Hello,
This is not strictly a forensics question, but I figure you folks are the best in the business.
An acquaintance has a 10-year old IDE HD with all of his company data on it. All of a sudden the other day he was unable to access the drive. The system was running windows XP and this is the c drive.
Since I have had an interest in data recovery / digital forensics for several years, he asked me if I could try to access the drive and extract the critical data.
I received teh drive this morning. I installed it into my external IDE drive enclosure hooked it up to my Ubuntu-based laptop, and turned the power to the enclosure on.
Clunk Clunk Clunk whine…
As root on the ubuntu system, I ran dmesg and discovered that the drive was attached as sdc. Looking into /dev, I see sdc but no sdc1 or any other partitions.
Running testdisk, parted /dev/sdc print fdisk -l all yielded absolutely nothing.
I ran gpart and got a floating point exception.
I strongly suspect that there has been a physical failure of the drive. My acquaintance needs the data by Wednesday next week, so I want to help him out if I can.
Is there anything I should try to gain access to this drive?
Any suggestions/thoughts welcome!
Greetings,
If you believe there is a physical failure, stop, drop, and roll. Without the right tools and experience, you are unlikely to do anything more that make matters worse.
Call DriveSavers, or a similar company, and have them look at it.
http//
-David
Based on age and sounds described I would say heads failed and hopefully no platter damage has occurred at this point. I don't see this being recovered without a trip to the clean room to get a better diagnosis.
You can try his backup drive….
I agree with jwells that it sounds like physical error - or at best a firmware error. It need more than a software solution
You can try his backup drive….
Thanks everyone for confirming my suspicions. As for a beackup drive -) I don't think he has one based on the way he talks.
Actually I had told my brother-in-law of my interest in doing data recovery / computer forensics so when his boss's computer had a problem his boss called me.
I will call barious places locally (both here in Tucson and Phoenix) to see if anyone can handle recovering data from a drive with mechanical issues and proceed from there.
BTW This group is AWESOME!
…10-year old IDE HD with all of his company data on it…
As for a beackup drive I don't think he has one…
I am continually amazed by people not keeping backups. Not a single backup in 10 years of all the company data?? Incredible. If it was a public company they would be sacked for incompetence.
I would start by confirming this is really the case. Was work ever taken home on a laptop? Were the accounts sent to the external accountant? Were there USB drives with some of the data available? Were some documents E-mailed to other people and might be recoverable from E-mail?