Hi,
I've got a laptop with a very bad hard disk from my client. It makes weird noise when accessed. I took it out and use the Dossier to do a DD and E01 image but failed, with too many errors.
I then put it back to the laptop and boot to Raptor. Raptor seems to be able to image the drive but when i review the DD image file, there isn't any thing. It only shows 2 volumes (drive C and D) without any folder structure. I use EnCase to recover any folders and eventually showed some folders which are of no interest.
Next i took the disk out and connect to Windows via a write blocker. Windows is able to recognise the disk but with an error message that says "Drive not formatted". I ignore this message and try EnCase but it stuck at "Parsing MFT". I then tried FTK but I'm not able to add the disk as a logical drive. "Hang" for a long time.
Anybody has any idea on how to get data out of this disk?
Kwokhong,
when using EnCase to acquire drive, try to set Read File System and Parse Link Files options in Choose Device dialog box to NO. You should be able to acquire raw disk data and then you may try to use Partition Finder to restore partition setup or search/carve files from unallocated space.
Good luck!
Greg
This is data recovery rather than forensic analysis. Try data recovery tools.
Thanks Greg!
I'm trying your method and hope that it works! I will update again.
This is data recovery rather than forensic analysis. Try data recovery tools.
+1 )
Carpenter's example (if needed)
Q. I have issues in placing a nail into a wooden plank with a hydraulic hammer, I also tried with a pneumatic one, but with no good result.
A. Use a plain, simple hammer, i.e. a tool designed and refined over the last few thousands years exactly to the scope of planting nails in wood.
Seriously, you have a (possibly seriously) defective hard disk.
You need to use a copying/imaging strategy that attempts to maximize the bits and pieces that can be salvaged (if any) and of course - depending on how much valuable is to you or your client the data - it could also make sense to stop fiddling with it and give the thingy to a data recovery professional.
If you want to insist in DIY, you should use appropriate programs, such as ddrescue or dd_rescue under Linux and/or
http//
http//
http//
under Windows NT.
The general idea is of the approach is sketched here
http//
A very good tool to recover data and or fix filesystems (once disk is imaged) is dmde
http//softdm.com/
jaclaz
dd_rescue under Linux is indeed a very good tool for this.
A friend of mine gave me his dying HDD, because the "professional" shop where he bought the drive told him that there was no way of accessing/recovering the data on it.
dd_rescue did the trick for 99% (physically damaged sectors could't be recovered.)
Suggestion try to decrease the temperature of the drive as much as possible before use (put it in a plastic bag and then in your refrigerator for at least 12 hours, but do not go below zero temperatures).
Suggestion try to decrease the temperature of the drive as much as possible before use (put it in a plastic bag and then in your refrigerator for at least 12 hours, but do not go below zero temperatures).
I would highly advise against this, as you would be risking getting condensation on the platters (which is obviously not good). If you have a few minutes, peruse the
DD_rescue may be able to image most or all of your drive, but you're also risking making matters worse if it doesn't work. Failed previous data recovery attempts tend to make things much more difficult (i.e. much more expensive) for professional DR companies. It's a choice you'll have to make, but you should be aware of the potential consequences if you spend a while trying to perform DR yourself.
jaclaz,
I think the disk is screwed. Tried the method that you have suggested but can't work at all. I have handed the disk to a professional data recovery vendor. I guess they will need to recover it directly from the disk platter. Thanks everybody for all your help!
jaclaz,
I think the disk is screwed. Tried the method that you have suggested but can't work at all.
Sorry for that, but nowhere like in data recovery, sometimes you win, sometimes you lose cry .
I have handed the disk to a professional data recovery vendor. I guess they will need to recover it directly from the disk platter.
I don't think that any professional actually exists that can recovery data "directly from the disk platter", just for the record, the usual procedure is the following
- find a disk of EXACTLY the same manufacturer/model AND Revision
- transplant the platter from the old defective disk to the found replacement
I hate to be the bearer of possibly bad news, but even if the disk has been put in the hands of a very expert and capable pro, data may not be recoverable, a lot of variables are still unknown.
IF the EXACT replacement is found, THEN IF the transplant is done successfully (it is a rather complex job, expecially if the disk is multi-platter), THEN IF the actual platter is NOT damaged, AND IF the filesystem is NOT damaged OR IF the files were "substantially" contiguous, THEN your client will (hopefully) get the data back.
Thanks everybody for all your help!
You are welcome ) , if you can, please let us know how it evolved/ended…
jaclaz
Jaclaz,
I was told that the drive head was misaligned and it caused a little surface damage on the disk platter. Recovery of the data is possible but would take about 2 weeks, a lead time which is not agreeable by my client. Hence I did not proceed.
Thanks for the help man!