Recovering lost files

There’s an article at that gives a good overview of using testdisk and PhotoRec. Testdisk should be able to recover at the partition level and PhotoRec should be able to just pull the files out of a damaged partition. Truth is Hard drives fail in a number of different ways and some of those can give the same error messages. Not too long ago my brother had a laptop hard drive failure, it gave a “no partition found” kind of error message. We talked about a utility such as ghost4linux (g4l) which includes dd_rescue which does a remarkable job with failing disks.

However, I was out of town at the time and by the time I was back he had sent it to a data recovery company. It turns out that it was just as well, the read write head had actually fallen off. He said occasionally it would boot and the drive geometry was visible and correct, but realistically there was no way that data could have been recovered short of rebuilding the drive, which is what the data recovery company did.

Anyway, a week or so back, I had a call from a customer that had a similar problem. The laptop wouldn’t boot suddenly. They had already bought a replacement laptop by the time they called me, but they needed the information off the drive, it had not been recently backed up. I booted up the laptop and saw the “partition not found” or “no partition found” (at this point I don’t recall the exact wording.) I loaded the bios configuration and saw the drive was detected and thought this was a good sign. I took the laptop with me and got to work.

I first removed the drive and plugged it into an external adapter. Controller failure was my first suspicion. So, I plugged the usb adapter into my desktop and it saw /dev/sda show up, but no partitions found (no /dev/sda1)… hmmmm. Ok, this reinforces the no partition found message. So, I start looking around for software that can fix a partition table. gpart and the above mentioned testdisk come to the top of my search. I used gpart, at first very cautiously…. From the description of the software it can guess partition information from the data on the disk in the even you’re partition table is either missing or damaged. In this case, it found one 76GB NTFS partition which was the one I was hoping to see.

The fact that gpart saw this confirmed that the disk was likely ok, we just had a damaged partition table. After doing a test run where gpart reads the information and doesn’t write it, I got up the nerve to write the partition table back to the disk. After this, my desktop saw not only /dev/sda but /dev/sda1 as well and I was able to mount and browse the partition. All the files seemed intact.

I then went about cloning the disc with g4l (ghost4linux) running in dd_rescue mode (just in case). It turns out there were no read problems during the entire process. The only background I have as to what preceeded this “failure” was that they were in process of changing firewall exceptions for a specific program. It’s not clear if Windows crashed during this changing of settings, or if the reboot was merely required to complete the process. When they attempted to reboot, that’s when things failed to come back up.

One thing that you might take away from this, is that although it may seem that you’re data is gone/unreachable….. doesn’t mean that it really is. If you’re getting rid of a machine (even one that’s drive seems to have died). It’s worth trying to be REALLY sure and using something like DBAN (Dariks’ Boot and Nuke) which I’ve referred to several times.

Related Posts

Blog Traffic Exchange Related Posts
  • Some days you really want to slap someone at Microsoft.... So, I was formatting a drive the other day. It's an external hard drive that will need to be readable AND writable by both Mac and Windows XP machines. So, the only choice (without paying for MacDrive to read/write to HFS+) is really FAT32. The drive is in the 250GB-300GB......
  • A closer look at x11vnc I've got to say, one of the things I really like about linux are the myriad of options for remotely administering a system. SSH is the one I use the most, but for the graphical you have x (especially on the LAN), nxserver (which is a compressed and optionally encrypted......
  • Remote Tech Support using VNC (Ultravnc SC and x11vnc+wrapper script) Ok, some time back I'd done a writeup on UltraVNC SC, which is a nice customizable (windows version) VNC server that essentially let's someone doing remote support build their own downloadable .exe that runs and automatically tries to make a direct connection to a "listening" vnc viewer. It's good for......
Blog Traffic Exchange Related Websites
  • FREE Backup Software Free FBackup Software Review Backup Your PC Local, Network and USB Whether or not you are an internet marketer you need a way to offload your critical data in order to protect yourself against catastrophic system failure and resulting data loss. While a local backup solution will not protect you......
  • Corporate Blogging Pitfalls It has been widely recognized that blogging is an excellent way to publish content to a website, and many corporations and other businesses are beginning to embrace this idea with a great amount of enthusiasm. Not only are companies creating corporate blogs, but sometimes a single employee blogs as well,......
  • A New Credit Score That Includes More Financial Factors The calculation of your credit score already includes numerous details about your financial life, such as how much credit you have available to you, how much of that credit you are using, and the number of late payments made on your credit accounts over the past few years. Now, there......    Send article as PDF   

Similar Posts

See what happened this day in history from either BBC Wikipedia
Amazon Logo

Comments are closed.

Switch to our mobile site