Any software solutions for crashed hard drive?

[gerbil]

My 200GB hard drive with my photo archive crashed. I have most backed up to another drive but not all and I'd like to recover the data from this drive. Does software exist that I can try myself to help recover this data? Or will I have to send it in to an IT pro? Oh, and it's Windows-formatted. Thanks in advance for any information.

 

[DerekS]

Try Spinrite from www.grc.com!

 

[gerbil]

Sorry, I should have been more specific, but the drive I'm talking about is an external USB hard drive. Spinrite seems to be for crashed bootable drives only. Or can Spinrite help me out?

 

[ChrisA]

My 200GB hard drive with my photo archive crashed. I have most backed up to another drive but not all and I'd like to recover the data from this drive.

How "crashed" is the drive. Does it power up and spin? Can you see any data at all. Does it show up as a disk on the desktop. It the drive can stil "talk" to the computer there is a good chance at least some data can be recovered. But if the drive is dead no software can help and if will have to be shipped off to a very expensive lab.

Don't use PC formated drives with FA32 file systems for important data. Even Microsoft got away from that. FAT filesystem was a poor design even when it was new back in the 80's.

You should re-think your work flow so that backup is the first step when files come off the camera

If you are looking for software type "data recovery" (in quotes) to Google and find all kinds of software and services.

 

[gerbil]

Mechanically the drive seems sound. Windows XP recognizes it as a drive but it lists no data and asks to format it. Leopard can't read it either and asks to initialize it.

 

[compuwar]

It really depends on what sort of crash it was. If the drive makes noises when you boot it, then you may be able to do the freezer trick once- but it's not definite- if the heads hit the platters, then it's toast, even a clean room environment won't necessarily get all the data back. If it's just the controller card, you can usually swap out a good controller card if you can find the same model/version in about two minutes. If it's just a hosed file system, then there's lots of recovery software out there that lets you do try before you buy- should take about a minute to find one on Google.

 

[Westside guy]

Yeah, my wife's PC laptop just had its hard disk crash, and hard. Tried to use XP's Recovery Console - didn't work. Tried SpinRite - no go. Tried the freezer trick - nope. And of course her last backup was in August 2007... so she has definitely lost some stuff.

Now I've got her on a MacBook (she was willing to give it a go), and she'll use VMware for those Windows programs she has to have. Her files will be on the Mac side; so Time Machine will make it trivial to back up. Hopefully I won't have to worry about data loss ever again.

Hey, one thing to remember when discarding even a crashed drive: DESTROY IT. Put a drill bit through it in several places; or open it up and use pliers on the platters. Or both.

 

[gerbil]

I wound up using Ontrack Easy Recovery software with pretty good results. It managed to retrieve at least 90% of my pictures along with pictures I had previously deleted on that external drive.

The bad news is that a significant number of videos no longer work even though it first appeared as if Ontrack retrieved them just fine. Once I played them there were lots of crosslinks with other video files if they played at all.

Overall I can recommend Ontrack for ease of use for those drives that are physically OK but suffered some software glitch.

 

[compuwar]

Yeah, my wife's PC laptop just had its hard disk crash, and hard. Tried to use XP's Recovery Console - didn't work. Tried SpinRite - no go. Tried the freezer trick - nope. And of course her last backup was in August 2007... so she has definitely lost some stuff.

Depends on what it's worth to you- Ontrak will pull the platters and recover to a new disk if it's worth enough to you.

Now I've got her on a MacBook (she was willing to give it a go), and she'll use VMware for those Windows programs she has to have. Her files will be on the Mac side; so Time Machine will make it trivial to back up. Hopefully I won't have to worry about data loss ever again.

Famous last words..

Hey, one thing to remember when discarding even a crashed drive: DESTROY IT. Put a drill bit through it in several places; or open it up and use pliers on the platters. Or both.

It's not *that* difficult to get around the holes and still get valid data, and you don't know the holes are actually where the important data is. If you sand the oxide off the platters, you actually get to scramble the bits.

 

[ChrisA]

Now I've got her on a MacBook (she was willing to give it a go), and she'll use VMware for those Windows programs she has to have. Her files will be on the Mac side; so Time Machine will make it trivial to back up. Hopefully I won't have to worry about data loss ever again.

Hey, one thing to remember when discarding even a crashed drive: DESTROY IT. Put a drill bit through it in several places; or open it up and use pliers on the platters. Or both.

Time Machine is nice but not fool proof. To be safe data needs to be on three different media and at two different geographical locations. TM does you no good if there is a house fire or someone breaks in the takes all your computer stuff. You need an off-site backup too. If the data is important and you want it to be around for a while yuo have to use some other system in addtion to TM. I am pretty sure that in 100 years there will be very few 100 year old photos, our era will disapear.

As for disk recovery. Once I watched a technician apply some kind of magnetic dye to the the magnetic media and then you could see under a good loupe or low power microscope the bits. The dye changed color based on the the magnetic feild recored in the media. It would not be easy but give enough time and money one could recover data even from a bent plater. If you can just overwrite the data it's easier and works beter.

 

[Westside guy]

Time Machine is nice but not fool proof. To be safe data needs to be on three different media and at two different geographical locations.

I'm not that worried about fire - probably because I've never had one. Now I HAVE had multiple hard drive crashes, dating back to the 1980s...

 

[termina3]

It's not *that* difficult to get around the holes and still get valid data, and you don't know the holes are actually where the important data is. If you sand the oxide off the platters, you actually get to scramble the bits.

What about a very large magnet?

 

[Westside guy]

It's not *that* difficult to get around the holes and still get valid data, and you don't know the holes are actually where the important data is. If you sand the oxide off the platters, you actually get to scramble the bits.

If my hard disk has crashed, I'm not particularly worried about NSA getting stuff off of it - they're free to go to the trouble if they want. What I do care about is the kiddie that's bought a bunch of hard drives at surplus that's going to look for peoples' personal info. People that have the means to get at the data on a physically destroyed drive also have better, easier ways to get that data if they really want.

If I'm discarding a functional hard drive, I've found Darik's Boot and Nuke to be very handy - and before that, its predecessor from one of our C&C folks at U of W (had to look it up - Autoclave). Guess I haven't yet discarded a Mac drive though (yeah I know about dd and /dev/random).

 

[termina3]

(yeah I know about dd and /dev/random).

I don't. Enlighten me (please!)

 

[compuwar]

What about a very large magnet?

If you disassemble the drive, yes, otherwise it tends to be difficult to get enough power to affect the entire drive- there are specs for it, but it's just too much hassle unless you're doing bulk destruction and get get someone to melt them down for you.

 

[compuwar]

If my hard disk has crashed, I'm not particularly worried about NSA getting stuff off of it - they're free to go to the trouble if they want. What I do care about is the kiddie that's bought a bunch of hard drives at surplus that's going to look for peoples' personal info.

I talked to Peter Gutmann shortly after he appropriated a microscope to test the NSA patent's real-world applicability. I've seen electron microscopes going for $300 at school surplus sales. It quite depends on what you're protecting (my drives tend to have very interesting things on them.)

However, while the microscopy option is interesting, it's more interesting for "wiped" drives and taking the track-to-head-position variances over the life of the drive into account. To just read a drive that's got some holes in it, you simply need a head at the right height and with the right characteristics- and those are easy to come by...

People that have the means to get at the data on a physically destroyed drive also have better, easier ways to get that data if they really want.

You're seemingly assuming a static technology base- I'm not prepared to do that- if tomorrow someone came up with plans for a $50 read head and platter spinner, I wouldn't be too concerned, but you might want to re-evaluate the drive you drilled out two years ago. While perfect may be the enemy of good enough, time is also the enemy of good enough.

It's just like encryption key lengths- I tend to protect against future threats, not just today's state of the art.

If I'm discarding a functional hard drive, I've found Darik's Boot and Nuke to be very handy - and before that, its predecessor from one of our C&C folks at U of W (had to look it up - Autoclave). Guess I haven't yet discarded a Mac drive though (yeah I know about dd and /dev/random).

If I'm discarding a functional hard drive, it's no longer functional when it gets to the discarded stage. I'm too lazy to try to see if the drive has mapped a bunch of sectors off the main area due to errors- and I'm not sure older drive firmware ever reports that anyway.

 

[Westside guy]

I don't. Enlighten me (please!)

dd is a built-in Unix command line tool that copies data from an input file/device to an output file/device. Most Unix machines have some predefined "devices" with names like /dev/null (is always null), /dev/zero (is always zero), and /dev/random (essentially a pseudo-random value). They're useful for various things; for example a lot of times people will dump script output they're not interested in to the device /dev/null because it just discards it without displaying it. But you can also use these devices as input (rather than output), such as using dd to write all zeroes to a disk by copying /dev/zero to the disk; or you can write (more or less) random data to it by copying /dev/random to it. /dev/random is quite slow though since it has to be called once for each byte to be generated (fyi there's another device /dev/urandom that doesn't have this liability). For speed's sake, a lot of these "disk nuke" tools will just write all zeros, followed by all ones, etc. - much faster than a random number call.

The main problem with tools like dd is they are very powerful; and if you're not careful you can overwrite all the data on your disk. That's not a problem if you're on the computer you want to nuke, and it's only got one disk in it; but let's say you had TWO disks and only wanted to nuke one of them. (I've never done that, but I have done "rm -Rf" when I thought I was in one directory but was actually in another...). I personally think it's better to just download a free tool like Boot and Nuke onto a floppy or CD, and use that - the programmer takes care of the bookkeeping.

Oh - ALWAYS BACKUP FIRST!!

A good way to learn about things like dd is to use the "man" command from the command line in Terminal (or iTerm or whatever) - typing "man dd" will show the commands manual page, which tells you how it works, tells you what arguments it accepts, etc.

 

[compuwar]

I don't. Enlighten me (please!)

(besides what's already been posted)

There's a school of thought that tends to think that writing random data will "fool" 3rd party recovery of data through uncommon methods like the needle and scanning electron microscope trick. The main real issue there is the needle's point is smaller than the write head width on a drive, so you can go to the edge of a track and pick up "old" data because the head moves infinitesimally between writes. So if you use a fixed pattern, then it's (a) easy to find the edge of the last track and (b) easy to discard data that's not the data you're looking for. (a) is, of course easy to do anyway- it's the data that's "narrower" than any other data before you get to another "wide" spot. Which leaves us with (b,) the overriding reason for doing it at all.

The issue against just doing a random overwrite is that you can't easily *validate* that you've overwritten the drive completely with a random pattern if that's all you do. Therefore, if you're paranoid enough to do it, you should be paranoid enough to do it correctly- fixed values with validation at least once followed by random values- total overwrite about a dozen times (I tend to do about 14 random patterns if I'm using that method.) Of course, you can always feed the output of a /dev/random pattern to entropy-measuring software, so the *best* pattern after the initial fixed pattern overwrite is actual data from a different drive or at least actual data from a normal file or executable repeated in random-sized, randomly sought chunks.