Page 1 of 1

Recovering data from a raw sector-by-sector image

Posted: Thu Apr 19, 2012 8:31 am
by MGrosser
My HP laptop recently crashed. I have run a couple diagnostics to determine what the problem was, and both the hard drive and one of the memory sticks failed the built in HP diagnostic. I also ran one of the Samsung diagnostics on the UBCD, and it detected a bad sector on the HD. My external backup HD is smaller than the HD in my laptop, so I made a raw sector-by-sector copy of my laptop's HD. My external HD could fit about half of the laptop HD on it, but that should be fine because I didn't nearly have a full HD on my laptop.

Now that I have a sector-by-sector raw copy of part of my laptop HD, how can I recover data from it? Has anyone done this? I am currently searching around online for tools. I did not see anything in the other tutorials posts on this forum.

Thanks for any assistance!

Re: Recovering data from a raw sector-by-sector image

Posted: Fri Apr 20, 2012 3:19 am
by ady
A RAW sector-by-sector copy means that each and every sector of your HDD needs to be copied. Being a RAW sector-by-sector procedure (whether direct copy into another drive or copying to an image file) means that the content of each sector has no meaning in terms of being a certain file, or being "empty", or being part of a certain partition or filesystem. To put it "in binary terms", where there is a "zero", the copy gets a "zero"; and where there is a "one" in the original, the copy will get a "one" (except if the original sector can't be correctly read, for whichever reason). The copy procedure (and the program you used, which you didn't mention) doesn't care of the meaning of those zeroes and ones.

OTOH, instead of using a RAW sector-by-sector copy, you could use some other "more intelligent" (in a certain sense) program that indeed understands about the specific filesystem you might be using, and where the partitions start and finish (and every other meaning of those zeroes and ones). Then the resulting destination drive is not an exact RAW sector-by-sector copy of the source HDD, but the files are indeed the same (or at least the copy / backup program will try to make an exact copy of the files).

UBCD and PartedMagic (among others) have several of these type of programs.

Alternatively, you could try accessing the problematic HDD by means of PartedMagic (or by means of the copy program you choose to perform the task), and then select the specific files / folders you are interested in and copy those to your external drive.

Part of the programs may try to copy a file and if / when the reading would fail, they move on. Some other programs are more about rescuing the data (maybe sector-by-sector, maybe understanding the filesystem in the source HDD you want to recover, depending on the program).

The method to be used (from the 3 I just mentioned) depends on what you would be trying to achieve. Apparently, the first method (RAW sector-by-sector) is not so adequate for the hardware available to you ATM. So either you need to select some other method / program, or get some adequate HDD (equal or bigger than the original).


Re: Recovering data from a raw sector-by-sector image

Posted: Wed May 02, 2012 5:52 pm
by MGrosser
Thanks for the input. I couldn't figure out how to make a smarter copy of my laptop's HDD because it is larger than my external HDD. I kept getting messages that the external HDD was too small. I was able to recover the data I needed using the free version of EaseUS's data recovery program from softpedia. It restricts you to 1 gig of recovered data, and I fortunately only needed about 700 mb.

I was also able to get my compy back up and running with the HP recovery disks I made. I kind of forgot about them for a couple days because when I had previously tried them, nothing happened. This was due to my not having figured out how to boot from the CD drive. Even though the recovery partition wasn't working, the recovery disks did. My HDD passed the diagnostic tests after recovery (yay!) though one of the memory sticks did not. Also it was overheating a lot (had to use an ice pack to finish the HD diagnostic). I took it to a pc shop and they could not figure out why it was overheating other than that HP dv6 laptops seem to have this problem a lot. They put some new thermal paste on the CPU though, and that seems to have helped. I am also going to try to blowing the air vents out with compressed air because the HP forums say that helps.

Random weirdness - the pc shop tested each memory stick separately in each of the two memory slots, and both sticks tested fine in each slot. However, when they are tested together, one of them fails. Any idea why that might be? The comp is running okay and task manager shows the full amount of physical memory, so I don't see any actual problems. Just wondering if someone else has seen that before.