June 16, 2010
Last night, their main computer coughed up a hairball and died. The husband of my boss has some skill with computers, so he ran some BIOS checks on the system and everything reported that the hard drive and grabbed its chest and died. Of course, this hard drive is the one that has the gazillions of Squishy photos on it, photos that they cannot replace (they have some saved in other places, but just a mere fraction of the total). Here's the thing: the HD gave no indication there was a problem, no weird sounds, nothing. It just stopped functioning. A two-hour call to tech support caused nothing but frustration, of course... frustration and a deep, deep desire to cause an immense amount of physical harm to the techie on the other end of the telephone.
When my boss came in to the Duck U Bookstore today, she told me of the situation. A quick phone call to her husband convinced me that the HD wasn't actually dead (merely pining for the fjords). I suggested that they take it out of the computer, put it into an external enclosure, hook it up to one of their other computers and see what happens. If it doesn't show up, then they know that the offending drive is dead enough that they'd need to take it somewhere to recover the pictures. If it did show up, then they know that the problem may not be the drive, but the computer itself... and they'd be able to copy the drive to the laptop.
I just got a call from them. They did put it into an enclosure, and sure enough, it appeared... well, actually, two drives appeared, at which point I slapped my forehead: of course two drives appeared, it was the boot drive from the dead system! What they were seeing was the C drive and the drive partition where the recovery stuff was kept... which is where the unexpected problem has reared its ugly head.
Y'see, when they look at what was the C drive, there's only a few folders visible, and they don't have anything in them... at least, that's what the laptop is reporting. What I think is happening, and please correct me if you think I'm wrong, is that the drive isn't showing anything because the copy of Windows that's on it obviously isn't booting, and thus the file system on the drive isn't functional (I may have the technical details wrong, but that's the net result). Further, the laptop is XP and the version of Windows on the drive is Vista, which probably causes problems too.
They're copying the drive to the laptop, and I've suggested that they go to their other desktop system (which they retired), rip out that hard drive, and plug the problem drive into it. If everything goes well, the stars align, and a choir of angelic ducks quack out paeans to the heavens, it'll boot up. At worst, they'll be in the same boat they're in now.
The tech question I have for you, the myriad readers of The Pond, is there some way to access the data from the problem drive if dropping it into a different computer system doesn't work? If the data was replaceable, I'd just suggest they find Windows on it, delete it, and see if that turns it into a normally-read drive, but I'm just WAGging there, and the chance that it'll turn the drive into a brick seems not insignificant. Can they pull the data off without the "boot Windows" running?
Another related question: is there some way to boot a laptop from an external hard drive that has Windows on it, sort of a half-arsed version of dual-booting? If they can do that, then they can save the pics to a different external drive, or burn them to DVD, or something.
Let's brainstorm, my friends. Hopefully they'll be monitoring this thread, if not tonight then tomorrow, so they'll be able to provide specific details (what folders are showing up, for example) that I don't have, but in the meantime, let me hear your best suggestions.
There are companies which are in the business of recovering data off of drives that have died. In the most extreme case they take the drive apart and move the spindle into an equivalent drive which is not dead.
But it ain't cheap. You're talking at least a thousand bucks.
Posted by: Steven Den Beste at June 16, 2010 09:12 PM (+rSRq)
Posted by: Steven Den Beste at June 16, 2010 09:13 PM (+rSRq)
One last point: given that they tried and failed to access the drive using Windows, they should probably not try again. The possibility exists that Windows may damage the data that's on the drive by trying to fix the file structure, making recovery impossible.
Posted by: Steven Den Beste at June 16, 2010 09:17 PM (+rSRq)
The Linux option is one that I thought about, but I have no clue beyond just thinking about it. I know so little about what it can do that I can't help them past the point of bringing it up.
Hopefully, they'll be able to copy the drive so we don't have to worry about Windows breaking the data. I'm hopeful that a drive-swap into a different computer will work...
Posted by: Wonderduck at June 16, 2010 10:10 PM (iJfPN)
After that, I used a file catalog rebuilding and file searching program. I'm on a Mac, so I used Data Rescue II, but there should be some equivalent for Windows. The Ubuntu Rescue Remix CD seems to include some open source tools as well, but I've never tried them. Some basic instructions are here:
Posted by: benzeen at June 16, 2010 10:32 PM (WE8c2)
Posted by: Pixy Misa at June 16, 2010 10:49 PM (PiXy!)
2. Run SpinRite, from Gibson Research (grc.com) which will do a complete low level scan of the drive, restoring data from damaged sectors. Very good program, inexpensive, saved my a$$ on multiple occasions.
3. R-Studio, from R-Studio.com -- i have used it many times in the past, and it does good work recovering broken file structures.
I know that none of these options are free, and there are other programs that do the same things, but if I had your problem in my office these are the steps I'd take regardless of the program being used.
Posted by: denebola at June 16, 2010 11:24 PM (LDyD6)
image that drive asap, then run spinrite on it, if its recoverable this will work.
another options is if you can find another drive with the same exact firmwear/revision number you could swap out the green logic boards, i have done this in the past, but if they are not identical fw/rv # it may not work.
Posted by: dagamore at June 17, 2010 01:11 AM (vdcdn)
Posted by: Quentin at June 17, 2010 01:32 AM (KSyKn)
Is that thinking incorrect? Is there some way to circumvent the version of Windows that's on the drive? Is there some way to boot a laptop from the drive? Or "dual-boot" from an external?
Posted by: Wonderduck at June 17, 2010 06:26 AM (iJfPN)
I'm going to preface this with "I know just enough to be dangerous"
But no, the fact that it's the "boot drive" from another computer shouldn't matter when it's placed in an external enclosure. (Make sure that the master/slave settings are correct) If everything was kosher, you'd just see another drive with a "Windows" directory in it. The boot drive just means it has a master boot record in the drive's sector zero that starts the booting process. When a computer starts, it looks at the drive it's been told to boot from and does what the MBR says, which here is "start Windows". The laptop has it's own boot drive, and it's starting from that one. Any other drive attached to the system, whether or not it has an MBR is just a secondary drive.
The fact that nothing appears says to me that the drive is screwed up somehow. If you didn't care overmuch about the data on the drive, like "It'd be nice to have, but I wouldn't cry over losing it," then play with all of the tools people have listed above. However, Quentin is almost certainly right...take it to someone who knows what the hell they're doing.
Posted by: CatCube at June 17, 2010 07:19 AM (Te0W1)
CatCube is right: the fact that it's a boot partition is irrelevant. I have access to two of those right now attached to the computer I'm using: one is in an external USB enclosure, and the other is a second internal drive attached to the IDE controller. In either case the drive appears fine. If you can't see the files, there's filesystem damage. An undelete utility of some kind might fix the problem, as might a filesystem repair tool...but it might also hose the system beyond repair. Your safest bet is as others have suggested: optionally image it and then take it to a recovery service. They're far cheaper than they used to be: as you already know, it's not exactly expensive any more.
Then tell the boss to start making regular backups.
Posted by: rickc at June 17, 2010 07:49 AM (85Ro5)
Posted by: jml at June 17, 2010 12:22 PM (Lti64)
Assuming, of course, that it can be saved without the drive without being handed to people in bunny suits and taken into a clean room. We'll know soon enough. Advice is still being taken, however! Collectively, you all know more than one person...
Posted by: Wonderduck at June 17, 2010 04:30 PM (iJfPN)
I didn't mean that it takes all my readers to know more than one random person... I meant that a group is always better pooling their knowledge than one person is.
Posted by: Wonderduck at June 17, 2010 04:31 PM (iJfPN)
Further, the laptop is XP and the version of Windows on the drive is Vista, which probably causes problems too.
Try plugging the now external hard drive into a machine running Vista. I think that MS tweaked NTFS in Vista because I've formatted drives on my Vista machine that I couldn't properly read on an XP machine.
Posted by: Kae Arby at June 17, 2010 09:33 PM (jzP7W)
Posted by: Steven Den Beste at June 17, 2010 11:48 PM (+rSRq)
Powered by Minx 1.1.4-pink.