hard drive recovery

Discussion in 'NZ Computing' started by Andrew Lambert, Nov 21, 2006.

  1. Im looking for a linux tool for hard drive recovery

    i currently have a drive plugged into the machine via usb, I can mount
    the drive and view some directorys.. but the rest are borked
    Are there any tools available that can scan the drive and recover any data?

    Cheers
    Andrew Lambert, Nov 21, 2006
    #1
    1. Advertising

  2. Andrew Lambert wrote:
    > Im looking for a linux tool for hard drive recovery
    >
    > i currently have a drive plugged into the machine via usb, I can mount
    > the drive and view some directorys.. but the rest are borked
    > Are there any tools available that can scan the drive and recover any data?
    >
    > Cheers

    the drive is ntfs btw

    Windows does not see anything, mac and linux see all folders, but few files
    Andrew Lambert, Nov 21, 2006
    #2
    1. Advertising

  3. Andrew Lambert

    Roger_Nickel Guest

    On Wed, 22 Nov 2006 09:42:22 +1300, Andrew Lambert wrote:

    > Andrew Lambert wrote:
    >> Im looking for a linux tool for hard drive recovery
    >>
    >> i currently have a drive plugged into the machine via usb, I can mount
    >> the drive and view some directorys.. but the rest are borked
    >> Are there any tools available that can scan the drive and recover any data?
    >>
    >> Cheers

    > the drive is ntfs btw
    >
    > Windows does not see anything, mac and linux see all folders, but few files


    NTFS is proprietary to Microsoft and uses a not fully documented database
    file as its directory. Linux FAQ's and Howto's strongly advise against
    against writing to NTFS from Linux and this can usually only be done by
    changing default permissions. Linux remedies are probably limited to using
    dd to make a sector-by-sector image of the disk for later analysis.
    Roger_Nickel, Nov 21, 2006
    #3
  4. Andrew Lambert

    Roger_Nickel Guest

    On Wed, 22 Nov 2006 10:20:14 +1300, Roger_Nickel wrote:

    >>> Cheers

    >> the drive is ntfs btw
    >>
    >> Windows does not see anything, mac and linux see all folders, but few files

    >
    > NTFS is proprietary to Microsoft and uses a not fully documented database
    > file as its directory. Linux FAQ's and Howto's strongly advise against
    > against writing to NTFS from Linux and this can usually only be done by
    > changing default permissions. Linux remedies are probably limited to using
    > dd to make a sector-by-sector image of the disk for later analysis.


    I found this
    http://www.ntfs.com/data-integrity.htm
    Roger_Nickel, Nov 21, 2006
    #4
  5. Andrew Lambert

    Dave Doe Guest

    In article <>, f says...
    > Andrew Lambert wrote:
    > > Im looking for a linux tool for hard drive recovery
    > >
    > > i currently have a drive plugged into the machine via usb, I can mount
    > > the drive and view some directorys.. but the rest are borked
    > > Are there any tools available that can scan the drive and recover any data?
    > >
    > > Cheers

    > the drive is ntfs btw
    >
    > Windows does not see anything, mac and linux see all folders, but few files


    Have you been writing to the disk 'from' Linux?

    If so, I'd try and back it up (image it), and then mount it in a Windows
    PC and try yer basic chkdsk stuff.

    --
    Duncan
    Dave Doe, Nov 22, 2006
    #5
  6. Andrew Lambert

    jasen Guest

    On 2006-11-21, Andrew Lambert <> wrote:
    > Im looking for a linux tool for hard drive recovery
    >
    > i currently have a drive plugged into the machine via usb, I can mount
    > the drive and view some directorys.. but the rest are borked
    > Are there any tools available that can scan the drive and recover any data?


    have you tried "fsck"



    I could give you a copy of "unshred" an invention of mine for
    data recovery, you might get some of the data back using it..

    it's pretty primitive it just scans the drive looking for anything that
    looks like the start of a file and then saving it on a different drive.

    ii only uses read access to the drive so it'll do no further harm.

    it's only sensitive to a few file types but if you can read C you can
    probably add others.

    it won't recover fragmented files correctly, or filenames.

    Bye.
    Jasen
    jasen, Nov 22, 2006
    #6
  7. Andrew Lambert

    Ray Greene Guest

    On Wed, 22 Nov 2006 09:39:16 +1300, Andrew Lambert <>
    wrote:

    >Im looking for a linux tool for hard drive recovery
    >
    >i currently have a drive plugged into the machine via usb, I can mount
    >the drive and view some directorys.. but the rest are borked
    >Are there any tools available that can scan the drive and recover any data?


    Data Rescue PC from RecoverSoft has saved my bacon a few times. It needs a
    FAT partition, which can be on a USB drive, to write the data to.

    It's $US129 though :-(

    --
    Ray Greene
    Ray Greene, Nov 22, 2006
    #7
  8. Dave Doe wrote:
    > In article <>, f says...
    >> Andrew Lambert wrote:
    >>> Im looking for a linux tool for hard drive recovery
    >>>
    >>> i currently have a drive plugged into the machine via usb, I can mount
    >>> the drive and view some directorys.. but the rest are borked
    >>> Are there any tools available that can scan the drive and recover any data?
    >>>
    >>> Cheers

    >> the drive is ntfs btw
    >>
    >> Windows does not see anything, mac and linux see all folders, but few files

    >
    > Have you been writing to the disk 'from' Linux?
    >
    > If so, I'd try and back it up (image it), and then mount it in a Windows
    > PC and try yer basic chkdsk stuff.
    >

    Have not been writing to it

    it was in a windows machine, When plugged in normally (via ide cable)
    the machine refuses to boot


    its plugged in via usb at the moment, Windows recognises the drive, but
    shows no data. Linux mounts the drive and shows data, but most folders
    report an input/output error when trying to access them
    Andrew Lambert, Nov 22, 2006
    #8
  9. Andrew Lambert

    -=rjh=- Guest

    Andrew Lambert wrote:
    > Andrew Lambert wrote:
    >> Im looking for a linux tool for hard drive recovery
    >>
    >> i currently have a drive plugged into the machine via usb, I can mount
    >> the drive and view some directorys.. but the rest are borked
    >> Are there any tools available that can scan the drive and recover any
    >> data?
    >>
    >> Cheers

    > the drive is ntfs btw
    >
    > Windows does not see anything, mac and linux see all folders, but few files
    >


    There is heaps of stuff available free that will do what you want; the
    issue about NTFS not being safe to write to under Linux (it is safe,
    actually, but not advisable in this case) is not at all relevant, as you
    will only be reading from it.

    Check out distrowatch.

    I've posted this previously in this ng, but here it is again:

    ====================
    I've had good results using (IIRC) INSERT and STD

    There are heaps of forensic LiveCD distributions listed on Distrowatch,
    search the Forensics, Security and Rescue categories.
    =====
    INSERT - Inside Security Rescue Toolkit
    INSERT (Inside Security Rescue Toolkit) aims to be a multi-functional,
    multi-purpose disaster recovery and network analysis system. It runs
    from a credit card-sized CD-ROM for convenient transport or download and
    is basically a stripped-down version of Knoppix. INSERT provides full
    read-write support for NTFS-partitions using captive-ntfs.

    STD - Security Tools Distribution
    STD is a customised distribution of the Knoppix live Linux CD. STD
    focuses on information security and network management tools. It is
    meant to be used by both the novice looking to learn more about
    information security and the security professional looking for another
    swiss army knife for their tool kit. The tools are divided into the
    following categories: authentication, encryption utilities, firewalls,
    penetration tools, vulnerability assessment, forensic tools, honeypots,
    intrusion detection, packet sniffers and assemblers, network utilities,
    wireless tools, password auditing (crackers) and servers.
    ====

    Basically, you can boot from CDROM, take an image of the hard drive you
    are interested in and put that image on a fileserver or another hard
    drive, and work from the image. Some of these distributions have quite
    good tools for working with the data, in some cases with a web based
    front end.

    Quite useful for getting data off failing hard drives, as well as the
    forensic side of things.
    ===========

    You can work directly off of the original hard drive if the data isn't
    really important to you; the forensic apps are capable of retrieving
    files that Knoppix cannot see.
    -=rjh=-, Nov 22, 2006
    #9
  10. Andrew Lambert

    -=rjh=- Guest

    Dave Doe wrote:
    > In article <>, f says...
    >> Andrew Lambert wrote:
    >>> Im looking for a linux tool for hard drive recovery
    >>>
    >>> i currently have a drive plugged into the machine via usb, I can mount
    >>> the drive and view some directorys.. but the rest are borked
    >>> Are there any tools available that can scan the drive and recover any data?
    >>>
    >>> Cheers

    >> the drive is ntfs btw
    >>
    >> Windows does not see anything, mac and linux see all folders, but few files

    >
    > Have you been writing to the disk 'from' Linux?
    >
    > If so, I'd try and back it up (image it), and then mount it in a Windows
    > PC and try yer basic chkdsk stuff.
    >


    I think that is bad advice, in my experience, chkdsk will likely achieve
    nothing, and more likely, make the problem worse. There are better
    alternatives. Definitely take an image, though, but don't use Windows to
    do this.

    I wouldn't put a drive I wanted to recover data from in a Windows system
    anyway - you cannot easily control how Windows writes to the drive, and
    it may well make the problem worse.
    -=rjh=-, Nov 22, 2006
    #10
  11. Andrew Lambert

    -=rjh=- Guest

    Andrew Lambert wrote:
    > Dave Doe wrote:
    >> In article <>, f says...
    >>> Andrew Lambert wrote:
    >>>> Im looking for a linux tool for hard drive recovery
    >>>>
    >>>> i currently have a drive plugged into the machine via usb, I can
    >>>> mount the drive and view some directorys.. but the rest are borked
    >>>> Are there any tools available that can scan the drive and recover
    >>>> any data?
    >>>>
    >>>> Cheers
    >>> the drive is ntfs btw
    >>>
    >>> Windows does not see anything, mac and linux see all folders, but few
    >>> files

    >>
    >> Have you been writing to the disk 'from' Linux?
    >>
    >> If so, I'd try and back it up (image it), and then mount it in a
    >> Windows PC and try yer basic chkdsk stuff.
    >>

    > Have not been writing to it
    >
    > it was in a windows machine, When plugged in normally (via ide cable)
    > the machine refuses to boot
    >
    >
    > its plugged in via usb at the moment, Windows recognises the drive, but
    > shows no data. Linux mounts the drive and shows data, but most folders
    > report an input/output error when trying to access them
    >


    Also see foremost (http://foremost.sourceforge.net/) but you won't be
    able to do this under Windows.

    There is a corresponding app (AFAIK developed by the USAF, but I may be
    wrong about that) which would behave like dd but would continue through
    errors - in fact, it would work through the good data on a whole drive,
    then go back and repeatedly attempt to get data from defective areas of
    the drive; the idea being that you have only a very short time to get
    your data as the drive fails.
    -=rjh=-, Nov 22, 2006
    #11
  12. Andrew Lambert

    Dave Doe Guest

    In article <4564b15f$>, says...
    > Dave Doe wrote:
    > > In article <>, f says...
    > >> Andrew Lambert wrote:
    > >>> Im looking for a linux tool for hard drive recovery
    > >>>
    > >>> i currently have a drive plugged into the machine via usb, I can mount
    > >>> the drive and view some directorys.. but the rest are borked
    > >>> Are there any tools available that can scan the drive and recover any data?
    > >>>
    > >>> Cheers
    > >> the drive is ntfs btw
    > >>
    > >> Windows does not see anything, mac and linux see all folders, but few files

    > >
    > > Have you been writing to the disk 'from' Linux?
    > >
    > > If so, I'd try and back it up (image it), and then mount it in a Windows
    > > PC and try yer basic chkdsk stuff.
    > >

    >
    > I think that is bad advice, in my experience, chkdsk will likely achieve
    > nothing, and more likely, make the problem worse. There are better
    > alternatives. Definitely take an image, though, but don't use Windows to
    > do this.


    chkdsk will not fix anything without a '/f' - so it won't harm it by
    just running it 'vanilla' - will it?

    --
    Duncan
    Dave Doe, Nov 22, 2006
    #12
  13. Andrew Lambert

    -=rjh=- Guest

    Dave Doe wrote:
    > In article <4564b15f$>, says...
    >> Dave Doe wrote:
    >>> In article <>, f says...
    >>>> Andrew Lambert wrote:
    >>>>> Im looking for a linux tool for hard drive recovery
    >>>>>
    >>>>> i currently have a drive plugged into the machine via usb, I can mount
    >>>>> the drive and view some directorys.. but the rest are borked
    >>>>> Are there any tools available that can scan the drive and recover any data?
    >>>>>
    >>>>> Cheers
    >>>> the drive is ntfs btw
    >>>>
    >>>> Windows does not see anything, mac and linux see all folders, but few files
    >>> Have you been writing to the disk 'from' Linux?
    >>>
    >>> If so, I'd try and back it up (image it), and then mount it in a Windows
    >>> PC and try yer basic chkdsk stuff.
    >>>

    >> I think that is bad advice, in my experience, chkdsk will likely achieve
    >> nothing, and more likely, make the problem worse. There are better
    >> alternatives. Definitely take an image, though, but don't use Windows to
    >> do this.

    >
    > chkdsk will not fix anything without a '/f' - so it won't harm it by
    > just running it 'vanilla' - will it?
    >

    Then what's the point of running it? With hard drive failure, time is
    everything - *everything* you do needs to be focused on getting the data
    off in the minimum time. Just running the drive unnecessarily may reduce
    the chances of getting the data off. Even Windows normal behaviour will
    mean it writes to the drive in normal operation, and you really don't
    want this.

    I suspect that for NTFS drives at least, Windows writes and corrects
    stuff on the drive without user intervention all the time, which isn't
    good in this situation. I've been caught out by that before.
    -=rjh=-, Nov 22, 2006
    #13
  14. Andrew Lambert

    Dave Doe Guest

    In article <>, says...
    > Dave Doe wrote:
    > > In article <4564b15f$>, says...
    > >> Dave Doe wrote:
    > >>> In article <>, f says...
    > >>>> Andrew Lambert wrote:
    > >>>>> Im looking for a linux tool for hard drive recovery
    > >>>>>
    > >>>>> i currently have a drive plugged into the machine via usb, I can mount
    > >>>>> the drive and view some directorys.. but the rest are borked
    > >>>>> Are there any tools available that can scan the drive and recover any data?
    > >>>>>
    > >>>>> Cheers
    > >>>> the drive is ntfs btw
    > >>>>
    > >>>> Windows does not see anything, mac and linux see all folders, but few files
    > >>> Have you been writing to the disk 'from' Linux?
    > >>>
    > >>> If so, I'd try and back it up (image it), and then mount it in a Windows
    > >>> PC and try yer basic chkdsk stuff.
    > >>>
    > >> I think that is bad advice, in my experience, chkdsk will likely achieve
    > >> nothing, and more likely, make the problem worse. There are better
    > >> alternatives. Definitely take an image, though, but don't use Windows to
    > >> do this.

    > >
    > > chkdsk will not fix anything without a '/f' - so it won't harm it by
    > > just running it 'vanilla' - will it?
    > >

    > Then what's the point of running it? With hard drive failure, time is
    > everything - *everything* you do needs to be focused on getting the data
    > off in the minimum time. Just running the drive unnecessarily may reduce
    > the chances of getting the data off. Even Windows normal behaviour will
    > mean it writes to the drive in normal operation, and you really don't
    > want this.


    The point of running it is to see if it finds any problems - surely.
    Based on those results, one can then take further action.

    If it's not mounted as a boot drive, when and why will Windows write to
    it?

    > I suspect that for NTFS drives at least, Windows writes and corrects
    > stuff on the drive without user intervention all the time, which isn't
    > good in this situation. I've been caught out by that before.


    Thanks, didn't know that (not for 'data' drives anyway). What versions
    of Windows do this? (ie when did they start doing this?).

    --
    Duncan
    Dave Doe, Nov 22, 2006
    #14
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Nate
    Replies:
    1
    Views:
    1,117
    Ed Mullen
    Feb 21, 2004
  2. Digital Image Recovery
    Replies:
    1
    Views:
    1,266
  3. H
    Replies:
    7
    Views:
    4,773
    Toolman Tim
    Jul 21, 2005
  4. Digital Image Recovery

    Digital Image Recovery and Memory Stick Recovery; Recovery of Lost Photos

    Digital Image Recovery, Sep 10, 2004, in forum: Digital Photography
    Replies:
    0
    Views:
    1,114
    Digital Image Recovery
    Sep 10, 2004
  5. Ron
    Replies:
    3
    Views:
    872
Loading...

Share This Page