Data Recovery off a "Damaged?" HDD

Try looking for help here if you are having problems with the Ultimate Boot CD.

Moderators: Icecube, StopSpazzing

Locked
Message
Author
Nightmare
Posts: 2
Joined: Tue Feb 12, 2008 3:12 pm

Data Recovery off a "Damaged?" HDD

#1 Post by Nightmare » Tue Feb 12, 2008 3:17 pm

I should have known better, I should have backed up my HDD. But I've been building systems since 95 and I've never had a HDD failure. I've had viruses, corrupted MBRs, lost/missing files, etc.

Some quick background on the PC and then I'll ask my question:

I built this system about 3-4 years back. I played WOW on this machine every couple days for about 1.5 years. The last couple weeks I played the PC would shut down without warning or notice. I thought it might be a heat problem with the Video Card or possibly the Power Supply. I swapped out several components, but the problem was intermittent and I never came to a final answer. I quit WOW and the PC sat unused for about 6 months. The HDD is a 120 GB Western Digital IDE.

Last week I did some data recovery for my sister in law. The system would not boot (common problem after the above described shut down). I swap out the Power Supply for a brand new Ultra 500 Watt. The system boots and runs fine. I installed her “bad” HDD into my system and copied the data she wanted to a Jump Drive. I removed her HDD and on the very next boot I get BSOD. I shut down the PC and check all the connections. Then the PC would not even boot (no power, no post, just ½ second of spin on the Power Supply Fan). Ok now I assume it is a dead Mobo. I purchase a new Mobo and rebuild the system.

Because I have the new Mobo I need to reinstall windows. At this point I find out that the Power Supply (the brand new one) is toast. I have no clue how/why this thing died after about 2 hours of use. I pull an old Power Supply from the garage and I install XP on a 200 GB Drive that has never been used. I get XP installed and updated (SP2). I install Norton and run all the updates (I think there is a slight chance her HDD could have infected my HDD with a virus or worm). Everything is running fine. I even run a full system scan on Norton. I connect the Western Digital HDD and boot to Windows. As soon as start to scan the drive with Norton I get a BSOD.

I pull the WD drive and run Memtest for about 7 hours. Everything checks out. Because this is a new Mobo I have everything at “normal” clock speeds.

Now I assume that the HDD is damaged, or at least the data on the HDD. Here is where I stand:

Windows XP actually booted and recognized the HDD when I had it connected as a “Master” on IDE2. I actually copied 1 file from the old drive to the new drive. After that the system became unstable and could not read the drive.

Ultimate Boot CD loaded the WD dive utilities and I checked the drive. I don’t understand the result, but I took a photo of the screen. It looks like this:

1 Raw Read Error Rate - Value 1 - Thresh 51 - Worst 1 *

I started to run a Salvation HDD Scan and Repair on the HDD from UBCD, but it found 200 errors in the first 2% of the drive. The scan was going to take 8-10 hours to complete. I wasn’t sure if Salvation was going to destroy the data during the recovery, so I stopped the scan.

I downloaded a copy of HDD Regenerator. I have not used this CD yet.

I downloaded Knoppix and ran that from the CD drive. Knoppix can see and mount the Western Digital HDD. I can even access some of the folders. As soon as I get to my personal folder in “My Documents” the drive become locked up. I’ve tried to access the data like that several times.

I can feel the drive spinning and given the access in Knoppix I know that the drive operates.

I tried to follow the directions in another post, but I don’t know the Command Prompt to copy files or navigate the drives.

Link viewtopic.php?p=753

“Make SURE you are booting
Knoppix with the following bootcodes (cheatcodes):
nosound noapic noscsi nodma noswap nofstab

the last two are very important since otherwise, Knoppix may try
to mount and write to the drive; potentially catistrophic when
trying to recover data.

The Main HDD is called “HDA1”
The Damaged HDD is called “HDB1”

If I can copy all the files in My Documents then that should be everything I need. The windows path should be “c:\Documents and Settings\Night”

If I boot Knoppix like this:

Knoppix 2 nosound noapic noscsi nodma noswap nofstab

What command do I use to copy the folder?

Is there something else I should try before the HDD Regenerator?

Based on the information I provided can anyone tell what is wrong with the drive? I don't think it is a virus or worm any more. Could the Power Supply failure damage the drive? I always thought that the drive would spin down and "park" under its own momentum.

I saw another post about RIP and SystemRescue CD. I'm note sure which to try first. Just in case I only get 1 shot...
---

I tried to Clone the HDD onto a 3rd 200 GB Seagate drive.
Clone does not appear to work.

I setup the "Bad" drive as the Master and the "New" drive as the Slave.

# dd if=/dev/hda of=/dev/hdb

The Error codes ran by before I could write it down. It has lots of I/O Errors

I tried to run the command again and I get:

end_request: I/O error, dev hda, sector 0
printk: 2062 messages suppressed.
Buffer I/O error on device hda, logical block 0
end_request: I/O error, dev hda, sector 8
Buffer I/O error on device hda, logical block 1
end_request: I/O error, dev hda, sector 16
Buffer I/O error on device hda, logical block 2
end_request: I/O error, dev hda, sector 24
Buffer I/O error on device hda, logical block 3
end_request: I/O error, dev hda, sector 0
Buffer I/O error on device hda, logical block 0
dd: reading '/dev/hda': Input/output error


It says it copied 28 MB the first time

Thanks
Nightmare

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

#2 Post by Icecube » Sat Feb 16, 2008 3:02 pm

You can try Puppy linux (small linux distro, graphical user interface)http://www.puppylinux.org/.
Burn it to a CD or include it in a customized version of ubcd (see tutorials, howtos).

Boot from it and use puppy pfix=ram (else it tries to search your whole pc after a previous session, this command is just for speeding up the boot process).
Select your keyboard and resolution (probably 1024x768)
When it is completely booted, click one time on "drives" (USB-stick). If you have a lot of partitions, Menu ==> File System ==> MUT.

Mount your two hard drives (click on the icons). ROX (=filemanager) will open.
Make a new directory (right click ==> new ==>directory) on your good hard drive.
Select the file and folders that you want to copy (hold down ctrl else puppy tries to open them) and drag and drop them to your good hard disk. If you are lucky it will copy the files. If you can't copy a certain file, try the other files. Else you can try
dd_rescue http://www.garloff.de/kurt/linux/ddrescue/
ddrescue http://www.gnu.org/software/ddrescue/ddrescue.html

it is not the same program. You need a linux distribution (knoppix, puppy) and probably some reading.

If you get your files back, you can format the bad drive, check it for surface errors (diagnostic tools, I assume). Boot puppy linux: Menu ==> System ==> Gparted Partion manager.
See that you select the good harddisk (the "broken" one), remove all partitions and make two new partitions:
1. make a new partition for WINDOWS: choose "primary" (Windows can only be installed in a primary partition), you can choose unformatted as formatting choise (Windows will format it anyway), choose a size for the partion (will contain Windows and programs)
2. make a second partition for your documents: choose primary or extended
(if you choose extended, you have to make a logical partition in it) Format it as ntfs or fat32.

You can have maximum 4 primary and extended partitions together. But in a extended partition you can make a lot of logical partitons.

Copy your documents to the crashed hd ("Doucuments of Night" or copy them just to the root of the partition.

Install windows again and save your documents in D:\ or "D:\Documents of Night". If you right click on the "My Documents" folder, you can choose another destination for your documents.
Change "c:\Documents and Settings\Night" to "D:\Documents of Night".

The next time your windows crashes, you can just reinstall it without losing your documents. It has saved my ass several times.

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

#3 Post by Icecube » Sat Feb 16, 2008 3:21 pm

If the previous post didn't help, use photorec.
Photorec ignores the filesystem, this way it works even if the filesystem is severely damaged.
http://www.cgsecurity.org/wiki/TestDisk_Download
There is a windows version also.

It is also included in UBCD but not visible.
Boot UBCD ==> Filesystem tools ==> Partition Tools ==> Testdisk

Run it and quit the program. On the command prompt type "photorec".
look at the site, to know how to use it.
http://www.cgsecurity.org/wiki/PhotoRec

It can rescue a lot of files, but they won't have there original filename.
e.g. "Metallica - Unforgiven.mp3" becomes someting like this ABCDE123.mp3

Nightmare
Posts: 2
Joined: Tue Feb 12, 2008 3:12 pm

#4 Post by Nightmare » Thu Feb 21, 2008 10:00 pm

Thanks for the reply. I tried to use HDD Regenerator and I gave up after 48 hours. The program found and repaired 18,929 bad Sectors in the first 417,394 sectors scanned. It was about 1% of the way through the HDD. I ran HDD Regenerator again and it started to repair the same sectors again. I think the HDD may be totally fried.

On the “UP” side I found a backup CD with most of the files I was concerned about. I have the photos from the last 6 trips we took.

I might try your suggestion before I throw the HDD into the trash. Actually I might just cut that sucker open to see the inside 

The Piney
Posts: 370
Joined: Mon Apr 30, 2007 11:06 am
Location: FL

#5 Post by The Piney » Fri Feb 22, 2008 1:48 am

If you have never opened a drive before it is nice to see what is holding your data so go for it.

As far as just throwing the HDD into the trash - you should dispose of properly such as taking it to a recycling center. If your area recycles you can put it in a recycling container also.

Locked