when you protect your files in xp so others can't share them. You need to reassign the windows file permissions and it is reasonably straightforward. There are a whole series of windows knowledge base articles which document how its done. For xp you have to be logged on as an administrator and boot in safemode. See the following:-http://support.microsoft.com/kb/308419/en-us. Good luck.

[tad]

This (http://www.dvdcollections.co.uk/lost/lost-series-dvd-box-set.htm) might solve the problem Tad - thinking inside the box!!

Why Gary, with Christmas so close that would make a terrific gift for LOST fans...hint.:rolleyes:

[tad]

This happened to me recently as well. The problem is when you protect your files in xp so others can't share them. You need to reassign the windows file permissions and it is reasonably straightforward. There are a whole series of windows knowledge base articles which document how its done. For xp you have to be logged on as an administrator and boot in safemode. See the following:-http://support.microsoft.com/kb/308419/en-us. Good luck.

Thanks for the ideas Edmundo and for everyone else's ideas too.

In the end I got fed up with the DIY approach and used a utility called RecoveryFix for Windows which I ran on a computer at work with my drive in an external caddy. Not only did it get everything I wanted bar a couple of corrupted files, it displayed them in a Windows style folder tree, so I'll give them a plug even though it cost $49.
I tried two other applications and they were nowhere near as good (most of these applications let you do the search but you have to buy them to actually recover the data)