problems after running chkdsk

[CybertecOne]

I do mostly field work and some clients can be hesitant about sensitive data, especially acct'ing, being copied over to one of my laptops. So I use bootdisks and usb drives to do backups generally, then run chkdsk in an attempt to prepare the file system for ghosting. Reinstalling from scratch is less profitable from my standpoint and I get less whining if I manage to restore the computer to it's former state.

The bulk of my work is also onsite, however when it comes to sensitive data, company secrets or banking details on a failed hard drive - My clients are not concered with what I am going to do with the information least of all copy it to my computer for recovery.... In fact they would encourage me to do anything i can to recover said information - Perhaps people in Australia trust too much... ?

Although, I couldnt imagine being in this field without my clients having trust in my professionalism or skills.

[brokencrow]

My clients are not concered with what I am going to do with the information least of all copy it to my computer for recovery.... In fact they would encourage me to do anything i can to recover said information - Perhaps people in Australia trust too much... ?

Although, I couldnt imagine being in this field without my clients having trust in my professionalism or skills.

It's pretty much the same here in the States. Most clients are very
trusting, especially the long-standing ones. OTOH, there's a lot of
control freaks out there. The main reason I prefer to keep a client's
data onsite and off my equipment is I don't want to be responsible
for it offsite. Which I am essentially if I've copied it to my laptop(s).
I just don't think it's a good practice.

That reminds me, I've got to delete an image I copied last week. Chit,
I hate taking data offsite.

[CybertecOne]

The main reason I prefer to keep a client's
data onsite and off my equipment is I don't want to be responsible
for it offsite. Which I am essentially if I've copied it to my laptop(s).
I just don't think it's a good practice.

Haha, Yes. I can imagine many occassions where i have asked for someone NOT to leave me in a room by myself, for the only reason is to remove myself from suspicion in case something goes missing or is stolen.

My reputation is too important to me, and if all it takes is to kindly refuse keys and alarm codes to the premise, or ask to be accompanied in a secure area - then that is much easier than being the "Trusted" person who may have stolen something or interfered in something.


CTO

[nihil]

Interesting.

When it comes to chkdsk, I tend to regard it as a simplistic file system recovery tool.

1. It is not a data recovery tool.
2. It does not "repair" a drive; simply marks sectors as unusable.
3. It requires Windows, and is influenced by the file system in use.

Please also remember that there is more than one version of NTFS

Some of you might remember that I got hold of some cheap OEM Vistas a little while back, and built a couple of machines to try it out. I used old technology parts to see what issues there were.

I discover to my horror that it (full) formatted and loaded onto a 60MB "deathstar" that chkdisk and myself had pronounced dead (I had been drinking, and picked the wrong one up). Chkdsk and manufacturer's tools now think that the drive is just fine, and it has been running for several months.

My suspicions are that Vista uses the latest NTFS an zero fills the drive first ("full" format). I suppose that I might have had a similar result if I had used something like Darik's Boot & Nuke to wipe the drive?

[CybertecOne]

I imagine the future will lead technology away from moving parts, and more into solid state storage.

No fans, no bearings .... no SUDDEN problems..... and when something breaks, it will all be connected circuit boards which you can snap out and replace 1 component of :P

We can dream cant we .... hehe

CTO

[brokencrow]

When it comes to chkdsk, I tend to regard it as a simplistic file system recovery tool.

That's the beauty of it, yes?

1. It is not a data recovery tool.
2. It does not "repair" a drive; simply marks sectors as unusable.
3. It requires Windows, and is influenced by the file system in use.

So, if chkdsk marking a sector unusable and moving the data on that
sector to another is not a drive "repair", what is it? Is a file sytem
recovery ALTOGETHER different than a data recovery?

Case in point, one of the HDD's I was dealing with last week was hanging
on a 1.5 GB outlook.pst file. The computer ran fine until the user would
open Outlook. We were unable to copy the PST or ghost the HDD because
of a read/write error. Outlook opened the PST, albeit it very slowly, and
then it hung on a cyclical redundancy error when going to the Deleted
folder. Obviously there were problems with the drive. Chkdsk marked
the bad sector finally and moved the portion of the outlook.pst file to
another sector. After that, the PST was readable enough to copy and
the drive was ghost-able.

So that's not a data recovery? Or a drive repair? Sheesh, I need to
make things sound more complicated. I could charge more money.

[Linen0ise]

Don't you hate it when windows or linux is unable to recover a FAT32 or NTFS partition but when you decide to reimage the HDD, the image software keeps rebooting. Explain that to a customer, they damn you and swear you're satan himself. Next they call your boss and your boss looking at you like a Jew ready to crucify Jesus again.

[nihil]

So that's not a data recovery? Or a drive repair? Sheesh, I need to
make things sound more complicated. I could charge more money.

Yes you do, it would also help protect your professional credibility, I would have thought. You should never promise that you can do something without being pretty much certain, and discussing the options with the customer.

Consider these scenarios:

1. Customer formats hard drive.
2. Customer deletes important files by accident.

chkdsk will do absolutely bugger all to recover the data (but I have plenty of tools that will sort the problem)

3. The drive is deteriorating and suffering physical damage but will still spin.

chkdsk will most likely make matters worse, and destroy more data, assuming that it manages to run at all.

Also, how do you recover data from a drive with a head crash, or with a dead control card?....................errr NOT with chkdsk. You need a spin-up table and a clean room, or at least a (reasonably) clean room with a good electronics engineer to make the HDD work again.

Those scenarios are data recovery.

As for "drive repairs", well that is pretty simple. There is software that will attempt to fix the drive if it has magnetic anomalies and Windows thinks that it is corrupt...........chkdsk won't do that, it will either do nothing or screw up..

Otherwise we are back to a physical repair situation; although I would never trust the drive again.

Chkdsk is a tool designed and intended to repair problems with the Windows file and operating systems. It is certainly not a magic bullet, and should be used with caution. It is for Windows screw ups, not for hardware problems, and will not resolve many Windows OS problems (MBR, Table File etc.?)

LinenOise,

That is what I mean about discussing things with your customer. Just give them a few specialist data recovery companies' numbers........... when they get the quotes they will STFU and ask you to "have a go".

[CybertecOne]

Don't you hate it when windows or linux is unable to recover a FAT32 or NTFS partition but when you decide to reimage the HDD, the image software keeps rebooting. Explain that to a customer, they damn you and swear you're satan himself. Next they call your boss and your boss looking at you like a Jew ready to crucify Jesus again.

Not really..... **** happens hey


CTO

[morganlefay]

Next they call your boss and your boss looking at you like a Jew ready to crucify Jesus again.

wow..that is almost offensive....

Thank the gods I dont believe in that all the religous shite....

MLF