Tag Archives: getdataback

data recovery using selfimage getdataback for ntfs

Computer Aid Posted on by

I was asked to attempt to recover some data from a failed HDD.

The 40GB drive didn’t make any strange noises, and while connected to another PC, I could see files and folders.

Just to be safe, I froze the drive, then ran selfimage (in order to minimise the time the drive was left running).

I ended up making 3 images, but each time, I would only get 35 GB before selfimage would fail.

Once I had the images, I used getdataback to read the image, and extract all the files and folders to an area of my hard drive.

Since it was very likely that the last few gigabytes on the drive were mostly “empty” I figured I must have all the data I need.

The only problem was that many of the folder names had been lost… so most folders had names like: [001234], but the filenames and contents seemed perfect.

Since the customer was specifically looking for his accounting software, and his emails, I place them onto a seperate CD, with instructions on how to import the emails (which I tested previously).

The customer is very happy, as the data recovery only cost him a small part of the $2000 plus he was quoted by a PC “shop”.

data recovery using: r-studio, getdataback, nucleus kernel, stellar phoenix

Computer Aid Posted on by

Got a computer that wouldn’t start. Owner says she got a power surge.

The owner desperately wants to recover some accounting data (and if possible email address book and some excel and word documents from my documents). Her 2 sons also ask about their mp3’s.

I say I’ll do my best.

At the office, I see windows xp won’t boot… not even safe mode. I boot bartPE, but viewing the HDD proves near impossible.

I run a chkdsk (hdd is NTFS, and just 20 GB in size), and it finds many bad sectors… it cleans thing up, but then crashes part-way through the process. I try it again, and it gets most of the way through, but seems to freeze just after verifying USN… after 30 minutes, I pull the plug.

I then try my usual trick of plugging the drive into an existing XP system (making sure its set as a slave drive), and boot up… but I get to just after the windows start screen (the one with the moving horizontal bar)… Ie the part where the screen goes black for 1 or 2 seconds… I wait for the logon screen, but the screen just stays blank. The corrupt drive makes seeking noises for a minute or two, then goes quiet.

I try the same thing with a different PC, but get the same result. It looks like a faulty drive attached to an XP system can actually stop XP from booting (even if it boots from a non-faulty drive!)

Using BartPE seems to be the best way to get at the drive.

I figure: its time I got some serious data recovery software. So I try out the 4 that seems to get the best reviews.

Of course, not being able to start XP is my first obstacle. But I install them and take a look anyway.

At first, I like r-studio and getdataback, as they have the option to make an image of the drive/partition, and then work from the image file (thus saving wear and tear on a failing drive).

Nucleus and stellar work directly on the drive, and I suspect are useful when you just want to restore a few files.

I jump back into BartPE, and try running these programs from “bart”.

  • Getdataback complains about a missing DLL file… so I give up and try the next one.
  • R-studio started creating an image file, but takes 10 second each time it hits a bad sector… so after 1 hour, and less than 1% of the drive imaged (and the drive gets hot and less reliable after 40 minutes), I decide to try the next one.
  • Nucleus Kernel Fat and Ntfs : Insists on doing a very long scan of the drive… after 10 minutes and 1% of the drive scanned, I stop and try the next one.
  • Stellar Phoenix Recovery Suite has a reasonably fast scan (it scanned the 20GB drive in just 15 minutes). After that I saved the scan info the disk on my own drive, then selected the files to restore (total of about 600Mb), and I managed to copy them to my drive in about 45 minutes… Not very fast, but good enough.

After all this, I decided I need to find something that can image a drive quickly, and that will run with bartPE. I’ll give ghost 8.2 a try, but not sure if it will work with ntfs (nor how fast it is when dealing with bad sectors).

But the important thing is I restored the important data (minus the mp3s… that could have taken many hours of heat-generating, drive-destroying work).

All up, quite time-consuming (and expensive), but the customer is very happy to get her data back.

I get the data back to her (she is very grateful) and give her various options on where to go from here.

She initially wants to buy a new box, but given that upgrading the existing system to a new HDD, some more ram, and a DVDRW, all costs about half of a new system (and I assure her that it will be fast enough for her needs), then she goes for the “upgrade”.

So I install the new parts, install windows xp, install antivir, winpatrol, spywareblaster, nero, run autoPatcher, do some additional tuning, and the “old” system is ready to go (and quite quick too).