WAYS TO RECOVER DATA FROM CRASHED HARDDISK

WAYS TO RECOVER DATA FROM CRASHED HARDDISK



WARNING
First, you should know that any attempts to recover data from a damaged or failing hard drive may lead to further damage making it impossible to recover data even by a professional. So, if the data is EXTREMLY important to you, DO NOT ATTEMP TO RECOVER THE DATA YOURSELF or with any of the following methods. Take is to a data recovery specialist and I don’t mean one of those geeks, squads, nerds or dogs, but rather someone who specializes in hard drive data recovery. I have sent a few clients to Disk Doctors which is a national chain but there are many other good ones out there. Keep in mind that it will cost you and could run $500 or more depending on the damage and how much data you need recovered, but if the data is irreplaceable, it may be well worth the price.

Having said that, if you have conceded to the fact that the data may be lost and you have no intentions of paying several hundred to maybe a thousand or more to recover the data then there are some things that you can try and you may just luck out and recover everything. I am assuming that you have the ability to connect the old drive to a working computer either by installing it inside as a slave drive or by using an external USB enclosure or adapter. You will also need enough free space on a working drive to save the recovered data to.

There are many types of hard drive failures and the exact method that may work depends on what is actually wrong with the drive. If the drive is mechanically Ok and is simply corrupted then a data recovery program can be just what the doctor ordered. I have tried many over the years and have had the best luck with SpinRite and GetDataBack. Depending on the size of the drive and how damaged it is, these programs will take many hours or even days to run. In some cases, simply running Chkdsk /r from your Windows CD Recovery Consol or Windows Error Checking from Windows can fix some problems, but it could also make things worse.

FREEZING THE DRIVE
You may get some recommendations regarding placing the hard drive in a sealed bag and leaving it in the freezer for several hours. This can work for some types of problems but I would only perform this as a last resort and only after trying positional changes first.

POSITIONAL CHANGE
I have often found that placing the drive in different positions can help. I have had drives that would read only when upside down or placed on their side.

OVERHEATING
If you get the drive to read, but starts to overheat while recovering the data, it can be very helpful to cool it down. I use a special hard drive cooler but I guess you could use an ice pack or fan (USE CAUTION) as long as you are extremely careful not to introduce any moisture, condensation or water which can destroy the drive. Do not apply anything to the circuit board side of the drive and do not block the air hole. Be extremely careful not to bump or drop the hard drive, especially while it is running.

GETTING PAST COPY ERRORS
If you get the drive working but start running into errors while copying the data, you might want to try a free program call "Unstoppable Copy" which will continue copying files even when it encounters a bad file. This can be real helpful especially for copying large picture or music folders that have a few corrupted files in them.

The moral of the story is, hard drives FAIL. They are one of the few moving parts in a computer and should be treated like the tires on a car. They spin, they wear out and they WILL fail at some point and it is just a matter of when. They should to be replaced on a routine basis and when they do fail, you better have a backup spare. If you don’t want to deal with creating and maintaining your own backups, then consider using an online backup such as Carbonite.com or Mozy.com.


Hi Chuck,

Tis doesn't look good. But from your description, since the failed drive would appear to be accessible, albeit unreadable, that would suggest that the damage is logical, rather than physical, such as a head crash. Most likely the MFT or FAT are corrupted (the tables that point to the files on the disk). The damage could have been done if the machine suffered a power drop or power spike, essentially, the drive drops power, a safety mechanism retracts the heads but they spill a few random bits over the drive as they retract. Or it may have been updating the FAT when a power event occurred. There are many possibilities.

This is when you realise that frequent backups are essential but we all forget to keep them up to date - mea culpa!

What can you do? Well, don't do anything that might write to the disk, though it may be too late for that. The professional data recovery companies are expensive and so the data has to be very valuable to you to use them and, as you say, beyond the means of most students. That doesn't mean you should rule them out completely, though. I've had some success with Kroll-Ontrack (look them up on the web for your location). Here in the UK, they have a help desk that we can call and discuss our problem with a technician for the cost of the phone call. They won't restore your data for that but they can suggest the options available to you - naturally, usually using their services! But if they say the data is likely unrecoverable, then it probably is. They also have (or had, I've not needed them for 18 months) a free downloadable analyser program that will scan the disk in question and, where possible, document the problems found and the likely chance of recovery.

You've tried some of the data recovery tools with no real success so far. You might want to try Partition Table Doctor http://www.ptdd.com/. Rather than look at the files, it works at the level of the control tables on the disk, MBR, Boot Sector, FAT, etc. They also used to have a free download of a scanner, which will scan the disk and highlight any errors but won't fix it unless you buy the product. But remember, this will only fix disk control table problems- if that rebuilds the file tables, all well and good but it may not. They are in the Far East, so some of their English is "imaginative"!

One other suggestion that I've used on corrupt disks is to boot a Knoppix Linux CD and see if it can find the files you are looking for. Knoppix is free for download and you can burn a bootable CD from the ISO file. On booting, Knoppix will mount any hard drives it finds as read only and clicking on the drive icon will open the drive directory. If there are any recognisable files, you can copy them to a USB key and then copy them back to your Windows system later. Linux identifies files by content, rather than filetype and can sometimes rescue files lost to a Windows system. It's a bit of a long shot, though.


and even more ways a hard drive could be corrupted. We currently only know two things about your daughter's drive - maybe three:

One, the operating system (Windows?) doesn't recognize enough of the disk structures to assign a drive letter. Two, it didn't make any unhealthy noises, but we can't assume that the platters are still spinning - unless, three, the use of your recovery tools is an indication that, sector by sector, portions of the disk are still readable.

Case distinction:

If the drive hardware is unable to read data off the platters - or even to spin them, then only the recovery labs can get anything off - maybe - by taking the drive apart and mounting your platters into another drive with working components. Very expensive and success will be qualified at best.

If the drive hardware can still read sectors - maybe not all of them - it is theoretically possible to piece the readable sectors together to rebuild the files that they belong to. When I say "theoretically" I mean that it can be extremely tedious to do this, involving lots of trial and error, and with some files it may not be successful at all. Back in the days of Windows 98 and FAT file systems I used to do this from time to time, writing small programs to scan the readable sectors for usable data, Today's Windows XP or Vista and the now prevailing NTFS file systems make this harder; on the other hand there are some tools around that can help. The file recovery programs you mention probably are that kind (I don't know these specifically).

I once used such an image file recovery program on a 2GB memory card from a friend's camera. It went on for about seven hours, but came back with just under 200 photos that otherwise would have been lost - from their first visit to a game park in Africa. The lesson I learned from that was that recovery can be a very slow process, but that is no indication that it is not working. So try those programs again and let them get on with it - on an old machine that you don't need for anything else for the duration. Another lesson I learned was that a few days later, when I wanted to repeat the effort to show my friend how it works the card wouldn't respond at all anymore, and never again did. This means that you don't have an unlimited number of tries, and you may want to perform a sector by sector backup of your drive before you try too hard to "scrape" data off it.

To sum it up: With Murphy's bad luck your drive is dead. But with a bit better luck only a few sectors are unreadable, some of which may be crucial for Windows to find things on your drive. In that case it is possible that you can recover some of your data - albeit with an effort. A good set of utility programs for this would help - some results can be achieved with a degree of slow (!) automation, and some more may be found by even more tedious manual activities - such as scanning all sectors for a text string that I expect to find in certain documents that I am particularly interested in; I may then get lucky piecing these documents together from the sectors surrounding the ones identified by the search. Sectors on our hard drives aren't allocated strictly sequentially, but there is a good chance that the sectors of a file are close together. You may also find several versions of a file, say the last three or four versions you saved.

Lastly, there is a chance that there is nothing physically wrong with the drive but a crucial sector was overwritten and the partitioning or the housekeeping section of your partition needs tweaking. In that case someone knowledgeable can - with the aid of a disk editor - patch things up and restore all back to health. Which would be an ideal moment to make that backup everyone will tell you you should have had in the first place.