Hard disk data recovery. 365

forgive the snip

First thing is to decide what caused the failure as best you can. I would be concerned that the hard disk you were writing to encountered a hardware-firmware problem.

Just how important? How many hours of your time are you willing to invest? How much $ are you willing to pay for a specialist recovery shop to recover what they can?

Grant is suggesting that you should get that hard drive out of service ASAP! The "image" he is talking about is just a raw "bit-4-bit" copy of the parbreastion of the failed disk, similar to what you would get with Norton Ghost imaging software. Linux rescue CDs ususally include something that will allow-help you make this copy. Eg.,

Ask around here for experienced suggestions.

Howerver, before doing even this minimal step, I would test the low level integrity of that hard disk. Many makers provide disk utils that will provide this low level access and may allow you to recover or repair some problems. What kind of HD is it? Go here to find what tools may be available:

DOS boot disk

This last one can provide more background than you will hopefully need as well as tools related to S.M.A.R.T capable hard drives.

If you confirm that there are no hardware related problems (including simple things like ribbon cables), then you can buttume that the problem is a corrupted file system. Now you should make an image of the boinked parbreastion and do all other work on that image rather than the troubled HD-parbreastion. Remove that original HD from the box and set it aside. It is your only source-backup of the lost data. Maybe a good idea to make two images of the HD parbreastion.

Question then is to determine just what the problem is. fdisk output seems to indicate that the "parbreastion table" is OK. However, Windows uses an extended parbreastion in a peculiar and difficult to recover fashion -- unlike Linux. So I would try to determine the integrity-correctness of the parbreastion table first. This can be tricky, tedious, and scary if you make a mistake with a disk editor. Go here for the best info I've found regarding the details of MS parbreastion and file system usage-layout. There is also a free, but dangerous, disk editor availabe. For a disk editor you might try a free trail version of a commercial product or find a friend with Norton Tools or something similar.

look for PTS Disk Editor

Don't be put off by the "extra" stuff.

This might be useful to check out as well for some tools:

If that checks out, then we can figure on a completely boinked file system. Ie., is so corrupted that it cannnot be recognized as being formatted. Do not jump to this conclusion too quickly; check the parbreastion tables first as best you can. Do not run any automated file system repair utils. FAT32 FSes are easier to work with and might be recoverable. NTFS, otoh, is beyond my experience regarding recovery.

Do you know which files are "lost"? Presuambly, the failure retained the untransferred files intact. What other files pre-existed on the disk? Backups? Did you defragment the parbreastion before starting this transfer operation? If not, disentangling the file fragments is likely beyond the skills of "ordinary folks" (ie., you'll have to use a data recovery service to try to recover the data).

You can try looking at the parbreastion with a disk editor, but usually I've had little to no luck recovering much data that way. You can get an idea just how badly things are boinked -- like large zeroed areas -- but piecing together the right blocks to reconstruct a file are, ummm, tough.

At this point you give the recovery job to someone else or use a commercial software recovery app and hope for the best (either way).

good luck, prg