Recovering Data from a “Dead” Hard Disk By Bruce Preston My brother in law is a musician/composer. About a month ago the hard disk on the old desktop machine (Windows XP SP3) that he uses gave him a BSOD (Blue Screen of Death) upon booting. While he had backups of most of his things on a newer machine, there was some data that hadn’t made the most recent backup. He tried booting with Safe Mode – it didn’t get past the Windows logo screen before hitting a BSOD again. We tried putting the hard disk in an external drive enclosure so that we could access it from a working computer. Upon opening “My Computer” it stalled for several minutes before finally showing that there was a disk present, but it couldn’t show any contents. The fact that the drive at least tried to boot (getting as far as the logo screen) indicated to me that the drive was probably physically OK but had a data problem. There are services that will recover data from physically damaged or data corrupted hard disks, but they typically cost over $500 just to take a look at the drive. We decided to see if we could get data off of the drive using consumer-grade data recovery software. I did a search of the web and found that EaseUS.com has a “Data Recovery Wizard.” I have had favorable experience with their free Partition Manager, so I decided to give it a trial. The free download trial/demo version will examine the drive and tell you if the data can be recovered, but will only bring back something like 10MB of data. To actually recover all of the data you need the purchased version. So figuring that there was nothing to loose I downloaded the trial version. When you are attempting to recover data from a drive, it is important that you never write to the drive as you may over-write space occupied by an otherwise recoverable file. Since installing software involves writing to a drive, you need to install the software on a different drive. For this reason it is advisable to install the software on a fully operational machine and attach the damaged drive to the machine via an external drive enclosure, which typically uses a USB 2 interface. Alternatively you could install the drive within a desktop, but I find this to be a nuisance. External USB enclosures are available for the older PATA (a.k.a. IDE/ATA) drives or the newer SATA technology. USB 2.0 enclosures for 3.5” drive (desktop size) cost about $20 to $25, 2.5” drive enclosures are about $6. The 3.5” has a “brick” power supply; the 2.5” draws power from a pair of USB ports. I purchased mine years ago at a MicroCenter store; you may order them from www.microcenter.com. I have also seen them on eBay. The drive with the problem was a Western Digital WD800 – 80GB. We expected it to have about 40GB of data total, including the OS and installed programs. I had a spare 160GB drive in a second external enclosure that had about 140GB of free space, so I decided to use it to receive any recovered data. When I launched the trial/demo version of the EaseUS Data Recovery Wizard it showed me all of my desktop’s physical drives and partitions within. It also showed the problem drive as E: and said that it had 3 partitions (2GB unallocated, 60GB allocated but not formatted (oh really?,) and about 10GB formatted FAT32. Clearly the data was on the second partition, and the third partition was presumed to be the Dell recovery partition. The program offered to do an analysis and recovery. Since the directory was damaged, I couldn’t select specific file recovery, so I selected “Partition Recovery” and pointed to the second partition. There was immediate encouragement as I could see recognizable names of folders and files fly by on the screen. After just under an hour it reported that it was 100% confident in recovering files and folders, as well as being able to recover “raw files”. I looked up its definition of “raw files” – these are constructed chains that may include deleted files, but most importantly may contain cross-links to space occupied by other files. Essentially I think you only want to work with raw files as a last resort. We decided to purchase the full product. There are two versions – the $69.99 version will work with typical Windows formats, the $79.99 “Pro” version adds other formats including Mac and the multiple Linux formats. While I only have a virtual Linux machine, I figured that for $10 I might as well get the Pro version against the possibility of needing it in the future. The software will work with PATA -IDE/ATA drives, SATA, USB external hard drives, solid state drives, and USB flash drives. After downloading and providing the registration key delivered by e-mail, I launched it and had it do the analysis again. (I could have saved the analysis from the trial version, but didn’t.) I had created a folder on the target drive named “Recovered” and told the software to place recovered files and folders there. It took just under three hours, but when done, the folder “Recovered” in my F: drive looked identical to the original drive’s C: structure and Windows indicated that the folder structure contained 41GB. There was also a “Raw Files” folder. The total amount recovered was listed as 110GB – interesting as the physical drive is physically 80GB – but explainable when you consider the definition of raw files. The first thing that I did was burn to DVD the contents of the several “My Documents” folders within XP’s “Documents & Settings” structure as there were several accounts on the XP machine. Having moved his critical data to his new machine we then went through folder by folder and gathered other files from other locations such as “Application Data” etc. We skipped the thousands of files that had been in C:\WINDOWS and the thousands of files in “Temporary Internet Files” – these were mostly .JPGs and .GIFs of 2 or 3KB. There was no point in trying to move applications as these typically need to be installed from installation media. Once we were completely satisfied that we had recovered everything that he wanted, we used EaseUS’s Partition Manager to delete the three partitions from the old hard disk. We then created a single partition and formatted it as NTFS. He is now using that as a backup drive for his new machine, and promises to do more frequent backups. What we don’t know is what caused the initial corruption of the drive in the old machine. Scanning the recovered data with anti-virus and anti-malware came up clean. We didn’t try to scan the recovered registry, I’m not sure if that can even be done. My guess is that his almost 10 year old machine just had some sort of hardware glitch that damaged the directory entries for the drive. All in all it was a satisfying experience in being able to recover his data. It also makes me wonder if I have discarded a couple of “dead” drives over the years that had the same symptoms - recognized as a drive, but inaccessible data. Perhaps they could have been put back into some sort of functional use. I never would use a drive more than a few years old in a system, but find them useful for temporary or occasional use such as the transient target for recovery or to assist in the migration to a new system.
. |
 Click Here |
 |
 |
DacsGear!
|