Posts Tagged ‘Data recovery’

Recovering data from a soft or “logical” disk crash

Friday, July 18th, 2008

Okay, so you have a system disk that’s no longer bootable.  Perhaps you even accidentally deleted the partition or quick formatted it.  Whatever happened, you know you have lots of photos and other treasures on your hard drive that you didn’t back up.  How do you get your files off of a drive that won’t boot?  I’ll explain.

Requirements

Before we proceed, here is what you’ll require:

  1. Another working Windows XP system that supports the same type of hard drive interface, such as EIDE or SATA, and has a spare connection
  2. Sufficient disk space on the spare system’s hard drive, or an external hard drive, to hold your recovered files
  3. A backup device on the spare system, such as a DVD burner
  4. Data recovery software if you’ve deleted the files, deleted the partition, or formatted the drive

Removing the failed drive

Power down the failed computer system, and then unhook the failed drive.

Preparing the spare system for recovering deleted data

Before you hook up the failed drive to the spare system, there are some steps that you must take to prepare the spare system.  This will ensure that when you hook up the failed drive, it will not get written to, which could cause data loss if you are recovering deleted files or partitions.  Here are the steps to perform on the spare system if you are recovering deleted data:

  1. Disable System Restore
  2. Disable the indexing service
  3. Permanently disable all antivirus programs
  4. Turn off all scheduled maintenance, such as scheduled defrags, scheduled virus scans, and scheduled backups

Preparing the spare system for recovering data from a crashing or unbootable operating system

These steps ensure that you will be able to access the required parts of the drive.

  1. Turn on show hidden files
  2. Disable hide protected operating system files
  3. Disable “Use simple file sharing”

Hookup the failed drive to the spare system

Power down the spare system and install the failed drive.

Ensure that you set master/slave settings properly for IDE or EIDE drives.  If you set things up properly, your failed drive will appear as one or more new drive letters in Windows when you boot up the spare system.

Restoring data from a crashing or unbootable Windows system drive

If the problem was simply that the operating system wouldn’t boot or was crashing, all of your files should be there for the grabbing.

If you’ve used encrypted folders, ensure that you log into the spare system using the same username and password.  Create an account if it doesn’t already exist.

Otherwise, log into the spare system as administrator and take control of all of the files on the drive.  To do this, simply:

  1. Assuming you’ve already disabled the Simple File Sharing mode, right click on the failed drive and click Properties from the pop-up menu
  2. On the security tab, click the Advanced button
  3. On the Owner tab, select your login ID, fill in the checkbox for “Replace owner on subcontainers and objects” and click Ok
  4. You should now have full access to all of the files on the failed drive

To find a user’s Desktop, My Documents, and Internet Explorer Favorites folder, look in:

\Documents and Settings\username\

To find your Outlook Express database files, look in:

\Documents and Settings\username\Local Settings\Application Data\Identities\{GUID}\Microsoft\Outlook Express\

Restoring deleted data

If you did a low level format, your files are gone.

Restoring other deleted data requires specialized software.

Stellar Phoenix NTFS Data RecoveryI’ve had recent experience using Stellar’s Phoenix Recovery Software.  The NTFS Data Recovery Software package is sufficient for restoring your deleted files, including files from a deleted partition or even a quick formatted partition.

Stellar’s software worked, but the user interface was outdated and just plain not friendly.  For example, I only wanted to recover JPEGs over 1 MB, so I sorted the lost file list by size, but then I had to select each JPEG manually.  I couldn’t select a range.  Also, why I can’t I scan the whole drive for lost folders without scanning raw files at the same time?  In order to do that, I had to uncheck all of the file types.  Where are the FLV file types?  The file types list needs an upgrade.  Also, every time I wanted to change the selected file types, I had to start over from scratch because each time I went into the dialog to pick my file types, it automatically selected them all for me.  This was even a bigger pain because in order to add file types, I had to leave the dialog, add the file type, then come back.  The pros, of course, were that it worked.

When restoring deleted files, always restore the data to your spare computer’s drive and never to the failed drive.   Any time you write to the failed drive, you may be overwriting other data, which will then be gone forever.

Backing up and archiving your data

Now that your data is successfully recovered to your spare system’s drive, it is time to archive all of your important files.  The preferred backup method is DVD.  DVDs are more resiliant than magenetic or flash based media.  Use the verification mode on your DVD burning software to verify that the files were correctly burned.  If you don’t have this feature, you’ll need to test the backups before you archive them.

You can cheaply make multiple backups on DVD.  Store one copy in your home safe, if you have one.  If they’re not in a safe,  thieves may inadvertently grab them or your spouse may accidentally pitch them.

Store another copy in a safety deposit box.  This protects you in the case of fire or anything else that might happen to your home.  An alternative to a safety deposit box is a locked drawer at your office, or a local family member’s safe.

Label every DVD with the contents, such as “Photos”, “Home movies”, “Artwork”, or “Important Documents”, and a date.  Don’t start throwing away the old backups unless your safety deposit box and safe are out of room.  It’s best to have two or more generations of backups around.

Keep all of your photos and other masterpieces backed up on an external drive.  You can quickly grab them if you need them, and you’ll be protected in case of another system crash.  However, a backup on an extenal drive is not the same as archiving the data.  The external drive will burn in a fire and it will be the first thing the thieves grab.  The external drive is for convenience, not peace of mind.

Archive all of your data on DVDs in your home safe and a safety deposit box or other secure site away from your home.  Then, sleep well at night.

Computer won’t boot? If you like your data, stop!

Wednesday, July 16th, 2008

Okay, so something happened.   Maybe you ran a new program, maybe you installed some new hardware or updated a driver, maybe you applied a Microsoft update… whatever happened, now your Windows computer won’t boot.  Maybe you’re seeing the blue screen of death.  The first thing you think is, “I kept meaning to backup my photos and music!  Now I’ve lost them!”

Don’t panic.  An operating system crash is often unrelated to a hard drive crash.  In fact a lot can go wrong with an operating system or even the file system to prevent your system from booting, but as long as the drive is still spinning, odds are it’s a “soft crash”, as opposed to a “hard crash”.

hard crashWith a hard (or “physical”) crash, it means that something in your hard drive has mechanically failed.  Perhaps the spindle motor that spins the drive has failed.  Dropping or kicking a hard drive while it’s spinning can cause a drive head to come into contact with the platter, causing another type of hard crash, which may cause data loss.

soft crashA soft (or “logical”) crash means that the hard drive has not had a mechanical failure.  Instead, it has become corrupted in some way.  It could be the file system itself that is corrupted, such as a bad master boot record, or an accidentally deleted partition.  Sometimes, the file system is intact, but something has happened to the operating system, preventing your system from booting or causing it to crash.

Hard crashes are easily detected.  Your BIOS will usually report a bad hard disk, or the drive will not show up at all when you boot your computer.  Hint: hard crashes are often simply a loose connection.

A soft crash is just about anything else.  So if you want to keep your data after a soft crash, stop!  If you can get to the Windows boot screen, you can try to revert to your last known hardware configuration if you’ve just installed or updated a driver.

Sometimes you can fix other Windows problems, but if you haven’t made a recovery disk, or you don’t know where it is, you may be out of luck.

But wait!  If you don’t know the difference between running a recovery disk, restoring Windows, and formatting a drive, then don’t try it!

If you put in the recovery disk that your manufacturer has provided you, or boot off of your Windows CD or DVD to restore Windows, do you really know how far you can go before wiping out your current install?  If not, then don’t do it!  This is probably the biggest mistake made by home users, causing their files to be irretrievably lost.

With a soft crash, your prized files are probably all still there and intact.  Your hard drive can be hooked up to another computer, and your files can be retrieved.  The other computer boots off of its own hard drive, so it doesn’t matter if there’s an operating system at all, let alone a working one on your old hard drive.  Corrupted file systems are a bit more difficult, but with the proper software, your files can still be retrieved.

 In case I didn’t say it enough times, if you don’t know the difference between running a recovery disk, doing a Windows restore, reinstalling, or reformatting, don’t do it, or you may lose your data forever.

Take your computer to a specialist, preferably one that you’ve been referred to.  Taking your computer to someone who is not qualified to do data recovery is probably the second biggest mistake by home users.

In my next article, I will provide some basic tips for doing data recovery after your hard drive suffers a soft crash.