Page 1 of 2 12 LastLast
Results 1 to 10 of 18

Thread: Data Recovery

  1. #1
    Antionline Herpetologist
    Join Date
    Aug 2001
    Posts
    1,165

    Data Recovery

    Hey all,

    Wasn't sure whether this is the right place, but what the hey. Mods, please feel free to move the thread if that's appropriate. Well, here goes...

    A friend of mine who works for an architectural firm recently told me that the partition (not the hard disk itself) containing about a year and a half worth of drawings suddenly disappeared after a power failure. The boss is willing to pay an obscene amount of money to get that data back (which obviously got me interested). Now, he's already given it to two data recovery companies and they've said that they can't do it. However, my experience with local data recovery companies has been that they're quite shitty and rely on a single tool that may or may not have the features required to recover that particular client's data.
    Also, from my experience with power failures, I believe the most likely problem (since the other partitions on the hard disk still work) is corruption of the partition table. My approach is probably going to be something like this:

    1. Get the hard disk and another identical one (same make, model, capacity) from the client.
    2. Boot into linux (from a 3rd hard disk or a live cd) and dd everything over from one drive to the other. Now I don't have to worry about fux0ring the client's data.
    3. Run some sort of a partition discovery program and get the offsets for the partitions.
    4. Enter these into fdisk to recreate the partition table.
    5. Recover any data.

    However, since the data recovery firms gave up (and I can't believe they'd be incompetent enough to not be able to rebuild a partition table), I'd like an idea of what else could go wrong with a hard disk after a power failure that would cause it to lose a partition and possible strategies for recovering the data. Also, I lost pretty much my entire toolkit in the great hard disk crash of 2006 (go figure!), and I haven't done this in a while (last time was in a similar situation, but with my personal hard disk and that was a good 3 years or so back. I think I made a post in the forums about it somewhere), so I'd like some tool recommendations. You are welcome to point me to another thread with tool listings, since I can't seem to find hogfly's forensic toolkit thread.

    Cheers,
    cgkanchi
    Buy the Snakes of India book, support research and education (sorry the website has been discontinued)
    My blog: http://biology000.blogspot.com

  2. #2
    Did someone said Pizza :) FanacooL's Avatar
    Join Date
    Oct 2004
    Location
    Karachi , Pakistan
    Posts
    466
    Hi cgkanchi

    Well I need to know one thing are you able to access that hard disk or not, i mean i have experienced in the past after power failure hard disk have stop getting detected like totally dead ...... Even in that scnerio I was able to get the data back although i did't get it back myself, one of our consultant receoverd ir for us, something like getting data from the media. As per them they open the harddisk physically on a special machine get the data from the media and copy it to the new drive....... and they charge huge price for this rate is on the amount of data.... Anyways this was the last option available for me. Hope you get it back yourself

    Detail
    http://www.antionline.com/showthread...hreadid=268844
    One machine can do the work of fifty ordinary men. No machine can do the work of one extraordinary man!

  3. #3
    Greeting's

    havent used it but you can try :

    http://www.lnx4n6.be/index.php?sec=D...ds&page=bootcd
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  4. #4
    Antionline Herpetologist
    Join Date
    Aug 2001
    Posts
    1,165

    Well I need to know one thing are you able to access that hard disk or not, i mean i have experienced in the past after power failure hard disk have stop getting detected like totally dead ......
    Ummm..., you obviously didn't read my post properly, since on two separate occasions, I specifically say:

    A friend of mine who works for an architectural firm recently told me that the partition (not the hard disk itself) containing about a year and a half worth of drawings suddenly disappeared after a power failure.
    Also, from my experience with power failures, I believe the most likely problem (since the other partitions on the hard disk still work) is corruption of the partition table.
    Please read the post properly before contributing, the reason I write specific posts is because I want specific answers. Sorry if I sound a bit abrupt, but I'm not in a very good mood at the moment.

    Cheers,
    cgkanchi
    Buy the Snakes of India book, support research and education (sorry the website has been discontinued)
    My blog: http://biology000.blogspot.com

  5. #5
    AOs Resident Troll
    Join Date
    Nov 2003
    Posts
    3,152
    Well I just had this problem last week and was able to recover all data with this tool

    http://www.ontrack.com/easyrecoverydatarecovery/

    I had slaved the drive into a windows machine......but both partitions were not accessable.
    I downloaded the trial of this tool and tried......it worked. Read files from both partitions

    Need to purchase to recover the files...199 usd

    Worth a try??

    MLF
    How people treat you is their karma- how you react is yours-Wayne Dyer

  6. #6
    Did someone said Pizza :) FanacooL's Avatar
    Join Date
    Oct 2004
    Location
    Karachi , Pakistan
    Posts
    466
    Must have overlooked the lines..... Sorry for this
    One machine can do the work of fifty ordinary men. No machine can do the work of one extraordinary man!

  7. #7
    AO Guinness Monster MURACU's Avatar
    Join Date
    Jan 2004
    Location
    paris
    Posts
    1,003
    used this last time i had a problem with a partition table. About a month ago.
    test disk It worked for me. We recovered a linux drive slaved to a windows machine. There also linux versions of the tool on the site. another advantage is it is open source so completely free.

    I would also on general pricinples make an image of the disk.
    \"America is the only country that went from barbarism to decadence without civilization in between.\"
    \"The reason we are so pleased to find other people\'s secrets is that it distracts public attention from our own.\"
    Oscar Wilde(1854-1900)

  8. #8
    Antionline Herpetologist
    Join Date
    Aug 2001
    Posts
    1,165
    Well I just had this problem last week and was able to recover all data with this tool
    http://www.ontrack.com/easyrecoverydatarecovery/
    I had slaved the drive into a windows machine......but both partitions were not accessable.
    I downloaded the trial of this tool and tried......it worked. Read files from both partitions
    Need to purchase to recover the files...199 usd
    Worth a try??
    Yeah, probably worth a try, if only to tell me that the data is there. 199 USD is a bit steep for me, but let's see.

    used this last time i had a problem with a partition table. About a month ago.
    test disk It worked for me. We recovered a linux drive slaved to a windows machine. There also linux versions of the tool on the site. another advantage is it is open source so completely free.
    Thanks, that might turn out to be just what I need. Yeah, imaging the hard disk is a good idea. Since it's a 200 gb hard disk, I'm asking the client to provide me with another one, which I'll return to him when I'm done.

    Oh, and another thing, what kind of damage can a typical botched data recovery do if the hard disk hasn't been imaged? I ask because he's already given it to two different firms, and I might have to correct their mistakes.

    I'm pretty much the last thing he's trying before consigning the disk to the bin, so I'd like to try and do a good job.

    Cheers,
    cgkanchi
    Buy the Snakes of India book, support research and education (sorry the website has been discontinued)
    My blog: http://biology000.blogspot.com

  9. #9
    AOs Resident Troll
    Join Date
    Nov 2003
    Posts
    3,152
    They have a lite version....guess it depends on how many files you have

    The lite version allows for 5 recoveries...only 25 files each though.

    The Data Recovery standard allows for 20 recoveries...no file limit.

    Was worth it for us....seeing user store all data on local drive...last backup to the server was over a year ago...figure 2 weeks to recreate...or 199 usd...and a great tool to use again ......as I have many a laptop come in competely f**ked and all data is local.

    BTW...looks like it only works with windows partitions

    HTHs

    MLF
    How people treat you is their karma- how you react is yours-Wayne Dyer

  10. #10
    AO Curmudgeon rcgreen's Avatar
    Join Date
    Nov 2001
    Posts
    2,716
    Since the other partition(s) on the disk are still good,
    it shouldn't be too hard to recreate the partition with
    fdisk, since the dimensions are fairly clear based on
    the other good partitions. Use a copy, like you said.
    Put it in another box, and play with fdisk. Maybe a Linux
    box, since its fdisk is more versatile than Windows.
    I came in to the world with nothing. I still have most of it.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •