Using Knoppix to recover dead hard drives

[glavanway]

I have heard in passing that knoppix can be used to recover dead hard drives. I have never actually done. Now my father has sent me a dead hard drive with amongst other things pictures. Does anyone know / have experience recovering hard drives with knoppix? This particular hdd when I plug it into windows it says it is not initialized, when I plug it into knoppix (via USB) it doesn't seem to notice it at all.

Any help would be appreciated!
Greg

[Randy]

My thoughts:

It really depends upon what precisely is wrong with it. If the electronics aren't any good, you won't find a PC or operating system that will recognize it.

With this being a USB device, you may need to remove it from the case and plug it into a native (for the device) bus. That may require some kind of adapter, though. USB drives typically have an IDE or SATA converter which may be why you get that message if that portion is non-functional.

FYI... you're not limited to just using Knoppix for recovery, either. An Ubuntu CD works just as well.

As always, you're welcome to bring it to the next meeting to see if someone can help. Good luck!

[glavanway]

Sorry for the confusion. It is an IDE drive. I attached it to the linux laptop with a usb adapter. What I really need to know is what tools are on Knoppix (or any linux distro) that I can use to try to recover the data? I am aware of testdisk and gparted. Are there others?

-Greg

[Davemon]

What size and model? Someone may have a replacement pc board if that is the issue.


Davemon

[glavanway]

I doubt it's the pc board, or atleast I not at that point yet. Anyway it's a Maxtor Maxline Plus II, 250GB ATA/133 HDD, mfg date 04MAY2004, SN: Y639ZONE.

Still interested in disk recovery tools if anyone can recommend one.

-Greg

[Davemon]

I recommend this.

http://www.ultimatebootcd.com/


Ultimate Boot CD. Should have all the utilities to check the hard drive and then maybe repair the OS.



Sierra Dave

[hronmeer]

Whenever we have a hard drive fail at the office, Knoppix is what I've normally used to recover the files. Otherwise, I just throw the drive in a external case and plug it into the USB port on a working machine. Sometimes, Windows won't recognize the drive when I try the second drive, but I can usually recover most if not all of the files when I use Knoppix, unless there's major physical damage to the drive.

I've never tried using it to do any kind of repair to the file system of the drive, or anything like that, though.

[stack]

Sorry for being late to the conversation...Kinda slacking on my internet postings the last few months....

Anyway, here is my recommendation. It will require a LOT of hard drive space. If you can get the computer to recognize the drive, I would copy the data before the drive quits completely.

If you have space on your home partition (for example) and your dead/failing hard drive is /dev/sdb then you can do:
dd if=/dev/sdb of=/home/hronmeer/drive.img

This will create an exact replica of your drive for you to mess with so you don't destroy the original data. Since it is an exact replica you will need at least 250GB free space in home.

After this, you can run testdisk (http://www.cgsecurity.org/wiki/TestDisk). There are tons of good tutorials on the site and on Google. Just be aware that if you don't use any filters, it will try to recover EVERY file it finds regardless of how complete it is. This will use lots of hard drive space. You should be able to filter out file types rather easily if you are looking for specific files.

Foremost is fantastic for forensics work, so you should easily be able to use it to recover files from the image.

If you are working with an ext2 or ext3 drive you can look into e2undel and ext3grep.

I never got magicrescue to work efficiently when I used it, but I have heard good reviews from others.

One new set of tools that I just heard about but haven't gotten a chance to work with is the "recover" tools (recover, recoverdm, recoverjpeg).

Another one I have not tried yet is for NTFS drives (dont use NTFS much since I use Windows as little as possible) is scrounge-ntfs.


Well that is all I have got for now...

Oh...BTW...all of these tools are in the Debian repos (and a quick check shows in Ubuntu as well) so all of the tools should be in whatever Debian based live cd you are using (aka Knoppix).

Hope this helps!

~Stack~