Hard Drive Recovery Tip From: Daniel Philpott
Here is the solutions checklist for this problem:
Tools needed:
- Bootable CD or locked floppy dis k Formatted with an OS that can see the file system of the hard drive. DOS is usually the preferred OS for this function with NTFSDOS from Sysinternals for NTFS reads and DOS utilities for diagnostics/repair.
- It should have the ability to boot to and/or see CD-ROM drives, read FAT, FAT32, NTFS, or other common file systems, run common network card drivers and see the network, have disk diagnostic and/or repair utilities, and have antivirus scanning software with current definitions.
- OnTrack Data Adviso r A free download from www.OnTrack.com Hard Drive (large capacity) Formatted for a FAT file system (or whatever is your common file system) and preferably with BeOS as the boot operating system.
- Computer Repair Tool Ki t Standard repair tools.
- Freezer The one in your kitchen will do quite nicely.
1. The first task to recovering a drive is not at all technical It is social. Prepare your user for the worst but also explain what the realistic chances of recovery are. Then start collecting information that you will need. Here is what you need to know before starting:
- What is the goal of recovery, returning to the previous state or recovering the data?
- Which is most important?
- What is the client willing to spend on recovery?
- What OS (NT, 95, Linux) and DOS (FAT, NTFS, FAT32) was the system running?
- Where is the computer located?
- Check the environment: The last question from step 1 is often forgotten and can lead to extensive troubleshooting of a simple problem. Look for an environmental problem that may cause problems for the hard drive. Are there magnets on the computer case close to the hard drive? Is there a fan or heater near the computer? Is a transformer, electrical junction box, or high energy device near the computer (on a floor above or in a nearby wall)? All of these will produce a magnetic (or electromagnetic) field that can cause problems. Equipment that may vibrate the computer even at a very low frequency can cause hard drive heads to skip and jump or even scratch the platters.
- Turn off the computer, remove the cover, and get ready to the turn the computer on. Then put your ear right next to the drive and power the system on. If you hear any kind of grinding, scratching, or rattling from the drive, turn the computer off as quickly as possible and go to the next step. Otherwise go on to step 5.
- If the disk has made noise that indicates some sort of mechanical stress, then the problem is the domain of data recovery experts. This is where the client has to make a decision. Do they want to send the drive to a data recovery service, or do they want to destroy the disk in an attempt to recover some data? If the client has information that absolutely needs to be recovered, then send it to the professionals. Remember, you cannot service a hard drive unless you are working in a clean room.
- If they are willing to destroy the disk and try to get some data off the drive, there is a quick hack available. Place the drive in a static-free bag, then place the drive and static-free bag into a ziplock bag to seal out moisture. Place this into a freezer turned to as low as possible for 24 hours. After 24 hours, pull the drive out and immediately put it into a computer (the faster the better) that boots to a floppy and has another hard drive to transfer data to. If the drive wasn't damaged too much previously, you should be able to pull some data off before the metal of the drive heats up and starts destroying the data storage platters. You can repeat the process only if you shut down almost immediately and go through the 24 hour freeze process again. Chances are that the first time attempt will be the only chance to recover data.
- If the drive boots to an operating system and you can get to either a net work or backup medium, then start copying the most important data off first. Once that data is off, you can back up less important data. The best bet is to listen to your client to find out what absolutely must be recovered.
- If the client wants to restore the drive to its previous state and continue operating, then you need to do two things to see if this is feasible.
- First, run a virus scan on the drive. Update the virus definitions then scan every file on the computer.
- Second, boot to a floppy-disk-based hard drive utility and run a low-level bad sector discovery utility. If both tests pass and the computer boots to the operating system, then your job is done and you are eligible for a pat on the back. Otherwise, continue.
- If the drive does not boot, then try booting to a bootable CD or a bootable locked floppy disk. If you can see the file system, continue to step 8.
- If you can not see the file system, then assess your tools. If you have Hard Drive Mechanic from Higher Ground Diagnostics or Tiramisu from OnTrack, then you can use these to diagnose and recover data. Otherwise, boot to the Data Advisor disk to find out whether data can be recovered. They will recover it or suggest a recovery plan or even require the disk be sent to a data recovery center like OnTrack. The client needs to make the choice as to whether the expense of this solution is worth the recovery of the data.
- If you can see the file system, then priority actions are:
- Copy the most important data off the drive
- Copy the rest of the data off the drive
- Determine if the drive can be recovered (scan with virus checker and disk utilities)
- Repair the operating system
The best way of doing this is to install your spare hard drive in the computer and boot to either it or the CD/floppy bootable. Copy the important data off first, copy the less important data off next, and then do your diagnostics. If your diagnostics look like the drive is repairable, then go right ahead and repair it.
The reason I suggest BeOS be the boot OS on the hard drive is that it has the ability to mount more file systems than I even knew existed before using it. If you need to access an exotic file system, BeOS 4.5 is almost sure to have a driver available for it. However, the FAT (or FAT16) is the most commonly readable file system around, so generally you will want to transfer data to this file system.
If it becomes apparent that the file system is intact and not infected with a virus (or has had a boot sector virus removed), then you may need to replace the Master Boot Record (MBR) of the drive. Simple. Boot to a DOS disk that has the fdisk utility and run an 'fdisk /MBR' to replace the MBR. Remember, balance the time it takes to restore the operating system against the time it takes to recover data, get a new drive, and install a fresh operating system.
Normally, disk recovery is simply a matter of recovering the data. Returning a drive to its previous state is a goal but may simply be more costly than recovering the data and replacing the drive. How much effort to expend on the process is entirely up to you and the client.
