Re: [PLUG] OT - data recovery service?

On Wed, Mar 25, 2009 at 12:30 PM, brent timothy saner <brent.saner@gmail.com> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julien Mills wrote:
> Hi all,
>
> One of my coworkers brought in his neighbor's laptop
> with a dying/dead harddrive. Apparently it has some
> pictures on it which, if lost, his wife will kill
> him.
>
> So, has anyone used a data recovery service around
> here in Philly that they would recommend? Its an
> HP Pavilion laptop and probably running XP.
>
> ------------------------------------------------------
> Julien Mills julienfmills@yahoo.com
>
>

if you can see the drive show up in /dev on a livecd (i recommend System
Rescue CD- www.sysresccd.org), you can give this a shot yourself- you'll
need a usb chassis for it (i'm guessing it's a 3.5" laptop IDE) and
probably an appropriate converter.

rule number one is always work with an image of the drive so the first
thing you want to do is get one. dd doesn't like certain errors and will
crap out the second it hits a bad sector. that's why you'll want to use
GNU ddrescue (http://www.gnu.org/software/ddrescue/ddrescue.html should
be in your repos). not to be confused with dd_rescue; ddrescue is a
rewrite of the latter that works a bit better.

mount that image (might need to chkdsk it.. i BELIEVE hiren's bootcd
should have an MS chkdsk). you can also try ntfs fix on the image if
needed but chkdsk is considered the superior option there, as ntfsfix
pretty much only fixes some inconsistencies and scrubs the journal (and
marks the partition as needing a chkdsk. this is all kind of irrelevant
since we're dealing with an image and not physical media, but i digress).

ANYWAYS. you can then mount that image and get the date from it.

this is all still working under the premise, of course, that you're only
dealing with a couple bad blocks where some key system files.might be.
another thing that may have happened is the partition table was
corrupted; gpart is usually pretty good with fixing this.
lastly, another possibility is the MBR got massed up (not too uncommon)-
fixmbr etc. should help with that (pretty common thing, check google).

if it's actual electronics or mechanical failure, you'll want to send it
to a place like OnTrack in New Jersey.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAknKXD4ACgkQ8u2Zh4MtlQrzDQCgt5PvrCpD0VujVT2dNdqkEfG7
nwsAmwS+5y5V+2oS1+byuyeh3dM2I3uh
=6wG/
-----END PGP SIGNATURE-----

___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug