PDA

View Full Version : Hard drive recovery



Niko_Ghost
12-05-2010, 08:54 AM
A client of mine has a 40 gig laptop drive that has given up the ghost.
I've tried the freezer trick, and can get it to spin up, but windows still doesn't see it.
Is there software out that will allow me to access the root of the drive and salvage some of the data? Or any other tips?
While the data is ot critical, it will take quite a while to re-create it.
Any help would be greatly appreciated,
Thanks folks,
Niko

inphinity
12-05-2010, 08:57 AM
Is it detected in the BIOS? If so it's quite possible that various tools like a WinPE environment or linux would be able to see the drive.

If it's not seen by the BIOS, you will likely need to seek help from somewhere that specialises in data recovery like Computer Forensics.

Niko_Ghost
12-05-2010, 09:42 AM
Thanks inphinity, haven't checked the bios after a freeze, will do that next, last time I froze it, I got like 45 min of good spin time, but windows didn't see it. I'll look at the bios, and try a few data recovey progs....if nothing else, I have an identical drive and I'll try swapping controllers.

Cellux
12-05-2010, 10:09 AM
Freezing the drive should be the last thing you do (other then going to the forensic guys), as it can cause damage to it.

Have you tried reading the drive in a Linux Distro?
Without USB-IDE readers as well, they tend to mess up sometimes. Straight IDE to motherboard is a lot more secure (Same with SATA to motherboard).


Edit: A good source of information for Hard drive recovery is this guy:
http://www.youtube.com/user/SuperFlyFlippingA

He has a lot of exceptional videos explaining what forensics actually do, and what you can do yourself.

utopian201
12-05-2010, 10:27 AM
in my experience, while freezing actually worked, after I recovered everything, the drive was well and truly gone.

wainuitech
12-05-2010, 10:34 AM
in my experience, while freezing actually worked, after I recovered everything, the drive was well and truly gone. Exactly right :thumbs: Freezing is usually only done as a one off last resort, freezing produces moisture inside the drive, when it thaws out you now have water inside the drive.

Niko_Ghost
12-05-2010, 04:48 PM
hey guys....I know freezing is the last resort.....This drive is crispy....I may be a noob here....but the first upgrade I did was going from a 386 to a 486...workgroups was tits on a ritz back then...this is more of a pet project than anythig else....the client has given up on her data...looking for that Knight in Shiny Armor moment...and it would make her day......

thx again


Niko

wainuitech
12-05-2010, 05:14 PM
Slave the drive to a working PC, you can try programs like undeleteplus (http://www.portablefreeware.com/?id=1063) or Recova (http://www.piriform.com/recuva) or one that may work, thats very good and I use all the time - Getdataback (http://www.runtime.org/) ( its a paid software - but the trial will allow you to see anything it can recover) Another good one Active @ File Recovery (http://www.file-recovery.net/) - paid once again.

KarameaDave
12-05-2010, 08:09 PM
Another option

http://www.cgsecurity.org/wiki/TestDisk

Agent_24
12-05-2010, 09:00 PM
Freeze it again and hope like hell you can get it spinning and detecting.

If that all looks good then use a recover program like what Wainuitech describes (I'll add Filescavenger as that's my favourite)

DON'T do anything to the drive until you have your recovery program sorted. Don't bother with a trial version, by the time that finishes you may have no time left. If you need to buy a copy, buy it.