More specifically, I have a Win XP system non-coop drive. I am wanting to use Knoppix at the hex level to recover files/data. Knoppix "sees" the data, but I need to recover same to another drive. I need a "rescue" tutorial on knoppix.

I am sure whatever you want to do is easy. Have you searched the web for what you want? As far as books go Knoppix Hacks (O'Reilly) is good.

If you can be more specific about what you want to do, I can probably answer your question. I.e. do you want to copy partitions, copy files, or what? I am not sure what you mean by "at the hex level." (Yes, I know what hex is.) I am also not sure what a "non-coop drive" is.

non-coop drive means it is non-cooperative and has failed. I am attempting to recover data, by file if possible, or cluster/sector if necessary. I've been made to understande Knoppix has this capability, but need help in its functionality. Sounds like Knoppix Hacks (O'Reilly) could be a possibility. Thanks - hope there are other possibilities as well.

Knoppix has some Linux tools, but i don't know which are for file/disk recovery....and I'm not sure which tools support NTFS. Try a Google search using "disk recovery with Knoppix" or some such.

Failed hard drive recovery is a narrow speciality which requires detailed knowledge of the file system. This is why there is a thriving industry in this. Unless you have a lot of experience, you might want to consider getting a professional --especially if the data is critical.

If you do decide to tackle this yourself, the very first thing to do is to clone the relevant partitions. Under Knoppix, you can do this with the "dd" command. Proceed with caution--even the cloning can wipe out the drive if not done correctly.

"data recovery ntfs knoppix" 263,000 hits in a Google search

I would recommend cloning the partition to a file rather than to another partition (unless a cloned partition is really your end objective; I don't think it is). To do this, mount a good partition with more free space left than your defective partition at (for example) /mnt/temp. Then:

This assumes your defective partition is on /dev/hda1; adjust as necessary. Also adjust mount point and file name (partition_backup.img) to suit taste. If dd fails, you can check out Hack #59 in Knoppix Hacks or google to learn about dd_rescue and dd_rhelp.

To recover files , mount the defective partition RO (the default in KNOPPIX when you click on the desktop icon), mount the partition to receive the files where you desire. You can now use your standard tools (GUI or CLI) to copy non-corrupted files and/or directories (which should be your first priority). Google for options to try recover corrupted files.

EDIT: If you are doing this because a drive is failing, instead of mounting the actual partition to recover files, you would be better off mounting the backup image (make sure you mount it RO!):