Fragmentation shouldn't cause squeaking during imaging, because imaging is a sequential read.
If the drive is squeaking, get a complete image ASAP. If it is only one part of the drive, do an incremental image. Ideally image the MFT and then the area of disk where files are most likelly to be stored (ie skip system file area). Don't thrash tyhe drive trying to read failed sectors - until all readable sectors have been read.
Once you have an image do searches for strings of text that may be in your critical documents.
Try and establish for any MFT entries if the files were typically compressed. If compressed, then DOC files will start with the string 0xd0 0xcf, but in bytes 3-4 of a sector (byes 0 and 1 are the length of the compressed data run, and byte 2 is flag to indicate characters or strings ).
I agree with the others. Get an image of the drive and work from that. In fact, you may have already missed your chance.
Depending on the real root cause for the failure you may only get ONE chance to make an image of the drive. Even then the failure can spread like a cancer…. only faster and you end up with a worthless image and a completely unrecoverable drive.
Try dd_rescue to get your image. It can adjust it's buffer size down to a single sector and maximise the amount of data that is recovered. Be patient. I have seen dd_rescue take as long as 2-3 weeks to image a drive. In the end I was able to recover most of the data off of the drive.
I don't claim to be an data recovery expert. I've had some training and have been successful with most of the recoveries that I have done. If I get a drive with really critical data on it I pass it on to the guys with the multi thousand dollar drive diagnostic and imaging devices.
TonyC
Greetings,
I'd suggest that the OP is well past the point of trying to get a full image from this drive and further efforts will likely make the situation worse.
If the OP truly believes there is valuable information on the drive, it should be shipped to a professional data recovery service.
-David
I think I am in agreement with kovar! I'm basically clutching at straws. I've been trying to image this thing for 2 days and its constantly failing. I don't mind it taking a long time, but its not even doing that, its just failing!
The drive is fine to read when its plugged in via USB, until I start any image recovery, it just failed. The most I got out of it was about 30 minutes.
As mentioned, I got the important photo's of it they wanted, but unable to recover or even find the Thesis on it! Oh well, they should have back it up (I have mine backed up in about 3 locations!!!!) D
When you are imaging the disk, are you always starting at the start, or in different places.? Often the final 80% of a disk reads better than the first 20%.
Image the important areas first to slowly build up a 'complete' image. Maybe start with the final 80%, but don't let the drive get stuck on failing areas
Final Update!
So, it turns out that the owner 'does' have another working copy of her Thesis backed up!!!! roll
I tried a few other things but the disk is basically buggered. It always starts off fine, but after a few minutes, starts squeaking and then stops responding. Its beyond repair. And since she got her thesis backed up and I got the pictures off it, there is nothing left for me to do! But it was a good experience to see the possible different scenarios out there that you could come up against, not just deleted data that needs recovering.
Thanks for all the help guys/gals always much appreciated!
)
A few years ago I had a desktop with an 80 GB primary drive and an 250 GB secondary drive. There was there was a 3rd hard drive laying unattached to the bottom of the case it was 80 Gb. I imaged all three drives. When I examined the third drive I found it to contain almost all multimedia material. I was sure that the 250 GB HD had all the evidence I was looking for.
I loaded the image of the 250 Gb HD into FTK and went to sleep while the program did its thing. When I woke up I found I had virtually nothing. At first I tried to figure out how I could have wiped the 250 Gbyte image. After a while I went into the registry that was on the primary 80 GB HD. Once there I could see what happened. The 250 GB HARD drive that I had been given was brand-new. There had been a different 250 GB hard drive installed in that computer, but it was long gone. This was a domestic case in which the SUBJECT had apparently tapped the phone. He heard my client, his wife make arrangements for me to receive the computer. He thereupon removed the 250 GB hard drive, went to Best Buy and bought a replacement which I ended up with. We were able to verify all of that with Best Buy records and through a brother-in-law who the loudmouthed SUBJECT confided in.
We had of course the serial number of the "new" 250 Gbyte HD and the serial number of the one he had removed. The case was all about substantial community assets that he had ratholed. The lawyer and I want to move forward and supeoena the missing hard drive. But the client, apparently still hopeful of a reconciliation dropped the case.
I thought of that when you said that you couldn't find anything on the hard drive.