Please can someone help me, my laptop HDD has got messed up and if possible i would like to recover the files that were on there before i scrap it.

So far i have tried restoring it using System
Rescue CD 0.3.7, but i don't really have much experience using those tools. I did notice when i ran the sysresc cd that it does still appear as a disk, only the size is wrong, it show 120mb instead of 20gb, even though the laptop on which it was running no longer recognises that its there. Also in windows it doesn't even get recognised by *most* applications, so i can't really use that to fix. it did however get recognised by one program (stellar phoenix i think), but there were so many errors being flagged that i just gave up.

I have tried rebuilding the boot sector, and repairing the MFT in sysresccd, neither of which worked.

has anyone got any ideas on how to get the data back, which i all i really want? the drive is probably going directly in the bin after this incident.

Connect a drive to the notebook computer either through USB or IEEE-1394 (aka Firewire or i.Link). Create a partition if is it new and format it with either XFS or JFS. Use dd, ddrescue or dd_rescue to create an image file of the drive. The reason why to create an image of the drive, so you can keep the source intact. You already did some recovery which may decrease the chances of getting the data back.

Use Testdisk and Photorec to try to fix and retrieve the files from the image file.

I suggest finding an recycling facility for electronics, so the materials that are used for the hard drive can be recycled instead of hurting Earth.

just want to confirm that i understand your instructions correctly...

i boot up with System Rescue CD, attach my working USB drive, format that to a linux-compatible file system, use dd to backup the broken drive onto the working one, then use Testdisk and Photorec to recover the files?

would System Rescue CD be the best thing to use, or is there a better distro/livecd out there?

my laptop HDD has got messed up
Can you elaborate on how it got messed up?


I think that depends. If there's no need for compat then I'd choose ext2 since you don't need the journalling caps of ext3. IMHO choosing XFS or JFS makes only sense if you're doing more than a few sessions of file ops with hundreds of thousands of files. If you need to be able to also read the filesystem contents on another type of OS and if you are sure you have no files exceeding 2GiB filesize limit, then you could use VFAT instead. If you have files exceeding 2GiB in size and need compatibility then you could use ntfs-3g (if you're using a Live CD like HELIX).


I favour 'ddrescue', it's got more relevant options compared to 'dd' and it is faster than 'dd_rescue'.
(Also see http://www.forensicswiki.org/wiki/Categoryisk_imaging for more tools like ')


Use Testdisk and Photorec to try to fix and retrieve the files from the image file.
While you could write to the same drive the backup image is on better write to a separate HD to avoid overwriting anything and for performance reasons.


would System Rescue CD be the best thing to use, or is there a better distro/livecd out there?
Depends on the tools you need. Here's a list showing only forensic Live D's: http://www.livecdlist.com/?pick=All&showonly=forensics. You'll want one that has Photorec, foremost, retriever and maybe PyFLAG for last effort file carving.

I rather suggest people to use EXT3 instead of EXT2 because there is no lost of space from the journal. EXT3 and EXT2 has lousy performance when accessing files that are very large. JFS or XFS is the fastest when they access files that are several gigabytes. Though EXT2 and EXT3 does have file size limits for certain kernels, but not XFS and JFS.

The reason of making an image file is keep the source, the failed hard drive, intact.

The following to do data recovery on a failed medium.
1) Create an image file of the source.
2) Set aside the source.
3) Run data recovery programs on the image file.
4) Repeat step three (3) until almost all valuable data is recovered.

More elaborate data recovery is as follows.
1) Dismantle the medium or in this case the hard drive in a clean room
2) Separate and mark the platters
3) Inspect the platters for any debris.
4) If platters are clean, scan them with a laser.
5) The individual image files that make up the platters are put together into one very, very big image file that was done at step 4.
6) Data recovery programs scans the image file, but does not modify the image file.
7) When valuable data is found, it is then copied to a hard drive that works. Failed drive is thrown in the bin.

If you are worry about compatibility of the medium, format the destination hard drive only after doing the data recovery using FAT32. NTFS creates more problems than it is worth.

JFS or XFS is the fastest when they access files that are several gigabytes.
So how much faster are you talking about? (Pointers to objective tests will do, if any)


Though EXT2 and EXT3 does have file size limits for certain kernels, but not XFS and JFS.
Since Large File Support, if there's a limit, it would be in the Terabytes, right?


More elaborate data recovery is as follows.
Isn't that somewhat cost-prohibitive for most people?


format the destination hard drive only after doing the data recovery using FAT32. NTFS creates more problems than it is worth.
While I almost always have to choose FAT32 for compat issues, apart from forcing a freshly NTFS-formatted drive to mount under GNU/Linux using ntfs-3g (dirty flag), I haven't encountered "more problems than it is worth".

finally solved this one and thank God, i got my files back.

what worked for me was to connect the drive while in Ubuntu 7.04. The drive got recognised (unlike in Winxp), and i quickly backed up the files before it changed its mind. I did have to try more than once, because when it started 'clicking', it wouldn't work any more, so i had to repeatedly disconnect and reconnect until i got everything i wanted. may seem a bit dumb, but it worked for me when nothing else would. I cannot recommend Ubuntu enough after this incident!

i couldn't salvage the actual drive in the end, it was too badly damaged and its now going to be recycled.

XFS and JFS are about five times higher throughput than EXT2 or EXT3. On my computers that uses XFS for almost all partitions, it has a throughput about 25 megabytes per second to 35 megabytes per second with only one drive. EXT3 is meant to be used with small files.

I have copied an 8 GB file from one drive and then to another connected on different IDE controllers. I think it took a few minutes. EXT3 will take half an hour to an hour.

brinstar, that is good. Glad we can be of some service.

once more, thanks to all of you. on the issue of speed, i have noticed that xfs seems to be faster than the others, but i have had issues when connecting ntfs drives, but don't seem to have the problem when i use ext3. though when you are in my position and have important files that need recovering, speed is the least of your priorities