Archive for the ‘PC Emergency Room’ Category

PC ER: Recovering a Corrupted Partition with GetDataBack (Review)

Tuesday, June 30th, 2009

Imagine you’re trying to merge two partitions together using a utility like GParted from a live CD and everything is humming along nicely until the power gets cut. Once the power permanently interrupted the merge, Windows would no longer boot, and all of the important data on the drive was inaccessible. At the time I was performing this recovery, I was short on time and had to relocate. I had a quick flash of what had to occur in order to be able to recover every last bit of data from the laptop. I would need an SATA/IDE to USB adapter; a screwdriver; a few bootable CDs (such as Acronis Disk Director bootable disc); and a large external HDD to store the data that would be recovered.

This time around, I decided I’d go with Runtime Software’s GetDataBack (NTFS) because I have had such dismal results with other recovery suites such as Stellar Phoenix Windows Data Recovery and a few others that I probably shouldn’t mention. After futzing around with trying to set up a remote connection using GetDataBack’s HDHost, I realized it wouldn’t work since I couldn’t even boot into even the most basic of Windows, nor would I want to, since it could conceivably corrupt the data on the disc even further. So I did it the old fashioned way, as I mentioned in my post entitled, How to Recover Data From Old Laptops, I took the drive out using my toolkit and plugged it directly into my spare laptop.

(As I mentioned in the past, most laptops have their own proprietary connectors, but once you remove it, it’s either SATA or IDE — not such a big mystery.)
IMI_0280(Laptop HDD plugged into spare laptop, note the SATA connector and Molex-to-SATA adapter as well as the clear-cover external HDD on the left)

Plugging a laptop HDD directly into a computer running Windows Vista is a mistake if you intend to perform sensitive data recovery such as forensic data recovery — you must have a write-block in place to prevent the possibility of writing data back to the drive or altering its contents in any way. For my purposes, I wasn’t too worried about it.

With my mobile recovery rig in place, I set the parameters to recover all it could find — I cannot tell you what settings to choose here because your needs depend on what you are trying to recover and what level of file damage your drive has sustained.

GetDataBack(GetDataBack searching for file systems)
GetDataBack(GetDataBack indicating a found file system; note the “show recommended” option at the lower left)
GetDataBack NTFS(After GetDataBack found the partition, it began loading the data into a easily navigatable GUI tree view)
recovery5(The data recovery process for a 200GB+ drive is lengthy)

This was a 200GB+ drive which was recovered completely by GetDataBack. Although it took quite some time (over two hours for just the initial scan, and another three to four hours for the recovery portion), GetDataBack performed very well. At all times it was stable, reliable and surprisingly informative.

I checked the reliability and completeness of the scan. Sure enough, every single file that had been lost was recovered in its entirety. My experience with GetDataBack has been nothing short of positive and I will continue to recommend it.

admin-email

aim-2-48x48VariableGHz


PC ER: Blue Flash Followed by Restart in Endless Loop

Sunday, February 15th, 2009

Symptoms:

System attempts to load the Windows XP operating system, cuts to black and very quickly flashes a blue screen full of text and reboots in an endless loop. Due to the brief stint of the blue screen, no specific identifiable error messages are retrievable.

Hypothesis:

The system is attempting to display a “stop” error message, commonly referred to as a BSOD (“Blue Screen Of Death”) due to the frequent occurrances of them in the legacy versions of Microsoft Windows. However, because there is a setting in WindowsXP which allows it to “automatically restart” after a catastrophic error, it becomes impossible to read the “stop” error. The BIOS may need updating (as indicated by other issues, such as the need to “start” the computer twice. The hard disk may have a corrupted cluster/sector in a critical area containing Windows system information. If the hard disk checks out fine, then the system memory may have a corrupted area causing a data mismatch and thus needs to be checked.

Diagnosis:

As a primary measure, I elected to scan the entire hard disk using my preferred tool SpinRite 6 using a Level 1 scan to determine the integrity of the hard disk. Below is a video of SpinRite 6 and the Microsoft RAM testing software (permanent archive) in action:

SpinRite revealed an unrecoverable error on my Level 1 scan, so I performed a second scan, this time at a Level 5 which is the most intense: inverting 1’s and 0’s twice to verify.

(SpinRite complete scan with an unrecoverable sector)

(Level 5 is the most intense)

SpinRite has the unique ability to “null” out sectors of data, restore and redirect that data to working areas of a hard disk. It’s serious business, and in this case, was pivotal in getting the system back up to speed in a hurry. Years of quixotically running a computer without any backup procedures, clearing out dust or even so much as defragmenting a hard disk can increase the likelihood of this kind of issue arising.

After SpinRite deferred (“corrected”) the sector, as a precaution I ran the Windows memory testing utility. I let it run for 30 passes (which is serious overkill by the way) and it passed the extended tests with no errors (see video above).

(Microsoft Windows Memory Testing Utility, running extended tests)

I then proceeded to let Windows attempt to boot again. This time, chkdsk fixed a host of errors relating to the damaged sector which can be seen in the above video prior to loading Windows successfully. Even though the PC was now functioning, I would still recommend a new hard drive for this particular unit or at the very least storing important documents and data on a DropBox or similar real-time backup solution.

As a final note, the issues outlined in the Symptoms can be caused by an enormous array of complications: a corrupted MFT (Master File Table), bootsector virus, intermittant PSU (Power Supply Unit), application-specific failures such as Norton GoBack — just to name a few. No matter the root cause, it’s important to approach the issues in a sensible manner tackling larger problems first. For example, let’s say that I assumed it were a software problem such as a virus issue first only to later realize that I had an unrecoverable corrupted sector on the hard disk. I would have wasted hours of downtime diagnosing the wrong problem first. For this reason, when the symptoms are vague, it’s wise to address larger issues first before getting too specific.


PC ER: How-To Recover Photos/Videos/Data from a Damaged SD Card

Monday, January 5th, 2009

(damaged SD card with unreadable data; perhaps due to the worn down contacts?)

Situation:

2GB SD card no longer registers as ‘visible’ to the digital camera and is barely readable within the Vista OS.

Potential Loss:

~1.5GB worth of photos and videos of Hong Kong.

Diagnosis:

Download and install PhotoRec. (permanent archive)

Navigate to the ‘win‘ directory and run “photorec_win.exe” — you will be presented with a similar screen to the following:

(the PhotoRec media selection screen)

Now, on my laptop here, there are essentially two drives that PhotoRec sees: (1) the hard disk, which can be easily recognized as the larger of the two (160GB); and (2) the SD card which weighs in at an easily-discernible 2002MB (2GB). On a desktop system with many hard drives and devices plugged in, this selection screen can be a little tougher on the eyes — so be sure you are selecting the right media.

Next, PhotoRec will ask you to select the “partition table type”; for our purposes, we’re using an “Intel/PC partition.” On next screen, PhotoRec needs to know which partition you want to scan, whether it be the a specific partition, or the entire disk. The default is for it to do the largest partition, I believe, but just to be sure I instruct PhotoRec to scan the entire volume:

(the partition selection screen for PhotoRec, note the default is for the partition, and not the whole volume?)

With “[Whole disk]” selected, I do not change any options but instead hit Enter to “[Search]” and because I selected [Whole disk]; PhotoRec asks me the filesystem type, I simply select “Other” which was the default which encompasses FAT/NTFS, etc. All normal for an SD card.

Now, as a final measure, PhotoRec asks where you want to save the recovered files. This screen is confusing for most people who are not accustomed to DOS-style screens. Look through this screen slowly:

(PhotoRec asks where you want to save the files. Notice the ever so subtle [Y\N] prompt, however?)

As you can see, I launched PhotoRec directly from my downloads folder in Vista because I am not particularly concerned about the location right now. I don’t mind if it stores the files in the directory indicated in the photo, so I can just hit Y on my keyboard and let it scan the volume. However, if you did want to change directories, it would be helpful for you to know that two periods (..) in DOS syntax means “up one directory” — So, using your arrow keys, you can navigate through your directory structure in Windows to find the correct place to put your files. All the way to the right of the screen you’ll see, right near the top, two periods. Those periods let you go back all the way to the root of the drive. Also known as \ or simply the drive letter and a colon.

For my purposes, I hit the Y key and just write the files straight in the downloaded location since I will be moving them later with Windows Explorer anyway:

(PhotoRec, scanning sectors for recoverable data)

Once completed, it will indicate as such on screen. Simply close or quit from the command prompt window. Assuming you left the defaults in place as I have, the recovered data will be in one or more folders inside of the ‘win‘ directory labeled “recup_dir.*”:

(the recovered data from PhotoRec, deposited into the recup_dir.1 directory)

Scrolling through all 41 files, it appears as though that’s about everything. All photos and videos before the card became corrupt and was no longer readable by the camera or the computer. As such, I will not need to pursue further recovery methods which include but are not limited to, the following applications: (1) Stellar Phoenix Data Recovery; (2) GetDataBack; and (3) EnCase Forensic as a final measure.

Good luck.