Imagine you’re trying to merge two partitions together using a utility like GParted from a live CD and everything is humming along nicely until the power gets cut. Once the power permanently interrupted the merge, Windows would no longer boot, and all of the important data on the drive was inaccessible. At the time I was performing this recovery, I was short on time and had to relocate. I had a quick flash of what had to occur in order to be able to recover every last bit of data from the laptop. I would need an SATA/IDE to USB adapter; a screwdriver; a few bootable CDs (such as Acronis Disk Director bootable disc); and a large external HDD to store the data that would be recovered.

This time around, I decided I’d go with Runtime Software’s GetDataBack (NTFS) because I have had such dismal results with other recovery suites such as Stellar Phoenix Windows Data Recovery and a few others that I probably shouldn’t mention. After futzing around with trying to set up a remote connection using GetDataBack’s HDHost, I realized it wouldn’t work since I couldn’t even boot into even the most basic of Windows, nor would I want to, since it could conceivably corrupt the data on the disc even further. So I did it the old fashioned way, as I mentioned in my post entitled, How to Recover Data From Old Laptops, I took the drive out using my toolkit and plugged it directly into my spare laptop.

Plugging a laptop HDD directly into a computer running Windows Vista is a mistake if you intend to perform sensitive data recovery such as forensic data recovery — you must have a write-block in place to prevent the possibility of writing data back to the drive or altering its contents in any way. For my purposes, I wasn’t too worried about it.

With my mobile recovery rig in place, I set the parameters to recover all it could find — I cannot tell you what settings to choose here because your needs depend on what you are trying to recover and what level of file damage your drive has sustained.

This was a 200GB+ drive which was recovered completely by GetDataBack. Although it took quite some time (over two hours for just the initial scan, and another three to four hours for the recovery portion), GetDataBack performed very well. At all times it was stable, reliable and surprisingly informative.

I checked the reliability and completeness of the scan. Sure enough, every single file that had been lost was recovered in its entirety. My experience with GetDataBack has been nothing short of positive and I will continue to recommend it.

admin@variableghz.com

Symptoms:

System attempts to load the Windows XP operating system, cuts to black and very quickly flashes a blue screen full of text and reboots in an endless loop. Due to the brief stint of the blue screen, no specific identifiable error messages are retrievable.

Hypothesis:

The system is attempting to display a “stop” error message, commonly referred to as a BSOD (“Blue Screen Of Death”) due to the frequent occurrances of them in the legacy versions of Microsoft Windows. However, because there is a setting in WindowsXP which allows it to “automatically restart” after a catastrophic error, it becomes impossible to read the “stop” error. The BIOS may need updating (as indicated by other issues, such as the need to “start” the computer twice. The hard disk may have a corrupted cluster/sector in a critical area containing Windows system information. If the hard disk checks out fine, then the system memory may have a corrupted area causing a data mismatch and thus needs to be checked.

Diagnosis:

As a primary measure, I elected to scan the entire hard disk using my preferred tool SpinRite 6 using a Level 1 scan to determine the integrity of the hard disk. Below is a video of SpinRite 6 and the Microsoft RAM testing software (permanent archive) in action:

SpinRite revealed an unrecoverable error on my Level 1 scan, so I performed a second scan, this time at a Level 5 which is the most intense: inverting 1′s and 0′s twice to verify.

(Level 5 is the most intense)

SpinRite has the unique ability to “null” out sectors of data, restore and redirect that data to working areas of a hard disk. It’s serious business, and in this case, was pivotal in getting the system back up to speed in a hurry. Years of quixotically running a computer without any backup procedures, clearing out dust or even so much as defragmenting a hard disk can increase the likelihood of this kind of issue arising.

After SpinRite deferred (“corrected”) the sector, as a precaution I ran the Windows memory testing utility. I let it run for 30 passes (which is serious overkill by the way) and it passed the extended tests with no errors (see video above).

(Microsoft Windows Memory Testing Utility, running extended tests)

I then proceeded to let Windows attempt to boot again. This time, chkdsk fixed a host of errors relating to the damaged sector which can be seen in the above video prior to loading Windows successfully. Even though the PC was now functioning, I would still recommend a new hard drive for this particular unit or at the very least storing important documents and data on a DropBox or similar real-time backup solution.

As a final note, the issues outlined in the Symptoms can be caused by an enormous array of complications: a corrupted MFT (Master File Table), bootsector virus, intermittant PSU (Power Supply Unit), application-specific failures such as Norton GoBack — just to name a few. No matter the root cause, it’s important to approach the issues in a sensible manner tackling larger problems first. For example, let’s say that I assumed it were a software problem such as a virus issue first only to later realize that I had an unrecoverable corrupted sector on the hard disk. I would have wasted hours of downtime diagnosing the wrong problem first. For this reason, when the symptoms are vague, it’s wise to address larger issues first before getting too specific.

admin@variableghz.com

Situation:

2GB SD card no longer registers as ‘visible’ to the digital camera and is barely readable within the Vista OS.

Potential Loss:

~1.5GB worth of photos and videos of Hong Kong.

Diagnosis:

Download and install PhotoRec. (permanent archive)

Navigate to the ‘win‘ directory and run “photorec_win.exe”

Now, on my laptop here, there are essentially two drives that PhotoRec sees: (1) the hard disk, which can be easily recognized as the larger of the two (160GB); and (2) the SD card which weighs in at an easily-discernible 2002MB (2GB). On a desktop system with many hard drives and devices plugged in, this selection screen can be a little tougher on the eyes — so be sure you are selecting the right media.

Next, PhotoRec will ask you to select the “partition table type”; for our purposes, we’re using an “Intel/PC partition.” On next screen, PhotoRec needs to know which partition you want to scan, whether it be the a specific partition, or the entire disk. The default is for it to do the largest partition, I believe, but just to be sure I instruct PhotoRec to scan the entire volume. The partition selection screen for PhotoRec has the default set for the partition, and not the whole volume, curiously.

With “[Whole disk]” selected, I do not change any options but instead hit Enter to “[Search]” and because I selected [Whole disk]; PhotoRec asks me the filesystem type, I simply select “Other” which was the default which encompasses FAT/NTFS, etc. All normal for an SD card.

Now, as a final measure, PhotoRec asks where you want to save the recovered files. This screen is confusing for most people who are not accustomed to DOS-style screens. So be sure to look through the screen very carefully and slowly — you don’t want to rush this.

I launched PhotoRec directly from my downloads folder in Vista because I am not particularly concerned about the location. I don’t mind if it stores the files in the directory indicated in the photo, so I can just hit Y on my keyboard and let it scan the volume. However, if you did want to change directories, it would be helpful for you to know that two periods (..) in DOS syntax means “up one directory” — So, using your arrow keys, you can navigate through your directory structure in Windows to find the correct place to put your files. All the way to the right of the screen you’ll see, right near the top, two periods. Those periods let you go back all the way to the root of the drive. Also known as \ or simply the drive letter and a colon.

For my purposes, I hit the Y key and just write the files straight in the downloaded location since I will be moving them later with Windows Explorer anyway.

Once completed, it will indicate as such on screen. Simply close or quit from the command prompt window. Assuming you left the defaults in place as I have, the recovered data will be in one or more folders inside of the ‘win‘ directory labeled “recup_dir.*”:

(the recovered data from PhotoRec, deposited into the recup_dir.1 directory)

Scrolling through all 41 files, it appears as though that’s about everything. All photos and videos before the card became corrupt and was no longer readable by the camera or the computer. As such, I will not need to pursue further recovery methods which include but are not limited to, the following applications: (1) Stellar Phoenix Data Recovery; (2) GetDataBack; and (3) EnCase Forensic as a final measure.

Good luck!

admin@variableghz.com

This is one of the worst kind of error messages you can receive. Typically, however, one can conclude that either the hard drive is not functioning properly, the BIOS cannot detect the hard drive — or — if you’re really lucky, it’s a simple, dumb mistake like leaving a USB flash drive in the computer and the BIOS is attempting to boot from it or the wrong HDD has the priority for boot. That can easily cause the operating system not found error message.

The system that we’re talking about here is an old Dell Dimension from the Windows98 era. This particular computer had been used by various people over the years as a gaming,, Internet and mostly email station. It had never been opened before, so it surely had tons of dust from the 90′s in there.

Because the system has functioned without any hardware failures over the past decade, I immediately assumed the hard drive had finally come to it’s natural end and crashed once and for all.

However, I booted the computer up and attempted to enter the BIOS. The BIOS splash screen had a full screen Dell logo and amidst their blatant, enormous advertising failed to mention which key was necessary to get into the BIOS. I took the usual guesses and just hammered on F2 and DEL until it let me in.

Once in, I Immediately noticed that the BIOS was unable to “see” the hard drive. It could see the CD-ROM, Iomega ZIP drive and floppy, but no HDD. This leads me to believe it is a hardware issue, worse case scenario the hard drive would be nonresponsive. But, I would need to open the computer and check which was a particular pain for this system.

After I cracked the system open, since I was without an anti-static wrist wrap, I placed my hand on the PSU (power supply unit) in order to ground my hand to prevent any static discharge that may have accumulated on me. I then placed my hand on the HDD and powered on the computer. I could not feel the hard drive spin-up at all.

Now, when a hard drive doesn’t spin up at all, and you can’t hear the “whirr” of the motor spinning the drive up to 7,200 rpm or whatever the speed is (the stepper motor), then several things may be wrong: (1) a surge may have damaged the motor in the hard drive; (2) the controller card may be defective, has failed, etc. requiring an exact replacement in order to retrieve contents; (3) insufficient/excessive voltage (defective molex or SATA cable, for example); (4) all of the above and many more. Essentially, the problem isn’t easy to narrow down and you’ve got a real problem if none of that data has been backed up.

Much has been said about a couple of controversial methods when a hard drive fails, you may have heard of them: (1) placing the afflicted hard drive in a plastic bag, placing it in the freezer, once frozen attempting to very quickly remove the data; and/or (2) slam the hard drive on the ground from about 3 feet in the air and again attempt to remove the data very quickly. Now, I do not recommend either of these options. I would much prefer for you to go to a specialized place like i365, Seagate’s data recovery service or DriveSavers. Those folks have extremely specialized equipment, cleanrooms and truckloads of various controller cards to be able to get your data off successfully. Thing is, they cost nearly a fortune, so you’ll need to ask yourself, what’s my data really worth?

Anyhow, I considered the possibility that the four-pin molex cable could have been damaged in some way, so I removed it and replaced it with a different molex connector nearby. In typical Dell fashion of course, they mounted the hard drive vertically and stashed it in the front of the machine in a difficult to reach location, wedged right under a large block of plastic which made removing the molex connector (and inserting the new one) nearly impossible. Dell continues to do this to this day, I have no idea why.

Using a very long flathead screw driver, I was able to remove the molex cable and attach a new one. No difference, the hard drive was toast. I made a judgment call and decided the Windows98 box was simply not worth rescuing. With no time to spare, I unplugged everything and hooked up a computer I had brought with me (a Dell Optiplex 280 small form factor) since I had feared that this exact scenario would play out (I always come prepared).

The “new” system is a Pentium III with 512MB of RAM and an 80GB HDD. Perfect for an e-mail/Internet system. I configured it with WindowsXP Media Center Edition (MCE).

After setting up the “new” computer, I plugged in the Comcast USB cable modem they had and of course it needed a device driver (“USB Cable Modem”) that they did not have. It’s always a catch 22 when you need drivers to get online, and the drivers are online. Moreover, the new computer I brought didn’t have a dial-up modem built in, so I took the old modem from the Windows98 box and stuck it into the PCI slot of the new system.

By chance, I remembered that my boss has an Earthlink account that we use at my place of employment, so I entered that information into the Dial-Up Connection Manager, but alas I needed an Internet connection in order to retrieve the list of Earthlink access numbers for dial-up. Since I was way at the top of the Berkeley hills, there was no Internet access available to me on my cellular telephone. So I called up my programmer and held my phone really steady to avoid being cut off as he read me off some Earthlink local access numbers.

Earthlink access numbers in hand, I was able to make a flashback-inducing trip to 1997 as I connected via dial-up:

From there I was able to finally get the driver for the “USB Cable Modem” and get things working again. If you have your own methods of jumpstarting dead hard drives, let everybody know. I am going to be taking this old Windows98 Dell HDD and trying to see if I can get it going — the data isn’t valuable enough for a drive repair service, so this should be fun.

As always, shoot me an e-mail with any questions.

admin@variableghz.com