[ale] Fwd: Hard Drive Death Spiral -- AKA Recovery Software?

Stephen R. Blevins srblevi at worldnet.att.net
Thu Dec 11 16:29:57 EST 2008


Greg, Kind Sir,
    Where can I learn about PTK.  Google is *not* my friend on this one.

    TIA

Stephen R. Blevins
srblevi at worldnet.att.net



Greg Freemyer wrote:
> The first thing you need / want to do is make a full copy (image) of the drive.
>
> So, buy a drive that is atleast 20% bigger.  (just to be sure).
>
> Format it ext2 or some other basic FS.  (Definitely not FAT).
>
> If the drive is more or less functional use dd to make the image.  If
> not, look into dd_rescue (or ddrescue, I forget).
>
> If it is a data drive, then all you have to do is:
>
> boot normally.  dd if=/dev/sdX of=/image_file_on_big_drive bs=4k
> conv=sync,noerror
>
> If it is a boot drive, then boot a linux boot disk and do the same.
>
> Once you have that working copy, you need to decide if you want to
> make even another copy that you keep un-modified.
>
> You can use gpart to guess / rebuild your partition table.
>
> Once you know where your partitions are and you know what filesystem
> type you have, you can use various recovery software to move forward.
>
> To do the recovery, we use a professional tool, so I'm not sure what
> low-end / free software is available to do the recovery.  (We use
> either Encase Forensics ($3,000) or X-Ways Forensics. ($1200))
>
> PTK is new opensource recovery tool that was released in the last few
> months.  It may support linux filesystems.  Not sure.
>
> HTH
> Greg
>
> On Thu, Dec 11, 2008 at 10:54 AM, H P Ladds <householdwords at gmail.com> wrote:
>   
>> Hey All,
>>
>> I have a hard drive that appears to be dieing, and I need data
>> recovery software. Any suggestions?
>>
>> History of problem:
>>
>> 1. Somehow the partitions on the drive got out of order -- sda6 used
>> sectors (4376 - 4618) and sda5 had (4619 - 19457).
>> 2. In an effort to correct this situation, I deleted the partitions
>> and recreated them using the same sectors.
>> 3. I was hoping to do a e2fsck to recreate the superblocks and such.
>> This was a bad plan, and partition sda5 is not mountable.
>> 4. I did not reformat the partition, so I believe the information is
>> still there.
>> 5. I guess what I need to do is reformat the drive without destroying
>> the data on the disk, which is mostly impossible -- right?
>>
>> Yes, I do have the info backed up on DVDs, but this seems to be a good
>> opportunity to develop some data recovery skills, and maybe I can see
>> what's on that disk I've had in the freezer for about two years.
>>
>> H. Preston
>> _______________________________________________
>> Ale mailing list
>> Ale at ale.org
>> http://mail.ale.org/mailman/listinfo/ale
>>
>>     
>
>
>
>   


More information about the Ale mailing list