Data Recovery Help Needed

Blue Banana

Member
Reaction score
3
Location
South Africa
I had this laptop come in this morning. Client said the Laptop froze and when she restarted, it threw the classic 'boot disk failure' message.

I slaved the drive, but Disk Management cannot initialize the disk - cyclic redundancy check failure.

EaseUS Partition Manager also gives me an 'unsupported disk' message. The program can't do anything with he drive, only a surface test, which comes up with one bad sector every second.

Live Disk also doesn't see the drive.

I already went through this post on the Microsoft Technet. I am not able to download Microsoft PE, though I doubt it will help, seeing as what I've already tried.

Anyone got any recommendations of software I could try? I am not too familiar with the best data recovery/imaging tools today.

Any other ideas/valuable input will be greatly appreciated.
 
How much is the data worth? If the client is serious about the recovery then it might be time to send it off to a data recovery company before things start to go downhill even more.

If you still want to try, I'd say probably the best thing you can do with the tools available to you is to load up a linux distro (such as System Rescue CD) and attempt to clone the drive using ddrescue.
 
The client works at a Law Firm, so I'd guess it is pretty 'expensive' data.

I'll see if the ddrescue idea will work, though I'm not sure if it will even recognize the disk.
 
Does the drive detect in the BIOS, can you read the model number (it's not just a bunch of crazy characters)?

If you grab a linux distribution and run the command:
Code:
sudo fdisk -l
(that's a lower case 'L'), then the system will list any detected disks.
 
If the data is that important best leave it to a pro otherwise you could cause more damage the longer you play with it.
That type of problem is due to problems with head it prob crashed on the platter.
 
you can try file scavenger i have had it work on a number of seemingly dead drives.i think you can download a free trial from their website and it will let you scan the drive but you will need to buy it in order to recover data. good luck
 
Perhaps it would be worth asking the client immediately about the value of their data before you make things worse and possibly render it unrecoverable...especially if they work at a law firm.

Never run a file system recovery program against a failing drive, unless you want to kill it. Always get a full sector-by-sector clone first, then run the file system recovery programs against the clone. Not only is it safer, it tends to be the faster route.

In this case, I'd suggest telling the client that if you carry on any further yourself, you may render the data unrecoverable and ask whether they wish you to send it off to a professional lab for assessment or if they want you to continue risking the fatal blow to your drive.

Another thing to consider is that most labs only charge if they are able to successfully recover the data. Are you willing to spend several days working on this project with a fairly high chance that you will not succeed?
 
Does the disk show up in device manager? Does it make any funny noises? Also I agree that you should ask the client how important this data is for the simple fact that running scans on the disk can make it worse and it may need to go out for data recovery.
 
Best to heed the wise words above by lcoughey… I agree completely.

If you can find out the drive's model number, I'll let you know what the common problems are with it (according to our data recovery database of past recoveries). This may help you get a better idea of what the cost to recover it professionally will be.

P.S. Thanks for the shout-out FoolishTech!
 
The important thing at this point is to manage the customers expectations.

"We can attempt to clone the data but there is a chance that doing this will make the problem worse and harder for a lab to recover the data should it come to that. If you don't wish to authorize this risk we need to stop now and ship it off, however the downsides to this is it will cost quite a bit more and will take more time to recover if it's at all possible."

Most people I would be fine with a verbal agreement on this, if you think he is sue happy (My lawyer clients are the least sue happy people in the world) get it in writing.

With that...

I'd use ddrescue on it and clone it to another disk (or to an image file stored on my server if I didn't have a disk handy right this moment).

If ddrescue can't get the data then it's time to ship it off.
 
Good point, just one note: at least with us (we aren't like most other data recovery companies), it will likely take much less time then trying it yourself. The tools we have specialize in recovering drives with bad sectors and will be significantly faster than any software tools you run in Windows or DDRescue or anything else, and will get back more bad sectors. It will likely be faster and more complete.
 
With every data recovery job I've ever had (bad sectors and all) I've never had it take longer then 18 hours; most (75%?) are done in less than 4.

Shipping time from East Texas ---> California alone would put you behind that.

My general rule, if it shows up in "fdisk -l" I'm willing to work on it, otherwise it's above me.
 
Last edited:
Damn shipping :D

Sometimes using software will take days or weeks or even months (it's rare, but sometimes even with our tools it could take a week+, but then those drives probably wouldn't have any luck with regular software tools).

IMO any drive that takes more than 24 hours with software is best left to professional tools since software tools can easily put excessive strain on a bad drive and kill it completely.

Right now I've been targeting the "important" files on a client's drive for the last 5 days (and will probably be a few more days). We'll likely recover 100% of the specified files (Desktop, Pictures, and Videos), but it is very slow (as the drive has a weak head). In this case, we already recovered all sectors from the 3 good heads, and are targeting only the most important files on the bad head. This way, our client will get 100% of the "most important files" they specified, and at least ~75% of everything else.
 
Damn shipping :D

Sometimes using software will take days or weeks or even months (it's rare, but sometimes even with our tools it could take a week+, but then those drives probably wouldn't have any luck with regular software tools).

IMO any drive that takes more than 24 hours with software is best left to professional tools since software tools can easily put excessive strain on a bad drive and kill it completely.

Right now I've been targeting the "important" files on a client's drive for the last 5 days (and will probably be a few more days). We'll likely recover 100% of the specified files (Desktop, Pictures, and Videos), but it is very slow (as the drive has a weak head). In this case, we already recovered all sectors from the 3 good heads, and are targeting only the most important files on the bad head. This way, our client will get 100% of the "most important files" they specified, and at least ~75% of everything else.

Gotta love the DeepSpar! Just got one myself last week because we've been seeing so many drives with bad sectors and weak heads... and with the flooding in thailand and poor manufacturing process I'm certain we'll be seeing a lot more!
 
It is incredible! But, there is lots to learn now… and knowing how to use the tools is the most important thing. Besides memorizing the manual, you should try to read every post on the deepspar forum.

*A month ago we had a drive from another company who also has a deepspar. They couldn't recover it (or at least not enough to be any use). We got back 99.9% of the entire drive using just the deepspar (I purposely didn't use PC3K just to see if my knowledge was the difference, in this case it was) :)
 
I would pass it on to a HDD specialist, as everybody else already suggested, a law firm with no back up of their data?, perhaps you could install a backup server or if they don't have that many works stations then install a backup HDD and software needed.
 
With every data recovery job I've ever had (bad sectors and all) I've never had it take longer then 18 hours; most (75%?) are done in less than 4.
For this to take place, you must be cutting corners and not cloning the drive first...and obviously getting very simple recoveries.

I wonder how the non data recovery pros can do data recovery faster and with a higher success rate than the pros.
My general rule, if it shows up in "fdisk -l" I'm willing to work on it, otherwise it's above me.
My general rule of thumb is that if you run "fdisk -l" on the original drive before securing a full clone, you are taking unnecessary risks with your client's data.
 
For this to take place, you must be cutting corners and not cloning the drive first

That is cloning the drive.

...and obviously getting very simple recoveries.

This is possible, and very likely.

I wonder how the non data recovery pros can do data recovery faster and with a higher success rate than the pros.

Must be nice knowing everything about every person you ever speak about.

My general rule of thumb is that if you run "fdisk -l" on the original drive before securing a full clone, you are taking unnecessary risks with your client's data.

Everything has a risk, if "safe" is a binary function than breathing is unsafe and you should stop now as a "breathing expert".

Assessing the situation through a tool that reads the partition table, and hard drives size descriptors through PXE booted environment is at minimum establishing the health of the drives data by testing to see if the partition table is readable. If it is not chances are the issue extends into the file table of the first partition which is essential in establishing your risk management plan for moving forward. The other tool I would use is to check the smart entries of the drive, chances are it can show how bad the situation is, but it's not something I entirely base my diagnostics around.

Each of these produces very little risk and possibly only 2 spin ups of the drive and produces enough evidence to know where to go from there even better if you have it set to post kernel messages to the console and can see hard/soft resets of the interface in real time. All this without mounting the drive and minimizing the risk while maximizing your diagnostic sense of the situation.

Cloning a drive without assessing the situation is silly. If the drive is at the point where fdisk -l may crash it my first instincts are to go after the essential data first with the tools at my disposal instead of running a full clone, which if "fdisk -l" is so detrimental to the drive a full blown clone would destroy the drive before any chance of getting that essential data off of it would occur.

Knowing the risk and making intelligent decisions on where to go from there is the professional way to go about business or any decision that requires risk management and customer expectations management. Blindly moving forward without knowing what you are up against with a mantra of "clone everything" is risking more then fdisk -l ever could and I find it silly a professional would pontificate such.

Thus: You are talking out of your fourth point of contact and should excuse yourself from this conversation until you realize you are not in a conversation with children whom you can scare with slogans ("If you haven't cloned it, you shouldn't be trying to recover from it.") or woo with your false sense of superiority.

Perhaps sticking to such hard rules as "Clone first zomg!" with such religious zealotry may explain your success rate being seemingly lower then this "non-pro" as you have tagged me; however, I think my success rate is knowing what fights to pick through risk management and educating my customers which leads to my data recovery work having a selection bias more towards the easier jobs.

Good day sir (or madam).
 
Last edited:
**If you don't want to read this whole post, at least read bold part at bottom***

FYI Techs:
Today was the first day that I'm quite sure "hooking up a bad drive to a Mac" (Mac in this case), destroyed a drive's data. It very well happened before this, but this is the first time it can be the only explanation (at least at this point).

Here's the story:
A guy with a computer shop sends me drives for recovery often. Today we got one in that came from a MacBook. We followed the typical routine: disabled "autorelocation" in drive's firmware (a necessary "safe" precautionary step with Hitachi drives), cloned 100% of the drive using DDI, then connected to Mac to run Data Rescue 3 on the drive. This should have been an easy 100% recovery. Instead, only a damaged bootcamp partition was recoverable (after another scan using RStudio). Nothing from the Mac partition was recovered.

I asked my client what his client did before bringing the drive to him. Did he format the drive? Did he secure erase some of the data? What happened?

Answer: his client did nothing to the drive. He (my client) says he only removed the drive from the Mac and connected to his Mac. He saw the bootcamp partition, but the Mac partition wouldn't mount.

After my 100% clone, nothing was mounted… not bootcamp, not Mac, nothing. Since the drive's condition worsened since he connected it to his Mac (since now it's not mounting anything), and the drive itself was not physically damaged in any way (no mechanical or sector issues), it stands to reason that connecting it to his Mac was the cause of the problem.

I've said it before, but I'll say it again (this is what I told him also):

Ok, it sounds like your Mac tried to repair the drive in the background. At this point, the drive doesn't mount at all (the original or clone) on our Macs. No bootcamp or any other partition is visible from Disk Utility (just the name "Hard Drive" grayed out). So, sometime from when you first connected to the Mac and now, the condition has worsened. I think this (Mac trying to repair corrupt partition in background) is the only explanation.

In the future, if you must connect to a Mac before cloning it (which you should never do, though it's understandable if it's your only option), first open Activity Monitor. In the search box type "fsck" to filter out only that process. Then connect the drive. If you see "fsck" process starting, immediately force quit it. This will stop the Mac from attempting to repair the drive and hopefully avoid this problem again in the future.

This is just one example of why it's so important to clone a drive before working on it (BEFORE connecting to your Mac or PC).
 
Back
Top