Core Data Recovery

Posts Tagged ‘data recovery’

First, let me say this, leave it to the professionals if your data is critical. I do NOT recommend this if you can not afford to lose everything. All information contained in this article is to be used at YOUR OWN RISK. I will not be held responsible for your actions under any circumstances. Proceed with caution only if you are a geek.

Let me start by saying, I wrote this piece because I had to do a complex data recovery on a system damaged by a unix administrator trying to fix a drive that would not mount. This drive was, to make matters more complex, a striped raid array running an EXT2 partition type and all the files written were in inode tables. Those tables got shot by the attempt to repair the problem with FSCK. (NOTE DO NOT RUN FSCK to repair a drive that will not mount, unless you have a backup).

So, I have many tools to use if the drive is NTFS to restitch the 1 TB drives (2 of them) into one 2TB image file to run a recovery on. I do not have such tools in unix. This is the method I researched and successfully used to image the entire drive that was bad (was flaky, not dead) to a new 1 TB Western Digital drive.

I was then able to stitch the drives together in a virtual striped pair in Debian linux. I then used scalpel to retrieve the files that I could not retrieve with my unix recovery methods. (FSCK had shot the Inode table to hell).

So below is the method, tried and true, to image bit for bit an entire drive to another drive of everything, (even if there is no partition table available whatsoever (as is the case with a striped pair)). I prefer Debian however, I suggest UBUNTU in this article as it is easier to do the job from a bootable cdrom for an average windows technician to use.

If you can’t afford to have someone recover it, or think you are a super geek, here’s how to do a sector by sector copy of a drive that is failing to one that is new.

Mark the hard disk you have, set it aside as your source drive.

Grab a scratch drive (If you have one) and install ubuntu  on it from the cd downloaded here:

http://www.ubuntu.com/getubuntu/download , burn it to a cdrom.

Boot the cdrom and install ubuntu, I say this because if you have a small hard disk, you can stop the copy process in the middle without losing data.

Once ubuntu is loaded, select the package manager, search for ddrescue and install it.

Now you will need the 2 USB to IDE adapters I mentioned just now. (Easier than any other method)

Plug the source Hard disk into the IDE – USB adapter and plug the power in. Don’t plug in the usb yet.

sudo fdisk -l will list all drives in the system and whatever partitions are available to you.
note and mark the drives.

Then plug in your usb and run it again
sudo fdisk -l
you will see and mark the appropriate /dev/sdb etc. Please physically mark the drive with a post it note.
Plug in your usb attached destination drive and run it once again.
sudo fdisk -l
and mark the drive with the info.

Another way is below

run this:

ls /dev/sda
ls /dev/sdb
ls /dev/sdc

as soon as you get a not found error, stop searching.

If you have a /dev/sda file not found, you can now plug in your usb.

Please note, I want you to tag the drive with a pen as /dev/xxx as soon as you discover what it is.

If /dev/sda was found, or no error, put a sticker with /dev/sda on the computer tower (that’s where the scratch drive is and apparently it’s either scsi, or SATA.

if /dev/sdb was not found, Plug in the usb and wait 30 seconds.

then issue the
ls /dev/sdb  if there is not an error, you may tag the source drive /dev/sdb.

Then please plug in the drive you are copying to *Your Destination drive*

Issue the following if /dev/sdb was the last drive you tagged
ls /dev/sdc if no error, you may tag your destination drive as /dev/sdc

NOW for the magic.

You have a source drive (Tagged /dev/sdb for this example)
You have a destination drive (tagged /dev/sdc for this example.)

Issue the following command:
sudo ddrescue -n /dev/sdb /dev/sdc /home/root/logfile.log
This will take a while, but skips all troubled sectors.
sudo ddrescue -r3 /dev/sdb /dev/sdc /home/root/logfile.log
This command retrys all bad sectors logged above and makes this process much faster.

Once this is done, you can shutdown -h now and shutdown the computer.

On a seperate computer, running xp and having enough room for your critical files.
Plug in the USB to IDE adapter with the destination drive attached and powered on.
Copy any files if the partition will mount. If it will not mount, Install Get Data Back from runtime.org
Purchase a license for it and run it on the drive you recovered your data to to get as much as humanly possible back.

Below is a link I found after I wrote this all out for you.
http://www.linux.com/learn/tutorials/8225-clone-your-ubuntu-installation-onto-a-new-hard-disk

It has more information in other words, that you might find helpful for accomplishing a sector by sector (or byte by byte copy)

http://www.2thedeuce.com/video/?autoStart=true&topVideoCatNo=default&clipId=3686051

Personally, If I wanted to make my data unrecoverable by most means, I’d drill a hole (3/8″) down thru the platters (The rounded part of the drive).

This will destroy it so somebody would have to spend tens of thousands of dollars recovering your old data.

I have been recommending Jungle Disk for the last year or so for off site backup (Secure encrypted off site storage).

Jungle disk has multiple advantages for backup:

1. Supports Multiple platforms (Windows, Mac, Linux)
2. High Encryption supported (AES 256 bit buckets)
3. Inexpensive ($.10 / Gigabyte) monthly storage ( Transfer in or out is $.15/Gb)
4. Enhanced package available ($1.00/Mo.) to update large files to save time on those really big files
5. Easy to install and setup
6. Storage is on a RAID array provided by Amazon Web Services (AWS) S3
7. Inexpensive to purchase ($20 for as many computers as you need backed up)
8. You only pay for what you use so no more over paying
9. Everything you store is encrypted with at least one cipher.

Drive letter access ( you can map a drive letter and use it like an external hard disk if you wish)

I highly recommend this backup methodology for a good automatic daily backup to accompany a physical external drive in your home or office.

http://www.jungledisk.com/desktop/why.aspx

1. How much experience do their technicians have? (I have 20 years)
2. What is their success rate? (mine is about 75%) anyone who claims over 80% is simply lying about theirs.
3. Do they have a clean room? a clean bench? can they change heads? Transfer platters? (all these services are expensive but we can do them.)
4. Do they offer references and do you know/trust them? I rely on referrals to bring me business.
5. Do they offer to help you setup better backup systems? An ounce of prevention is …
6. You only get one attempt at this recovery – so make the best of it and give us a call.

1. Backup, Backup, Backup. Use a good offsite backup service and maintain good onsite backups. I have been recommending iBackup to my clients for a couple of years now and have been pleased with ease of use and performance.
2. If you hear funny noises, shut down your computer and have it looked at immediately. Clicking and chattering are not normal.
3. Use a good anti-virus software and anti-spyware software. These help cut down on software damaged drives. See my Discounts page for some of the software options I recommend, or email me for specific recommendations for your situation.
4. Purchase and maintain a good UPS (Uninterruptible Power Supply). This is important because about 30% of the drives we see are electronically damaged in brown-outs.
5. Clean the inside of your computer out (canned air is a wonderful thing!) and change the power-supply once every year. (Especially servers.) Maintenance is a good way to avoid damage. Dust seals in the heat and keeps the air from getting to the aluminum to wick off the heat. Aluminum radiates less than 2% of its energy so air/metal contact is a must. Clean more frequently if you work in a dusty environment.
6. On critical systems, implement a RAID architecture. Mirroring or RAID 5 or more is preferred. This means it takes more than one drive failing to cause a crash.
7. Restore your backups on a semi-annual basis to check that your backups are complete.
8. Do not, under any circumstances, while running or not, shake or hit the drive. This can lead to irreparable damage. This would seem like something I don’t have to tell you, but you’d be surprised how many people use the old “kick it and see if that fixes it” mentality.
9. Do not have food around your computer, particularly laptops. Sodas are the number one reason laptops seem to die (At least the ones sent to me)
10. Finally, do not immerse in water. Water will destroy your drive. Why? Hard disks are exposed to the air so they can properly maintain a pressure inside the drive. Water will seep inside the drive and corrode the surface.

Common Mistakes When Attempting to Recover Data Yourself

It sounds self serving, but if you could see how many hard disks we get in that have unrecoverable sections caused by user error, you’d understand why we say that data recovery by a professional is recommended if you really care about your data. Often, there is a limited window (number of attempts) to retrieve data from a failing hard drive, and using those up with unsuccessful attempts only costs you more in the long run – often the price you pay is lost data. It hurts that much more to know you could have had it back but for the home attempts to recover. That said, if you want to try to recover data yourself. . .

Here are our top 10 data recovery mistakes to avoid:

1. Under NO circumstances open the top of the drive. Exposing the internal workings to the outside world will destroy your chances of recovery in every case. If you need to have your drive opened for a recovery, send it to us for clean room service. Your drive can be taken apart safely in a class 100 clean room environment. Hint: no matter how clean you think your office is, it’s not clean enough.
2. Do not reformat media. Reformatting the media overwrites the master boot record and disconnects the directories and files, making my job more difficult. Sensing a trend here? The more the drive is messed up, the more hours it takes me to recover your data, and the more money you pay to get the pictures of your kids’ first birthday back.
3. Never repartition the media. Repartitioning also disconnects the master boot record and directory structure and means more time in the lab reconstructing both.
4. Avoid temperature extremes. Never put your drive in the fridge or freezer. There seems to be a myth out there that this helps, however it can cause condensation of water on the platters and when you turn on the drive, this can lead to catastrophic drive failure (scratched platters) and make it even more expensive to repair. Also, never heat your drive in the oven. Some nitwit on the internet posted this as a method to evenly heat the circuitry. However, chips are encased in a polymer that melts, causing irreversible & unrecoverable damage.
5. Do not ignore the problem. If your drive fails to boot up ONCE, make a phone call.
6. Do not continue to use the drive once it starts exhibiting problems. No matter how far behind you are on that deadline, it’s not going to get any better. Hard drives do not sound like Morse Code unless something is very wrong.
7. Do not run scan disk, defrag, chkdsk, fsck etc. on your failing drive. Essentially, this shreds your data.
8. Avoid off-the-shelf software. These programs work best for situations when you accidentally deleted something, not for a malfunctioning hard disk.
9. Do not, under any circumstances, while running or not, shake or hit the drive. This can lead to irreparable damage. This would seem like something I don’t have to tell you, but you’d be surprised how many people use the old “kick it and see if that fixes it” mentality.
10. Finally, do not immerse in water. Water will destroy your drive. Why? Hard disks are exposed to the air so they can properly maintain a pressure inside the drive. Water will seep inside the drive and corrode the surface.

Deleted that file?

1. Restoration – Freeware undelete program