Go Back   Technibble Forums > General Computers > Tech-to-Tech Computer Help

  Technibble Sponsor

Reply
 
Thread Tools Display Modes
  #1  
Old 03-30-2011, 07:45 PM
Appleby's Avatar
Appleby Appleby is offline
 
Join Date: Jan 2010
Location: Texas
Posts: 1,290
Appleby is on a distinguished road
Default Dying HD with severe infection...data recovery question

Ok guys I need some advice. Customer has a 7 year old Dell desktop that they are ready to replace. The hard drive will no longer boot so they ask me to see if I could recover their photos from it. I attempt to run SpinRite on the drive, just see what condition its in...the drive can't even be found my SpinRite, but it is spinning, so I'm hoping data recovery is possible. I use my IDE to USB cable to connect it to my bench computer....drive is found, contents of drive open and BAM...Kaspersky pops up red alert..the slaved drive has infected my bench machines. I unplug the slaved drive and start assessing my bench machine. Seems it was a bad trojan and Kaspersky had been scanning the slaved drive (for just a few seconds) and had found tons of severe infections. So I know I've got a very badly infected machine.

My bench machine is clean again, but I'm not sure where to go from here. I'm 99% sure I can get the data off but I don't want to infect my machine so I'm not sure what to do. Thoughts?
__________________
Simply let your 'Yes' be 'Yes,' and your 'No,' 'No'; anything beyond this comes from the evil one. - Matthew 5:37
Reply With Quote
  #2  
Old 03-30-2011, 07:55 PM
Skyhooker's Avatar
Skyhooker Skyhooker is offline
 
Join Date: Aug 2008
Location: Dundee, Illinois
Posts: 783
Skyhooker is on a distinguished road
Default

You could either disable autorun on the host machine you're slaving the drive to, so that no trojans execute, and make sure you're only copying over JPEGs, for example, or boot into a Linux distro - my favorite is Knoppix for things like this - and only copy his pictures folder to your backup drive. You could then scan the backup drive with your favorite AV just to make sure.

I always have my bench machine imaged so I can restore a clean installation within minutes in case something slips through.
Reply With Quote
  #3  
Old 03-30-2011, 07:55 PM
Martyn's Avatar
Martyn Martyn is online now
Administrator
 
Join Date: Apr 2010
Location: Bedfordshire UK
Posts: 5,511
Martyn has a spectacular aura aboutMartyn has a spectacular aura about
Default

I'm thinking get the image onto another decent hard drive then scan that drive slaved. Recently I had a similar situation and I wanted to get the data with infections onto my main computer. I used Acronis True Home and imaged it and I was surprised to find the infections stayed in the image and wasn't detected by Kaspersky. I then extracted it to another drive, slaved it and scanned it saving the data.
Reply With Quote
  #4  
Old 03-30-2011, 08:00 PM
iisjman07's Avatar
iisjman07 iisjman07 is offline
 
Join Date: Jul 2009
Location: South End Of The UK
Posts: 3,049
iisjman07 has a spectacular aura aboutiisjman07 has a spectacular aura about
Default

Two things are screaming at me:
1) USB adapter for data recovery = . You should really plug the drive directly into the motherboard to increase your chances of data recovery

2) The drive smells like it's badly infected; use a linux live cd to copy the files across. Linux should be completely un-phased by the most severe infections. Copying the files should be easy even if you're not a linux person, you can just use a nice GUI to copy the photos across to somewhere else by dragging and dropping. If you want a couple of suggestions for nice gui-linux repair distros I'd recommend using puppy linux or ubuntu, but System Rescue CD is a very nice solution if you know a bit of bash.

Once you've copied the folder with the photos in it, scan it on your bench machine or using a live cd if you're hesitant to plug it into your pc again.
__________________
put that in your pipe and grep it

Last edited by iisjman07; 03-30-2011 at 08:03 PM.
Reply With Quote
  #5  
Old 03-30-2011, 08:01 PM
Appleby's Avatar
Appleby Appleby is offline
 
Join Date: Jan 2010
Location: Texas
Posts: 1,290
Appleby is on a distinguished road
Default

Thanks guys. I did turn autorun off which I didn't even realize was still turned on?! And yes all I'm wanting is JPEGs, so I'm tempted to double check autorun is off and rolling the dice again....

The real issues is I don't want to spend a ton of time here because the customer isn't going to pay for it...they want the pictures if I can get them cheaply, if not, they said forget it. If I get into imaging it and such then obviously my time/cost goes up. This is supposed to be a quick fix or no fix.

I'm thinking no autorun and gambling...
__________________
Simply let your 'Yes' be 'Yes,' and your 'No,' 'No'; anything beyond this comes from the evil one. - Matthew 5:37
Reply With Quote
  #6  
Old 03-30-2011, 08:05 PM
iisjman07's Avatar
iisjman07 iisjman07 is offline
 
Join Date: Jul 2009
Location: South End Of The UK
Posts: 3,049
iisjman07 has a spectacular aura aboutiisjman07 has a spectacular aura about
Default

You could install Returnil Virtual System on your bench machine, grab the files and pick up any infections there may be, but then reboot to remove infections on your bench machine. You could set it up in about 5 minutes
__________________
put that in your pipe and grep it
Reply With Quote
  #7  
Old 03-30-2011, 08:13 PM
Frank's Avatar
Frank Frank is offline
 
Join Date: Dec 2010
Location: San Francisco Bay Area, CA
Posts: 219
Frank is on a distinguished road
Send a message via Skype™ to Frank
Default

Can you boot to PE on your bench machine and do the transfer there?

Last edited by Frank; 03-30-2011 at 08:31 PM.
Reply With Quote
  #8  
Old 03-30-2011, 08:30 PM
paristotle's Avatar
paristotle paristotle is offline
 
Join Date: Feb 2011
Location: Montreal
Posts: 155
paristotle is an unknown quantity at this point
Default

+1 for the PE. There is a good free one. Ultimate Boot CD 4 Win.
__________________
Reply With Quote
  #9  
Old 03-30-2011, 08:47 PM
MobileTechie's Avatar
MobileTechie MobileTechie is offline
 
Join Date: Oct 2009
Location: UK
Posts: 4,249
MobileTechie has a spectacular aura aboutMobileTechie has a spectacular aura about
Default

As long as autorun is disabled then you're safe.
Reply With Quote
  #10  
Old 03-30-2011, 08:52 PM
dbdawn dbdawn is offline
 
Join Date: Jan 2010
Posts: 925
dbdawn will become famous soon enough
Default

If all they want is pictures I would use a PE disk or a Linux live CD.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 04:02 PM.


Powered by vBulletin®
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Technibble.com is based out of MELBOURNE, AUSTRALIA.