HD Data Recovery

category: offtopic [glöplog]
I know this is not specific to Demoscene at all.

Anyone know about any HD-data-recovery program? I found HDAT2, and am soon to test it. I just wonder if anyone here had a problem like this and have managed to recover files from crashed disks? And if someone have any suggestions i am open to recieve them. Its a Western Digital Disk (WD1600BEVT) (Scorpio Blue) which have(or had) demos, old demosources and lots of other scene stuff.
added on the 2012-02-03 07:08:45 by rudi rudi
I used the very old Norton Disk Doctor to recover a few HDs back in the day... I don't think the tool does the same nowadays though, looking at Norton Utilities now they seem to be some kind of "defrag + s.m.a.r.t. checking" tools, rather than block level tools for repairing.

Is this logical or physical damage? If it's logical, it should be easy (although time consuming) to repair... if it's physical (heads not starting, etc.), then, unless it's just bad sectors (which to some extent would be like logical damage), you would probably need special hardware and a cleanroom if you need to open up the disk itself... repairing at home is not advisable... if it's very important for you, you can just pay for it to a dedicated company... else just live with it and move on.
added on the 2012-02-03 07:57:35 by Jcl Jcl
Where's the like button?
added on the 2012-02-03 08:43:56 by Danguafer Danguafer
Jcl: ok. I am not sure if its physical. it may be since the laptop was thrown into the ground. But iirc some time ago i tried boot up and got bluescreen, since the Windows OS isnt the same on that HD as in this new one im using now.
I hear it starts up and it doesnt sound wrong. But it takes a time and the LEDS on the HD-USB-interface device turns orange and not green. Either it is the drivers for the usb-interface to the disk (for the OS) or it is some damage to the disk(?) that makes it not possible to read from it, or maybe some bad sectors?. I see HDAT2 can repair bad-sectors. I havent tried that app yet. Just wanted some feedback or advice here first, to see if there is something else that I should consider. Ive also sent a mail to the HDAT2-author(s).
added on the 2012-02-03 08:53:31 by rudi rudi
I made good experiences with "Easy Recovery Professional" from OnTrack.

It lets you define some stuff and you can get back all your music and pictures and forget about the rest, if you want...
the only thing that sucked are movies... they are like 2000 pictures instead of a movie...

But I got back all my stuff from work that I needed.
added on the 2012-02-03 09:22:43 by FeN FeN
"Tough guys don't take backup... But they cry a lot."

But more seriously speaking... I was using PC Inspector File Recovery ages ago and it worked rather well back then... On more modern operating systems than WinXP it didn't seem to work too well, though.
For deleted (but not overwritten) data you can always use GetDataBack. It analyzes HDs that had FAT or NTFS partitions on them and presents the files that are still there in an explorer-like UI, which allows you to copy them over to a safe place.
added on the 2012-02-03 09:23:56 by xTr1m xTr1m
http://www.cgsecurity.org/wiki/TestDisk made good experiences with that tool. from recovering single files to recovering whole partitions.
added on the 2012-02-03 09:35:51 by gentleman gentleman
thanks for all the excelent advices!
added on the 2012-02-03 10:28:58 by rudi rudi
+1 for testdisk
Also spinrite (yeah I know Steve Gibson is a dick!) has helped me before - but it's more of a stop-gap.
added on the 2012-02-03 10:32:55 by ringofyre ringofyre
I find UBCD quite useful for all kinds of hardware stuff. Has TestDisk included also... Good luck with the recovery!
added on the 2012-02-03 11:21:41 by raer raer
My method of hdd recovery is as follows:
have another hdd ready for cloning (same or bigger size)
attach both drives to your computer (preferably internal S-ATA or IDE-Controller, as USB is slower and the drive may die in the meantime)
boot PartedMagic (a live Linux Distro, on CD or USB ThumbDrive)
clone the defective hdd to the new one with ddrescue (a commandline tool, which tries every sector, skips the defective to rescue the good data first, then retries the defective sectors over and over)
do some md5-magic to pinpoint the defective files (as ddrescue copies independet from filesystem)
et voila: most of the time, I have a working copy again.
PartedMagic also includes other tools such as Testdisk/Photorec, this is quite useful if your filesystem went corrupt
Also the aforementionend Ontrack Easy Recovery Professional is quite good for such tasks as "accidentaly formatted my harddisk" or "my NTFS MFT is broken" et al.
added on the 2012-02-03 11:37:18 by merkur merkur
If you your Linux-fu is strong, for HD recovery, SliTaz on a usbstick saved the days : it can read FAT and NTFS partition. Very handy for the few times I fumbled with boot stuffs and accidentally the whole boot sequence ^^
I once tried to recover a 1TB Raid and i can say, if you'e ever going to do this, you need a REALLY good program that can see through the controller layer. The only program that was any good ever under windows to recover files if you know the filesystem, it's the Data recovery from Diskinternals. But for 100€ its kinda pricey. :(

(Who also made all kind of filesystem migration tools, i guess they know what they are doing.)
added on the 2012-02-03 12:08:07 by Exin Exin
gloom: maybe it might do some magic ;)

okay. i'll try all the things listed here. but first i just have to say that i tried the HDAT2 utility without any luck. But I just got booted up the disk via usb-interface as i said earlier. it's the only way i can because its the only interface i have. it came into the windows progress bar loading screen and just turned into a black screen. so, it seems like the files are intact, but its strange i am not able to access the files directly in Windows Vista. hence accessing the drive letter. It does find the drive letter(s), but it does not load the files. If i boot up into a DOS-system it does not find the drive letter, but the HDAT2 utility finds the HD.

xtr1m: GetDataBack does find the drive but the application hangs up.
added on the 2012-02-03 14:08:03 by rudi rudi
downing TestDisk atm..
added on the 2012-02-03 14:10:59 by rudi rudi
I've had success using this: Recuva
iirc, it had deep scan which should be able to "dig deeper" in to the HDD and even recover stuff from a formatted disk.

If the disk is too unstable for any kind of recover operations like that, then I would go with merkur's suggestion of using ddrescue.

Always use the disk as a secondary disk, I wouldn't suggest writing stuff on to it at all, also try not to boot from it :)

One good way is to use an USB to SATA/PATA interface to access it (pretty much any external HDD case will do, as long as the connector is right) that way you can quickly reboot the HDD if it jams and refuses to work.

Good luck, working with borked drives can be really frustrating.
added on the 2012-02-03 14:40:50 by oasiz oasiz
A laptop thrown into the ground... well, if it was working when it fell, it could be just bad sectors (scratched ones)... if it was not working when it fell, then probably some motor went bad or the needle was misaligned (since the drive is starting to spin correctly, for what you say)... if this is the case, unless you have a lot of expertise on hardware itself, I'd say: tough luck.

The most sane thing to try first is, as someone stated above, cloning the disk with some tool (like ddrescue) which just skips bad sectors. If that works, then live with what you get and dump the original HDD... if that doesn't work, there's a high change that the data is still there on the magnetic disks, but some of the hardware around them (motor, needle, controller, etc.) is broken... that's usually solved by expert-recovery companies by opening up the HDD, extracting the magnetic disks and enclosing them in a different hardware: that requires, both expertise, and a cleanroom... if the opened magnetic disks collect dust particles, with the extremely high data density we have these days, unless you are very very lucky, you can say good bye to your data.

And yes, as oasiz says, working with broken hard disks can be frustating... if it's worth of it, get a few quotes on data recovery... for "normal" hard disks, you'd be surprised how cheap it can get.
added on the 2012-02-03 14:57:39 by Jcl Jcl
Jcl: yeh. don't you think the motors works when i am able to boot up and see the Windows Vista progressbar before it turns into a black screen?

Strange thing is now. I find the disk with TestDisk, but it finds no partition available. it is able to analyze it.
Is it a _bad_ thing that it Reads error at almost every cylinder??
I mean i dunno is wrong..

Fri Feb 3 14:33:21 2012
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
OS: Windows 7 (7601) SP1
Compiler: GCC 4.3, Cygwin 1007.7
Compilation date: 2011-11-15T08:36:54
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=296453406720
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=19148046336
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4260716544
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=53688139776
file_pread(4,1,buffer,625153409(38913/254/63)) lseek err Invalid argument
file_pread(5,1,buffer,312592769(19457/254/63)) lseek err Invalid argument
Hard disk list
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Hitachi HTS543232A7A384, S/N:E20342432MKKTJ, FW:ES2O
Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - WDC WD16 00BEVT-22ZCT0, FW:1A11

Partition table type (auto): Intel
Disk /dev/sdb - 160 GB / 149 GiB - WDC WD16 00BEVT-22ZCT0
Partition table type: Intel

Analyse Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63
Current partition structure:

Partition: Read error
Ask the user for vista mode
file_pread(5,1,buffer,312576705(19457/0/1)) read err: Invalid argument
Allow partial last cylinder : Yes
search_vista_part: 1

Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63
file_pread(5,8,buffer,32(0/0/33)) read err: Invalid argument
file_pread(5,8,buffer,40(0/0/41)) read err: Invalid argument
file_pread(5,3,buffer,48(0/0/49)) read err: Invalid argument
file_pread(5,3,buffer,95(0/1/33)) read err: Invalid argument
file_pread(5,8,buffer,111(0/1/49)) read err: Invalid argument
file_pread(5,11,buffer,158(0/2/33)) read err: Invalid argument
file_pread(5,2,buffer,2080(0/33/2)) read err: Invalid argument
file_pread(5,2,buffer,51(0/0/52)) read err: Invalid argument
file_pread(5,2,buffer,98(0/1/36)) read err: Invalid argument
file_pread(5,2,buffer,119(0/1/57)) read err: Invalid argument
file_pread(5,2,buffer,169(0/2/44)) read err: Invalid argument
file_pread(5,2,buffer,2082(0/33/4)) read err: Invalid argument
file_pread(5,8,buffer,63(0/1/1)) read err: Invalid argument
file_pread(5,8,buffer,71(0/1/9)) read err: Invalid argument

and it goes on there forever until 19450 (too big of a file for me to paste here). I am not sure what this means? this Invalid argument thing, if it is really errors on the disc?
still alot of good advices.
But jcl: no, my plan is not to send this to a company to fix. if it is broken then i don't mind. I just live with it.
added on the 2012-02-03 16:38:03 by rudi rudi
I'll download ddrescue and pmagic now..
added on the 2012-02-03 16:41:46 by rudi rudi
hmm. I somehow managed to run GetDataBack after analyzing it with TestDisk.
Now the GetDataBack shows: the drives G: and I: (which is the drives (because it had two partitions or drive letters)).
Its a 160GB drive.

Drive G doesnt hows Serial number: 000000000
Size: 104 and something Million sectors (50 GB)
Free: 0 sectors (0,0B)
File system: <none>
File name length: 0
Geometry: C*H*S = (0*0*0) = 104 mill sectors
Secs/cluster: 0

Drive I doesnt hows Serial number: 000000000
Size: 203 and something Million sectors (97GB)
Free: 0 sectors (0,0B)
File system: <none>
File name length: 0
Geometry: C*H*S = (0*0*0) = 203 mill sectors
Secs/cluster: 0
added on the 2012-02-03 16:54:40 by rudi rudi
BB Image
added on the 2012-02-03 16:59:38 by rudi rudi
hmm. could it be that its not NTFS-disk? that would be strange because i though FAT-systems was more common nowadays. but GetDataBack complained that it might be that that was the reason why its bad address mark
added on the 2012-02-03 17:01:53 by rudi rudi
common = uncommon
added on the 2012-02-03 17:02:22 by rudi rudi