knoppix to recover data?

jon1981

Hi,

can knoppix be used to recover data from a laptop in an infinite boot loop installed with XP. my head is wrecked, ive so much personal stuff, music, photos ebooks all my college stuff from my college days and its all possibly gone!

Saruman

yup just stick it on a usb key or hard drive.. its grand.
Boot off the cd, if your data is there then plug in a usb key or hard drive and copy it over. Done it plenty of times for customers.

jon1981

cheers for that

NutJob

Knoppix and many others are great for this job

have a look at http://www.sysresccd.org/Main_Page

I use it all the time for saving files from hard drives or imaging complete drives over the network.

Has all the tools i have ever needed and saved me many hours of my life.

also knoppix based

but there are many others with GUIs and stuff you are spoiled for choice in this area.

jon1981

ok, i downloaded knoppix and booted up the laptop with it. Now it loads up all fine, but i cant see the drives were my files are ? is it /media/hda1? any advice? should be in root?

Cake Fiend

Most likely /mnt/hda1, but I'm not sure whether Knoppix will mount your drives by default. Try 'mount /dev/hda1' and see if that populates the dir.

If not, su and do 'fdisk -l' to show your drives. Modern laptops using SATA might have the drive under /dev/sda1. If so, do 'mount -t ntfs (or vfat if it's FAT32) /dev/sda1 (or whatever) /media/hda1 (or create your own dir)'.

jon1981

hi,

I can see /mnt/hda1 and /media/hda1
but there are no files in there.

i did an fdisk -l
and i got the following

Device boot Start End Blocks ID System
/dev/hda1 * 1 3825 30724281 c W95 FAT32 (LBA)
I assume this means i have a FAT32 file system, why is it i can only see 30GB when i have a 60GB hardrive, all my data is missing because i can only seee 30GB

any ideas what i should try now?

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 3471 22 3449 1% /
/ramdisk 411808 17296 394512 5% /ramdisk
/UNIONFS 411808 17296 394512 5% /UNIONFS
/dev/hdc 714448 714448 0 100% /cdrom
/dev/cloop 1996646 1996646 0 100% /KNOPPIX
**** this is only showing as 30 GB but i have 60 GB****
/dev/hda1 30709264 32 30709232 1% /media/hda1

/dev/hdc 714448 714448 0 100% /media/hdc

jon1981

bump

niallb

You say it's showing as 30G and you have 60G.
Are you absolutely sure you had a single partition of 60G under windows?
Was there only one C: drive filling the entire disk?

You left out a VERY important line of the fdisk output:
the description of the drive itself.
It's the three lines that start,
Disk /dev/hda: 60 GB,

Looks possible that your partition table is banjaxed.
This could be what was causing your reboot loop under windows.
Unless you've done something reckless, linux won't have touched your data at all.

If this data is important to you, take it to someone who's at least done
this kind of thing before and is comfortable with partition tables.
All the tools you need to fix this are on the Knoppix CD, but they've got to
be used in the right order or you'll only make things worse.

There's a little partition guessing tool called 'gpart'.
DON'T have it write a new partition table, but it might be worth letting it
have a look at the drive. It'll tell you if it thinks it sees a larger partition.

If you have a large drive nearby, it's worth taking an 'image' of your drive
before doing anything with it. That way you can go back to exactly where you were.
Ideally you should work on the image then, and not the drive.
The less the drive is interfered with, the more data is there to get back.

Professional data recovery services can work wonders even with a drive that seems dead. Rates are based on drive size, and a crowd in Clonee I've dealt with do a no recovery no fee deal. You'd probably be looking at about 700 euro for a drive that size, but if the drive is not actually damaged, you just
need a bit of help with it.

Do you know anyone nearby with linux experience?
It's the most useful experience available for recovering windows files ;-)

The knoppix CD would also allow you have somebody remotely examine your drive if you have a net connection, so that's an option if you can't find someone nearby.

Best of luck with it, but tread lightly on your data!
NiallB

jon1981

Hi,

Yes i only ever had a drive C:
You see I was running my laptop from the power as I had a problem with the battery, and then the power went in the house. When i started it back up it went into a boot loop. I put in the recovery cd and i notice that this was starting to do a clean install, so i panic and ripped the cd out and restarted.
So there is a good chance the file system is screwed up.

I should have went down the Knoppix route before messing with the recovery cd. Thanks for the advice Niall, the data is important for sentimental reasons as well as other things. I'll ask around, im not well up on file systems and recovery.

Im just surprised how it selected to mount only 30gb?

niallb

It didn't select to mount only 30gb.
That's not possible if there was a 60g partition.
Windows recovery CD may have split the partition before doing the install,
though I can't think why. Something did anyway.

Where are you based? I suspect that if you got the machine to someone like myself or nutjob we'd get a fair bit of it back. It depends on how much of an install the windows cd did. That's a bit of a show stopper to getting the whole thing back as it was.
I'll drop in remotely to have a look if you like, on best effort
but if it breaks you get to keep both parts terms.
Seeing as it's so broken anyway, you've little to lose.
If you have another disk with 60G free on it,
you could image the drive and 'freeze' it until technology improves
and you can retrieve your files :-)

If you know someone well who could help who isn't nearby,
they could do the same. You'll need to enable 'ssh' service
on the menu, and find out your IP address.

Something worth knowing though. Image files in the jpg format are one of
the easiest file types to salvage from a mixed up disk. Music less so.
Are the music files on the disk recordings you've made yourself, or
just rips from CDs?

NiallB