Need to recover Data from NTFS (test..I think you can edit titles)

http://www.ocforums.com/showthread.php?t=531513

Basically I've got a hard drive here. NOt 100% sure what happened, but the "boot sector" (MBR??) got erased, windows rewrote it. It didn't get formated, but there is no data now. Linux loads fine and reads the drive, disk check tells me there are bad sectors. I made an image of the drive, and got ~15-20 gigs that were no good due to bad sectors. I need to rey and recover the data though. Only programs I know of recovering data are in Windows and when I try to boot into windows, the computer gets stuck at the loading screen, and if I try to hotswap, plug it in after windows starts, then my computer crawls to a halt.

So any ideas? Any Linux recovery software?

What I would try is a linux liveCD and see if I can use that to get it off. The newest version of ubuntu has NTFS write enabled so I would boot into that and mount both partitions and then copy everything form you linux to your windows just to make sure your data is safe.

Then I would try reinstalling grub.

TalRW said:

What I would try is a linux liveCD and see if I can use that to get it off. The newest version of ubuntu has NTFS write enabled so I would boot into that and mount both partitions and then copy everything form you linux to your windows just to make sure your data is safe.

Then I would try reinstalling grub.

Click to expand...

Ah, I think you miss understood. My computer is fine. The hard drive is a drive from my friends wife's computer. Its a second hard drive. I mounted it in Gentoo using the plan NTFS driver and the ntfs-3g driver. Both times when I mounted the drive it told me the drive was empty. df told me that the drive was 100% free. The only folder on there was the one for System Volume Information. The drive was not formated..where did the data go?

anyone?

Unless you know how to manually rebuild the partition table. You are going to have a really hard time saving the data on the drive. It is not lost though. Any bits and bytes are still sitting there waiting to be looked at by you.

Data does not magically get erased, even during a format. You have to write over that data to lose it. Or move it around before or after the format(read; defrag).

That is when any data starts or is not able to be recovered. Some recovery software has good enough math where it can guess to a good degree, even then it can only do so much..

I don't know if Wine or its cousins will allow you to run a Windows based data recovery suite or program in Linux.. Might be worth a shot.

Enablingwolf said:

Unless you know how to manually rebuild the partition table. You are going to have a really hard time saving the data on the drive. It is not lost though. Any bits and bytes are still sitting there waiting to be looked at by you.

Data does not magically get erased, even during a format. You have to write over that data to lose it. Or move it around before or after the format(read; defrag).

That is when any data starts or is not able to be recovered. Some recovery software has good enough math where it can guess to a good degree, even then it can only do so much..

Click to expand...

Well I have no clue how to manually rebuild a partition table, but I'll google it .

Do you know of any of this recovery software for Linux? I know of several Windows recovery software, to get data but none for Linux. Thats my main issue I can't find any for Linux.

Might be worth a shot to run wine for this attempt. Then use Windows software in that. What I would be trying. Since it chokes the hosting machine up in other cases. The bad sectors are going to be the hard part to get data off of. That part might be gone.

For some reason WINE doesn't work with most of them. I think its a permission error where WINE doesn't have access to see the other hard drives physically..only has directories.

Anyway I've stumbled across testdisk. Its an awesome little program, and Its detected the partition. Now the only problem is it has a bad boot sector. So I tried to rebuild it with the program, but it keeps just telling me its not a valid boot sector. Any idea what to do?

The only other thing I could think of is the files are hidden. Did you try Crt+H? While in Linux.

Another option could be to boot the drive with BartPe and see if any of them tools will help you out.


Also:

Does it boot into Safe Mode?
Do you have a install disc to do a repair install or use the tools to do a full chkdsk.?

Enablingwolf said:

The only other thing I could think of is the files are hidden. Did you try Crt+H? While in Linux.

Another option could be to boot the drive with BartPe and see if any of them tools will help you out.


Also:

Does it boot into Safe Mode?
Do you have a install disc to do a repair install or use the tools to do a full chkdsk.?

Click to expand...

Just hit me will ya. I was using the beta version of testdisk. I went and used the stable version. It rebuilt the boot sector, and repaired the MTF enough for windows to realize it was a NTFS partition. Then windows used chkdsk to correct the partition and make it usable. Testdisk repairs it just enough for windows to finish the job.

So now the drive has a valid NTFS partition again. Only problem, is the partition is blank, no data what so ever. PC Inspector, which has recovered data for me before in windows says there are no files to recover...so now that I have the partition back, I just need to get the more important files back!

Now boot it in a Windows install and use recovery software. As much as I would like to pass along a tid-bit using Linux. I have yet to find one for you or know of one.. Even something for myself. If you do find one. By all means please pass that info on to me.

The data is there long as you do not write over it. So keep hope it is not destroyed. Just yet anyways. Depends what part that bad sector was.

check disk is useless in this case, please don't bother with it. it will take days on a dying drive. Get a copy of ghost boot floppy try to ghost the hard drive to another drive. (i know you tried a clone, try ghost, we use it at work for a very long time and have a very high success rate).
Also to boot into a windows computer in safe mode, see if it still hangs. Our copy of PE at work has ghost built into it, you can try that, or try a getdataback/rstudio in PE.

I would also advise to try another machine, we had cases were get databack was unsucessful with the newer faster computers, but they worked with in older p4 machines. Make sure nothing else other than the get data back software is running while your doing it. And DO NOT touch the machine At all while its getting the databack.

Since the MFT is blown out. How is Ghost going to help besides make a copy of the drive.. I know it is a good app. What if it relies on the MFT to catalog the data? I am not all that hip on Ghost. I used other apps instead and hardware based solutions.

If you can get any shell or OS to recognize the MFT you can get the files to show. Then move them over to a safe spot.

That is the secret to most data recovery softwares. It makes a virtual MFT and allows data to be seen and recovered.

Here is what the MFT is:
http://www.pcguide.com/ref/hdd/file/ntfs/archFiles-c.html

I don't think I've ever come across a HD recovery utility that runs under linux My best advice would be to either take the drive out and recover it from a Windows box that you could install a utility to, or build/burn UBCD4WIN (or use BartPE if you have it -- they're roughly the same thing). UBCD4WIN includes some HD recovery utilities, though I've never used any of the ones it has--you can always download and install something something like R-Studio from within the environment though (I've always had great luck recovering data with R-Studio, though it isn't free...)

JigPu

As I recall this distro had lots of tools to use on it -> http://distrowatch.com/table.php?distribution=phlak


Might be of help? Might not.

If you have bad sectors, you should run the hard drive diagnostic that is provided by the manufacturer and see if it is able to recover from the bad sectors. I have run several successful sector repairs for various hard drives.

In all cases, the computer would not boot, then upon running advanced hard drive test and sector repair, the hard drive was able to boot windows like nothing was wrong.

VinnyTAMU said:

If you have bad sectors, you should run the hard drive diagnostic that is provided by the manufacturer and see if it is able to recover from the bad sectors. I have run several successful sector repairs for various hard drives.

In all cases, the computer would not boot, then upon running advanced hard drive test and sector repair, the hard drive was able to boot windows like nothing was wrong.

Click to expand...

Well I tried that, and wow oh wow the samsung software was horrible! It was timming out on every single head. But before it would time out the whole system was locked up! It took forever for me to be able to hit the cancel button!

I ended up making an image of the partition using dd_rescue and it was able to recover all but 9gigs of the 160 gig partition. I know the hard drive is dying and has bad heads so I was surprised dd_rescue was able to recover so much. Then I've used foremost (v1.5 from portage) to recover the actual data. The problem is though it seems to fail at ~23 gigs of data. First time I got a segment fault, second time it said it couldn't read a file, third time it just stopped and exited. So I'm not sure whats up there.

The second thing is that the main thing my friend wants is his contact list from outlook express. The problem is this is stored in a csv, comma separated values, file and foremost isn't programed to recover that file. For that matter it isn't programed to recover txt files either. I tried googling it but I'm lost on how to edit the config file of foremost and make it look for the file. Anyone know how?