June 16, 2010

Tech Assistance Needed, Save Squishy!

Okay, here's the story.  As you may remember, my boss went on maternity leave about a year-and-a-half ago after giving birth to a ridiculously cute baby girl, whom I call "Squishy."  Squishy's mom is an inveterate record-keeper, and has diligently chronicled Squishy's life via the art of digital photography, amassing a huge amount of pictures in the process.

Last night, their main computer coughed up a hairball and died.  The husband of my boss has some skill with computers, so he ran some BIOS checks on the system and everything reported that the hard drive and grabbed its chest and died.  Of course, this hard drive is the one that has the gazillions of Squishy photos on it, photos that they cannot replace (they have some saved in other places, but just a mere fraction of the total).  Here's the thing: the HD gave no indication there was a problem, no weird sounds, nothing.  It just stopped functioning.  A two-hour call to tech support caused nothing but frustration, of course... frustration and a deep, deep desire to cause an immense amount of physical harm to the techie on the other end of the telephone.

When my boss came in to the Duck U Bookstore today, she told me of the situation.  A quick phone call to her husband convinced me that the HD wasn't actually dead (merely pining for the fjords).  I suggested that they take it out of the computer, put it into an external enclosure, hook it up to one of their other computers and see what happens.  If it doesn't show up, then they know that the offending drive is dead enough that they'd need to take it somewhere to recover the pictures.  If it did show up, then they know that the problem may not be the drive, but the computer itself... and they'd be able to copy the drive to the laptop.

I just got a call from them.  They did put it into an enclosure, and sure enough, it appeared... well, actually, two drives appeared, at which point I slapped my forehead: of course two drives appeared, it was the boot drive from the dead system!  What they were seeing was the C drive and the drive partition where the recovery stuff was kept... which is where the unexpected problem has reared its ugly head.

Y'see, when they look at what was the C drive, there's only a few folders visible, and they don't have anything in them... at least, that's what the laptop is reporting.  What I think is happening, and please correct me if you think I'm wrong, is that the drive isn't showing anything because the copy of Windows that's on it obviously isn't booting, and thus the file system on the drive isn't functional (I may have the technical details wrong, but that's the net result).  Further, the laptop is XP and the version of Windows on the drive is Vista, which probably causes problems too.

They're copying the drive to the laptop, and I've suggested that they go to their other desktop system (which they retired), rip out that hard drive, and plug the problem drive into it.  If everything goes well, the stars align, and a choir of angelic ducks quack out paeans to the heavens, it'll boot up.  At worst, they'll be in the same boat they're in now.

The tech question I have for you, the myriad readers of The Pond, is there some way to access the data from the problem drive if dropping it into a different computer system doesn't work?  If the data was replaceable, I'd just suggest they find Windows on it, delete it, and see if that turns it into a normally-read drive, but I'm just WAGging there, and the chance that it'll turn the drive into a brick seems not insignificant.  Can they pull the data off without the "boot Windows" running?

Another related question: is there some way to boot a laptop from an external hard drive that has Windows on it, sort of a half-arsed version of dual-booting?  If they can do that, then they can save the pics to a different external drive, or burn them to DVD, or something.

Let's brainstorm, my friends.  Hopefully they'll be monitoring this thread, if not tonight then tomorrow, so they'll be able to provide specific details (what folders are showing up, for example) that I don't have, but in the meantime, let me hear your best suggestions.

Squishy
You wouldn't want to disappoint Squishy, would you?  How could you disappoint that face?

Posted by: Wonderduck at 08:17 PM | Comments (17) | Add Comment
Post contains 767 words, total size 5 kb.

1

There are companies which are in the business of recovering data off of drives that have died. In the most extreme case they take the drive apart and move the spindle into an equivalent drive which is not dead.

But it ain't cheap. You're talking at least a thousand bucks.

Posted by: Steven Den Beste at June 16, 2010 09:12 PM (+rSRq)

2 Also, there are bootable CDs which contain a flavor of Linux which are capable of reading and understanding NTSC and FAT32 which may be able to access the drive even if Windows refuses to do so.

Posted by: Steven Den Beste at June 16, 2010 09:13 PM (+rSRq)

3

One last point: given that they tried and failed to access the drive using Windows, they should probably not try again. The possibility exists that Windows may damage the data that's on the drive by trying to fix the file structure, making recovery impossible.

Posted by: Steven Den Beste at June 16, 2010 09:17 PM (+rSRq)

4 They know about the data recovery places; there's one in the Rockford area.  For easy "eh, it's just mostly dead" stuff, they might be able to recover data for about $200.  If it's more complex, then it shoots up to $1500+. 

The Linux option is one that I thought about, but I have no clue beyond just thinking about it.  I know so little about what it can do that I can't help them past the point of bringing it up.

Hopefully, they'll be able to copy the drive so we don't have to worry about Windows breaking the data.  I'm hopeful that a drive-swap into a different computer will work...

Posted by: Wonderduck at June 16, 2010 10:10 PM (iJfPN)

5 When my laptop drive began to fail a year or two back, I used ddrescue to image it first. You can find it as part of a bootable CD here: http://ubuntu-rescue-remix.org/ (warning, I've never actually used that). Of course I was dealing with hardware failure, and not just corruption. The advantage of running ddrescue, though, is that it makes a complete image of the drive. You can then do whatever you need to on the drive image (or better yet, a copy of the drive image). If you mess that image up, use another copy (this requires a lot of spare disk space, mind you...).

After that, I used a file catalog rebuilding and file searching program. I'm on a Mac, so I used Data Rescue II, but there should be some equivalent for Windows. The Ubuntu Rescue Remix CD seems to include some open source tools as well, but I've never tried them. Some basic instructions are here:
https://help.ubuntu.com/community/DataRecovery

Posted by: benzeen at June 16, 2010 10:32 PM (WE8c2)

6 If the drive is functioning but the filesystem is scrambled, a recovery utility might do the trick.  The only one I've used is Stellar Phoenix, and that was years ago, but it worked flawlessly.  Very slowly, but flawlessly.

Posted by: Pixy Misa at June 16, 2010 10:49 PM (PiXy!)

7 1. Make an image of the drive, just in case. I have a sector-to-sector USB tool to do it that also works as an external drive reader, from Aleratec (aleratec.com). Using something like Ghost to image the drive can also work, but I like a hardware drive to drive transfer the best.

2. Run SpinRite, from Gibson Research (grc.com) which will do a complete low level scan of the drive, restoring data from damaged sectors. Very good program, inexpensive, saved my a$$ on multiple occasions.

3. R-Studio, from R-Studio.com -- i have used it many times in the past, and it does good work recovering broken file structures.

I know that none of these options are free, and there are other programs that do the same things, but if I had your problem in my office these are the steps I'd take regardless of the program being used.

Posted by: denebola at June 16, 2010 11:24 PM (LDyD6)

8 I agree with Denebola,

image that drive asap, then run spinrite on it, if its recoverable this will work.

another options is if you can find another drive with the same exact firmwear/revision number you could swap out the green logic boards, i have done this in the past, but if they are not identical fw/rv # it may not work.

Posted by: dagamore at June 17, 2010 01:11 AM (vdcdn)

9 All the tools mentioned earlier work wonderfully in the hands of someone who is fully aware of what they're doing. But you can do unrecoverable damage if you do not fully grasp what you're doing. I get the impression that the latter is currently the case. So take the drive to a recovery place.

Posted by: Quentin at June 17, 2010 01:32 AM (KSyKn)

10 Everybody seems to be concentrating on the wrong problem, I think... they have evidence that the drive is fine, but the information isn't immediately accessible, possibly because it's no longer the "boot disc", if you get what I mean.

Is that thinking incorrect?  Is there some way to circumvent the version of Windows that's on the drive?  Is there some way to boot a laptop from the drive?  Or "dual-boot" from an external?

Posted by: Wonderduck at June 17, 2010 06:26 AM (iJfPN)

11

I'm going to preface this with "I know just enough to be dangerous"

But no, the fact that it's the "boot drive" from another computer shouldn't matter when it's placed in an external enclosure.  (Make sure that the master/slave settings are correct)  If everything was kosher, you'd just see another drive with a "Windows" directory in it.  The boot drive just means it has a master boot record in the drive's sector zero that starts the booting process.  When a computer starts, it looks at the drive it's been told to boot from and does what the MBR says, which here is "start Windows".  The laptop has it's own boot drive, and it's starting from that one.  Any other drive attached to the system, whether or not it has an MBR is just a secondary drive.

The fact that nothing appears says to me that the drive is screwed up somehow.  If you didn't care overmuch about the data on the drive, like "It'd be nice to have, but I wouldn't cry over losing it," then play with all of the tools people have listed above.  However, Quentin is almost certainly right...take it to someone who knows what the hell they're doing.

Posted by: CatCube at June 17, 2010 07:19 AM (Te0W1)

12

CatCube is right:  the fact that it's a boot partition is irrelevant.  I have access to two of those right now attached to the computer I'm using:  one is in an external USB enclosure, and the other is a second internal drive attached to the IDE controller.  In either case the drive appears fine.  If you can't see the files, there's filesystem damage.  An undelete utility of some kind might fix the problem, as might a filesystem repair tool...but it might also hose the system beyond repair.  Your safest bet is as others have suggested:  optionally image it and then take it to a recovery service.  They're far cheaper than they used to be:  as you already know, it's not exactly expensive any more.

Then tell the boss to start making regular backups.

Posted by: rickc at June 17, 2010 07:49 AM (85Ro5)

13 If the drive is actually visible on another computer, and I'm not entirely sure from your description that's the case, a partition scanning utility may help.  I've used find and mount in the past with success, and it's fairly straightforward to use.

http://findandmount.com/

Posted by: jml at June 17, 2010 12:22 PM (Lti64)

14 Everybody, they've decided to take your collective advice: "Take it to someone who knows what the hell they're doing."  Fortunately, my boss's husband works in the IT field (though he's on the networking side, not hardware), and there's someone at his place of employ with the tools and the know-how to make it happen.

Assuming, of course, that it can be saved without the drive without being handed to people in bunny suits and taken into a clean room.  We'll know soon enough.  Advice is still being taken, however!  Collectively, you all know more than one person...

Posted by: Wonderduck at June 17, 2010 04:30 PM (iJfPN)

15 Wait, that didn't come out right.

 I didn't mean that it takes all my readers to know more than one random person... I meant that a group is always better pooling their knowledge than one person is.

Posted by: Wonderduck at June 17, 2010 04:31 PM (iJfPN)

16

Further, the laptop is XP and the version of Windows on the drive is Vista, which probably causes problems too.

Try plugging the now external hard drive into a machine running Vista. I think that MS tweaked NTFS in Vista because I've formatted drives on my Vista machine that I couldn't properly read on an XP machine.

Posted by: Kae Arby at June 17, 2010 09:33 PM (jzP7W)

17 No, NTFS hasn't changed.

Posted by: Steven Den Beste at June 17, 2010 11:48 PM (+rSRq)

Hide Comments | Add Comment

Comments are disabled. Post is locked.
37kb generated in CPU 0.0204, elapsed 0.2902 seconds.
47 queries taking 0.2814 seconds, 293 records returned.
Powered by Minx 1.1.6c-pink.