PDA

View Full Version : Knoppix. Useful for file recovery?



rugila
08-08-2008, 11:50 AM
I had a problem with a hard drive Seagate 300gb barracuda ide, which was my main boot drive (WinXp), but suddenly decided to stop booting. (Power supply problem, since fixed).

So I used an alternative boot, whence Xp then decided it could see the disk OK but that it wasn't formatted and asked if I wanted to format it now. I didn't.

I did a bit of investigation on how to recover some important files from the disk. I had these were backed up, but not the most recent versions. The only file recovery utilities I tried were File Scavenger ($49US) and TestDisk (free). These had no trouble at all in seeing and recovering the relevant files, and it seems they could do so with most or all of the other files on the disk.

So I don't now have a boot problem and I don't have a lost file problem. Just a fair amount of wasted time.

Getting on to KNOPPIX, which is the main reason for this post. I understood Knoppix could also be used for disk repair/file recovery.

So I downloaded the most recent Knoppix version, burnt it to a CD, booted from the CD OK and checked all 3 hard disks in that computer.

The boot disk (Seagate 160gb) was OK, the WD 120gb was OK. Knoppix could see that the 300gb Seagate existed (it was plugged in with an IDE cable) but couldn't do anything with it, in particular couldn't see or recover any files. It gave error messages "Could not mount device" and "Mount: I could not determine the file system type, and none was specified."

So, I have 2 questions on which I'd love to get some feedback.

1. Is there a way where one can specify to Knoppix what file system it's looking at?

2. For file recovery, is there use in using Knoppix at all, since there are other utilities that seem to easily do the job that Knoppix didn't? After all, it did take up time (often in short supply) for no result. And please, I don't want to start a dispute on the merits or demerits of Knoppix. All I want is info on best ways to handle file recovery problems.

smokey
08-08-2008, 12:20 PM
i could be wrong but i think knoppix is unable to do anything with ntfs partitions. could that have been your problem?

see post #3 here http://www.linuxquestions.org/questions/linux-newbie-8/knoppix-ntfs-support-384594/

nofam
08-08-2008, 12:38 PM
Download Ubuntu, and make a bootable CD - it's capable of reading from and writing to NTFS volumes in it's latest version (Hardy Heron). has been for a while actually.

You can pull files off NTFS drives, and drop them straight onto a USB hard drive or memory stick etc. Very handy

wainuitech
08-08-2008, 12:48 PM
knoppix can read most formats NTFS included. Example here is a snapshot (http://www.imagef1.net.nz/files/snapshot11218154053.png) From knoppix reading a NTFS customers XP drive that Windows cant open or see. I know its NTFS because I only installed this OS a few months ago.

What you may need to do is Right click the drive(s) you want to recover data from as well as the drive you want to recover the data to, select Change Read/Write mode - Yes, then locate copy/paste the files you want to the other drive.

From the link in Post #2
Knoppix has native NTFS (read) support, and also has captive support for NTFS write. This uses the real XP drivers to handle this - but requires the XP partition to be accessable.
If you have a dead XP install, you are out of luck. So your old drive may be the problem, but as mentioned the customers one I pictured above - windows doesn't even see anything, only a blank & unpartitioned drive

mzee
08-08-2008, 12:55 PM
I use Linux Puppy 4 or 3.
Has no problem with Windows files or formats. Also includes 'G-Parted' which is a very good partition manager, similar or better than 'Partition Magic', handles all Windows & Linux formats.

There are two situations where Puppy will not mount a drive, If the partition is corrupt, or If the partition is in hibernation.

If there are errors, G-Parted can check it.

Puppy is a free download ISO

rugila
08-08-2008, 03:05 PM
Thanx for feedback.

1. re Knoppix not reading NT file system, I understand that recent versions can, and can also write to it. However, not much point in doing anything about the write option if I can't use Knoppix to read ntfs. Why it doesn't is my current problem.

2. Ubuntu and Puppy may be useful suggestions, but is there some reason to suppose they would see the files that Knoppix won't? I have other ways of getting to the files, but do want to know why Knoppix won't do so.

3. Clicking the drive I want to copy files from just gives the error message that Knoppix can't determine the file system and can't mount the disk. Is there a way of telling Knoppix what the file system is? Where from here? :confused:

wainuitech
08-08-2008, 03:28 PM
Knoppix Can read a NTFS file system usually, as I pictured that's a drive that windows cant even see the partition on. (drive was slaved)

I did have knoppix fail once, that was when the drive had changed to RAW, then none of the other Linux distro's I tried, Ubuntu, or puppy could see anything either.

At that time I had to use a windows based data recovery program that could see through the RAW format.

With the disk in question, when you right click it on a working machine within windows, what does it say under Properties / File system ?

rugila
08-08-2008, 05:37 PM
With the disk in question, when you right click it on a working machine within windows, what does it say under Properties / File system ?

It says RAW.

So I suppose, like you, I'll have to continue using the windows based recovery utilities.

gary67
08-08-2008, 05:40 PM
This (http://www.cgsecurity.org/wiki/TestDisk) supposedly recovers RAW disks, have not tried it myself wish I knew about it 3 months ago when I needed it, in the end reformatted for friend and re installed windows

rugila
08-08-2008, 10:12 PM
Gary67,

That's TestDisk. It was one of the ones I tried, as in my opening post.

Yes, it can recover files with RAW format, but for a 300gb it's very slow, and (at least in the time I spent on it) didn't give me the file names or directories they came from. It was on the face of it going to a long job sorting out which file is which.

It seems File Scavenger can do the job much faster and more conveniently, and I'm still investigating a couple of others.

Probably I'll reformat the disk eventually, but only when I've got everything I want from it.

wainuitech
08-08-2008, 11:40 PM
Another data recovery program I use is get Data Back (http://www.runtime.org/data-recovery-software.htm) - it will read a Drive that's showing as RAW, it will also display the results in the windows explorer format, for example you would open the Search results - drive, Documents and Settings /your user name/ My Documents or Desktop etc. Example of recovery Tree (http://www.imagef1.net.nz/files/Recovery.jpg). Note: that drive showed as RAW in windows on a working PC.

If the drive is 300Gb you have to remember that the recovery programs dont know what you want to search for so they will scan the whole drive, you can tell get data back to search from sector XXXXX to XXXXXXx with X being a number you put in, BUT you have to know what the sectors are you want.

Generally a large drive is easy, you set it going and leave it over night, the next morning its done. Once done you can save the search and reload it in about 2 minutes if needed again.

The drive shown above is a 80Gb, and took about 3 1/2 hours from memory to do the original scan, and 2 minutes to reload the results tonight for this post (screen shot)

Get Data Back is not free, but it does a great job, the picture above is of another customers drive that Linux rolled over and played dead with. I have erased the customers names in that pic but you get the idea, and it will allow you to try first then if you want the data you pay for the license code.