Hello Everyone,
I am a newbie when it comes to data recovery. I have a problem which I hope you might be able to help me with.I have a 160GB Seagate SATA hard drive. A few days back the computer got stuck and became unbootable.
After analyzing the drive i got to know that it was possible that there are bad sectors at the starting of the drive, i.e. Sectors 0-17 or so.Also, the drive is detected in the BIOS when i first boot it. If i reboot the machine, BIOS fails to detect the drive. Then i have to switch off the mains for 2-3 seconds and then start the system.
I could search for lost partitions but couldnt save them. I know at what sector each partition starts. I want to recover certain data from 2 of the partitions.
The files i want to recover are-
1. jpeg
2. mp4
3. dat (yahoo messenger archive)
Is there any software which could help me extract the data i want to??
Will imaging the drive i.e the range of sectors that constitute the particular partitions i want to recover help??
Thanks
Adil
Imaging the disk isn't necessary to recover the data, but if the disk is failing, it might be wise to make as full a duplicate as possible should any further degridation occur. 😯
You should have no problems in recovering the files, as these are not going to have been damaged, and if you edit your image to reconstruct the missing sectors/partition table so that you can mount the image, you could very simply copy the files off.
Good Luck. D
@debaser_
Thanks for your input. My disk seems to be failing…its been acting real weird and i would be going to get a replacement. Last time i had this problem i plugged it to my friends computer and it miraculously started working after a few tries. But this time i wasnt lucky ( So i wanted to try and image my disk. I want to try recovering data from it before i give it for replacement.
@azrael
Well the disk seems to be failing. And before it stops dead i would prefer to image it…Now i dont really need the image of the whole drive. As i mentioned earlier, its only 2 drives that i want to recover i.e. from sector 257361363 - 299307077 and from sector 299307078 - end of drive.
Now since i am a newbie i dont really know much about it and cant spend time experimenting. Could you please help me out with this? I want to know whether i can image those two partitions and then mount it to recover data from it. Also which software do i use for doing this?
Thanks alot for all your help. It is really appreciated
Adil
I'm a student only, so someone may know better than I.
The way I would do it ( with no budget -) ) is to use a Linux distribution, the "dd" tool to image the sectors required and then the Linux "mount" command to mount the ( hopefully undamaged ) partitions.
Excluding the process of installing/booting a Linux distribution, you should use ( assuming a default 512 byte block and sector size )
dd if=/dev/hdb of=/home/si/partition.img seek=257361363 count=41945715
Where /dev/hdb is the block device assigned to the drive by the Linux distribution, /home/si/partition.img is the name of the file that you are copying to, and you check my maths to ensure that you capture the first and last blocks of the partition.
To mount an image obtained in this way use
mount -oloop /home/si/partition.img /mnt/partition
Where /home/si/partition.img is the image and /mnt/partition is the mount point.
This is a simplistic overview, you may need to specify the file system type to the mount command, and setting up the computers in the first place takes time, although it isn't particularly complex for an IT professional. -)
It is possible to image the entire disk, and then mount sub-partions by specifying their start, but it seems to be more trouble than it is worth if you are only after data from those partitions.
There are Windows imaging tools that I am sure others can reccommend, WinHex has an imaging capability that I am told is good, I don't know if it is available without a licese though.
Sorry not probably as much help as you could use -(
I'm sure that someone else can be more practical use …
All the best.
Addendum
Try
http//
and Google for tools.
There are a few forensic Linux distributions, have a look in the Open Source tools Forum here for more information …
If you are still having problems with the drive it could be one of two things.
1. Head failure - the heads could be in the process of failing or indeed failed
2. The firmware is corrupt. This is the most likely option.
Even if the platters have bad sectors on them, its still possible to retrieve all the data, (except in those bad partitions).
If you are still struggling, then send the disk in to us here at
Regards,
Simon
Imaging the disk isn't necessary to recover the data, but if the disk is failing, it might be wise to make as full a duplicate as possible should any further degridation occur. 😯
You should have no problems in recovering the files, as these are not going to have been damaged, and if you edit your image to reconstruct the missing sectors/partition table so that you can mount the image, you could very simply copy the files off.
Good Luck. D
If there are any bad sectors, any booting from the drive will cause further damage on the healthy sectors, therefore bytrying to access the drive and the drive is "sometimes" bootable, and aint other times, merely indicates the seriousness of this matter.
the HDD must not be accessed with normal commercial tools.
You need professional tools.
Godd luck
Stupid question but have you tried plugging the drive into a USB interface? If your boot sector is fucked, maybe you can get to your data by bypassing it?
These things are invaluable. . .
Try WinHex. You can program it to search for and recover certain types of files. If you just need the data and don't care whether or not its bootable this is the way to go.
-Dawson