May 9th, 2006, 09:15 AM
Wasn't sure whether this is the right place, but what the hey. Mods, please feel free to move the thread if that's appropriate. Well, here goes...
A friend of mine who works for an architectural firm recently told me that the partition (not the hard disk itself) containing about a year and a half worth of drawings suddenly disappeared after a power failure. The boss is willing to pay an obscene amount of money to get that data back (which obviously got me interested). Now, he's already given it to two data recovery companies and they've said that they can't do it. However, my experience with local data recovery companies has been that they're quite shitty and rely on a single tool that may or may not have the features required to recover that particular client's data.
Also, from my experience with power failures, I believe the most likely problem (since the other partitions on the hard disk still work) is corruption of the partition table. My approach is probably going to be something like this:
1. Get the hard disk and another identical one (same make, model, capacity) from the client.
2. Boot into linux (from a 3rd hard disk or a live cd) and dd everything over from one drive to the other. Now I don't have to worry about fux0ring the client's data.
3. Run some sort of a partition discovery program and get the offsets for the partitions.
4. Enter these into fdisk to recreate the partition table.
5. Recover any data.
However, since the data recovery firms gave up (and I can't believe they'd be incompetent enough to not be able to rebuild a partition table), I'd like an idea of what else could go wrong with a hard disk after a power failure that would cause it to lose a partition and possible strategies for recovering the data. Also, I lost pretty much my entire toolkit in the great hard disk crash of 2006 (go figure!), and I haven't done this in a while (last time was in a similar situation, but with my personal hard disk and that was a good 3 years or so back. I think I made a post in the forums about it somewhere), so I'd like some tool recommendations. You are welcome to point me to another thread with tool listings, since I can't seem to find hogfly's forensic toolkit thread.