Recovering a failed XP drive with Knoppix

MOH

Hard drive in my PC failed yesterday, and of course the last backup of my photos is close to a year old. I helpfully haven't a clue where my XP systems disks are. After a lot of messing around and frantic googling, I've got a plan of sorts, but would appreciate input from anyone who's been through something similar before.

Background: The machine was running XP, SP3. The drive is a 160 GB SATA drive,which is doing a fair bit of clicking now. Trying to boot into Windows just keeps giving BOOT.INI not found, and just resets, and goes around in a loop. Given the current lack of systems disks, and XP based recovery doesn't look an option.

I've burned a Knoppix install onto a CD and booted from that. I can't mount the failed hard drive in the file manager. I've run TestDisk on it but, unless I'm doing something wrong, it's not finding any files on the failed drive. I tried Photorec and that did start finding files, but was showing an estimated completion time of 2900 hours! I also was getting alarmed at the increased amount of clicking, so I killed it.

Right now, I'm thinking of buying a new drive, running dd_rescue to make one pass over the failed one and clone what I can off it, and then run Photorec again on the new clone and see if that works.

The only problem being that since I'd never heard of Knoppinx, Photorec or dd_rescue before today I'm not sure if there's an alternative apporach. And my linux is a bit rusty.

I do have a second drive in the PC, and I've also got a backup Stora box with a couple of RAID drives in it. I'm a bit worried though about whether I can write to them from Knoppix without corrupting them - since they're what's holding my backup data I don't want to make things worse. Can I safely write to them from Knoppix?

Secondly, if I'm buying a drive to try to clone the failed one to, does it need to be identical? Or will it work just as well if it's a bigger SATA drive?

Finally, there does seem to be an intact XP recovery partition on the failed drive, which I might be able to access. But from what I've been reading, it looks like I've better data recovery options from the linux side, so I might be best leaving that alone.

Any advice appreciated! Thanks.

Defiler Of The Coffin

Clicking sounds from the HDD is not good. You might only make things worse if you continuously try to access the data. I'd consider a data recovery specialist if I was you. There are single-man operations around that don't cost an arm and a leg.

Fysh

DD_rescue may help you, but if you're getting regular clicking you're screwed to a certain extent anyway.

My initial instinct would be to just let Photorec run though and do its thing, on the basis that an attempted clone with dd (ie not dd_rescue) that fails will do nothing for you except put the drive that bit closer to failure point.

The only thing you gain from using dd_rescue first is the assurance that the drive won't fall over and die half-way through PhotoRec's attempted recovery, but since PhotoRec writes recovered files to the specified rescue directory in realtime this doesn't help you. The image created by dd_rescue won't necessarily be of any more use than the original drive in terms of getting PhotoRec to recover files from it.

I wouldn't particularly want to add "writing to RAID array from Knoppix Live disc" to the mix unless it's your only possible location for storing rescued files. At least if you buy a new drive as the rescue destination you know you won't lose anything if things go south.

As for cloning - normally as long as you have enough space for the partition you're trying to clone, you should be ok. Larger than the original drive shouldn't be a problem.

BostonB

The less you use that drive the better. Very soon it will stop working completely.

I have seen the freezer trick work once on a drive. I didn't believe it till I saw it.

http://www.lancelhoff.com/freeze-a-clicking-hard-drive-to-recover-data/

RUCKING FETARD

http://safecopy.sourceforge.net/

MOH

Defiler Of The Coffin wrote: »

Clicking sounds from the HDD is not good. You might only make things worse if you continuously try to access the data. I'd consider a data recovery specialist if I was you. There are single-man operations around that don't cost an arm and a leg.

Tbh, I'm not sure exactly what's on it. I can't think offhand of anything that would be worth spending a lot of money on. I've since discovered that a lot of the pics which had been taken on my phone were being auto-synced to drop box anyway.

Fysh wrote: »

DD_rescue may help you, but if you're getting regular clicking you're screwed to a certain extent anyway.

My initial instinct would be to just let Photorec run though and do its thing, on the basis that an attempted clone with dd (ie not dd_rescue) that fails will do nothing for you except put the drive that bit closer to failure point.

The only thing you gain from using dd_rescue first is the assurance that the drive won't fall over and die half-way through PhotoRec's attempted recovery, but since PhotoRec writes recovered files to the specified rescue directory in realtime this doesn't help you. The image created by dd_rescue won't necessarily be of any more use than the original drive in terms of getting PhotoRec to recover files from it.

As for cloning - normally as long as you have enough space for the partition you're trying to clone, you should be ok. Larger than the original drive shouldn't be a problem.

My only problem with letting photorec run through was the 2000+ hours is was estimating! (Although given the lack of a spare drive, it was writing to the Knoppix RAM pseudo-drive, so not sure it that was affecting the speed.) Thought dd_rescue might clone it quicker, plus at least you can specify start/end sectors, so I could break it down into chunks. And not sure what photorec does if it hits serious drive errors.

Have a new 1TB drive, soon as I find a SATA cable I'll give photorec a bash again. At least it was finding stuff.

BostonB wrote: »

The less you use that drive the better. Very soon it will stop working completely.

I have seen the freezer trick work once on a drive. I didn't believe it till I saw it.

http://www.lancelhoff.com/freeze-a-clicking-hard-drive-to-recover-data/

Yeah, I'd seen the freezing thing. Was thinking after I photorec/clone it, might freeze it anyway just to see if it works.

Fysh

MOH wrote: »

My only problem with letting photorec run through was the 2000+ hours is was estimating! (Although given the lack of a spare drive, it was writing to the Knoppix RAM pseudo-drive, so not sure it that was affecting the speed.) Thought dd_rescue might clone it quicker, plus at least you can specify start/end sectors, so I could break it down into chunks. And not sure what photorec does if it hits serious drive errors.

Have a new 1TB drive, soon as I find a SATA cable I'll give photorec a bash again. At least it was finding stuff.

One thing to bear in mind is that it tries to estimate how long the rest of the job will take based on recent read-times, so while it's reading problem sectors it'll estimate a truly silly amount of time to finish the job. You might need to leave it running for a few hours (I think from memory the main bottleneck is actually your SATA interface, though memory bandwidth and processor clockspeed will play a part) to finish, but I'd be surprised if it took more than eg 12 hours start to finish.

BostonB

Seems to me a drive that's clicking and failing to boot is on its last mechanical legs.

The usual logic is to get off it what you can as fast as you can. On the drive I've seen the fridge trick used on the drive only worked for 20~30 mins. Get the absolute essentials off it after that its toast.

I would think if you subject it to 12+ hrs of continuous activity that can only hasten its demise where it will stop completely. I assume with photorec you can't tell it what to recover first?

Fysh

BostonB wrote: »

Seems to me a drive that's clicking and failing to boot is on its last mechanical legs.

The usual logic is to get off it what you can as fast as you can. On the drive I've seen the fridge trick used on the drive only worked for 20~30 mins. Get the absolute essentials off it after that its toast.

I would think if you subject it to 12+ hrs of continuous activity that can only hasten its demise where it will stop completely. I assume with photorec you can't tell it what to recover first?

Nope, it basically does an initial analysis to identify the filesystem and scans through either the whole thing or just free space (you specify on starting the software), and then it just iterates through the filesystem recovering any files it can. By design it doesn't require the filesystem to be intact to work but as a result this means you can't use the filesystem as a map for it to follow.

I agree that a clicking drive is on its way to dying, but given the OP's circumstances I don't know of a better-suited alternative tool.

MOH

Thanks again for the help guys.

Had a look at with earlier with Testdisk and it looks like the MFT is gone, so I guess the only way I'll be getting anything off it is whatever potluck I get from a full drive scan with Photorec.

I've set up the new drive with an NTFS partition to clone to if necessary, a FAT32 partition to write any rescued data to (on the grounds that apparently that's better common ground for Windows/Linux than NTFS?), and a couple of ext3 partitions to try out new OSs. Does that make sense?

At this stage it's nearly becoming an exercise in curiosity, I'm not hopeful of getting much usable stuff, but you never know.