| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 64569 | 2005-12-19 21:51:00 | Data Recovery & Unmountable Boot Volume | photosytes (9449) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 414038 | 2005-12-19 21:51:00 | I've read all of the suggestions concerning fixing an unmountable boot volume in Windows XP . My concern is retrieving the data from my drive . I have some data that wasn't backed up that I need to recover if it's at all possible . That is my first priority . I don't want to try anything if it might make that forever inaccessible . So, I boot up to that error . No new software or hardware has been installed . New cables have been tried . The settings are the same as usual . When I installed the drive on another computer, as a slave, it shows the hard drive, all the tech info and drive size . Shows it as 100%, no file system listed, it's Healthy(Active) . When I try to look at its contents, Windows tells me it isn't formatted . What can I do to try to recover the data that I need? What won't make it inaccessible? (I know that fixing the mbr in recovery will definitely make the data inaccessible, correct? What about fixboot? Or chkdsk /r? Please help! |
photosytes (9449) | ||
| 414039 | 2005-12-19 22:35:00 | I'd give something like Knoppix as a recovery CD (www.shockfamily.net) a go and see if you can actually read it. then you could give testdisk (www.cgsecurity.org) a go. and then I guess you could go for chkdsk Of course, a run through of the manufacturers diagnostic tools to tell you if the drive is physically defective is a good idea. |
gibler (49) | ||
| 414040 | 2005-12-19 22:46:00 | If it's really important, you might consider using Symantec's Ghost to duplicate the hard drive's contents before you attempt any repair. It sold seperately, or bundled with System Works. There's a "forensics" command line switch that will even copy data that's not in use. This is probably a good idea on the chance your NTFS table has gotten a bit scrambled. |
kingdragonfly (309) | ||
| 414041 | 2005-12-20 01:46:00 | It looks as if more than the NTFS "tables" have been scrambled . The partition table is gone . What sort of data are you looking for? Plain text might not be too "impossible", if you know some likely strings which occur in the files . *nix has a command dd which will copy from a disk (with no nonsense like file systems, partitions, etc) . Boot a Knoppix live CD and start a terminal screen . This command will find the string "known string" if it exists in the first 10000 blocks on the disk . dd if=/dev/hda count=10000 bs=512 | grep -i "known string" . "man dd" to Google will find the instructions . Once you've found an area to concentrate on, you can set a "skip" and "count" and write to a file (e . g . of=/tmp/afilename . extension) on another disk . The "if=/dev/hda" means "input file (if) is the whole device -- the first IDE disk in this example . |
Graham L (2) | ||
| 414042 | 2005-12-20 03:24:00 | A hex search would be pretty desparate, and unless the hard drive has been recently defragmented would probably be less than effective . Anyhow, you can Ghost clone a disk even if it's MBR is scrambled, by using the "forensics" switch . It's original purpose was for police use . Of course, there's better software than Ghost available now for law enforcement . |
kingdragonfly (309) | ||
| 414043 | 2005-12-20 03:48:00 | Who's talking about a "hex search"? I'm suggesting a text search for text files . As for "desperate": the data are lost at the moment . Windows won't help . I'm suggesting a realistic method for finding text by searching for known (or even guessed) strings . With fast drives and computers it's not even very slow . Fragmentation is a red herring . The allocation units are fairly big . Either this will get some useful files with a reasonable amount of work or it won't . It's worth a try . A Ghost "forensic" copy may be a wonderful thing . That will give two disks with inaccessible data . What's the questioner going to do with a matched pair? :groan: |
Graham L (2) | ||
| 414044 | 2005-12-20 04:53:00 | had the exact same thing happen to me, i used a program called "getdataback for ntfs" (yes thats its actual name) took about 15hrs or something to scan my 120gb drive and recovered basically all the files on it. however it costs quite a bit to purchase. |
Talon (2871) | ||
| 414045 | 2005-12-20 05:10:00 | as gibler mentioned, I would try booting off a knoppix cd first. would only take a couple of minutes, and may work. (4.95 from DSE) | dbs (8785) | ||
| 414046 | 2005-12-20 12:56:00 | Most of the files I need to save are images, photoshop files, graphics. That's what he does for a living and has quite a bit of work stored on that computer. He doesn't care if the hard drive dies right after the work is recovered and I don't want to accidently make the situation worse. At this point there is absolutely nothing that is accessible and if he was an average user I would tell him he is out of luck and it isn't worth the time or money to recover any data. I don't usually do that kind of work, so I'm a little out of my element, but there isn't a company in town that does do it. |
photosytes (9449) | ||
| 414047 | 2005-12-20 16:59:00 | i'd suggest you need someone to slave the drive to a pc and run a 'raw' recovery process on it.....if you know a shop/tech/friend/whoever who has a copy of powerquest 'easy recovery' that should recover pretty much anything that is on the drive. bit of a google may throw up some free program that does a similar job...... | drcspy (146) | ||
| 1 | |||||