Damn Small Linux - Not!

toob · Joined: 23 Jul 2006 Posts: 1

Greetings,

I have obtained DSL to assist me in identifying whether or not a Windows-based harddrive still contains readable data. I have successfully accessed DSL on the machine which contains the potentially dead drive (hereinafter "PDD") which is 250 GB. The death occurred during a severe t-storm that ripped through here on Friday night before I got a chance to unplug everything. In Windows, the drive shows up as "Disk 1 - Dynamic - Unreadable." Have installed drive in another Win2k machine with the same results.

I am not swift whatsoever in Linux. However, I do realize that it could care less about how Windows views things and therefore I thought using DSL would be a good route to go to see if I could still access and save the data from this PDD (I believe there are 7-8 partitions on it, not sure whether it is all completely partitioned out yet or whether there is still some unallocated space).

When I go into the file manager and view the contends of \dev, I see a list of drives beginning with hda and going through to hdh20. Some are files, some are directories. When I attempt to view the directories, they say 'permission denied.' When I open the files, they are read only and are blank. I can't begin to tell which of these hd's are the ones belonging to the PDD.

Could someone kindly assist me with walking me through the steps necessary to try and mount this PDD, if possible, so that I can potentially save its contents (thousands of photos, etc.)? I know, I should have been better at doing backups. Believe me, I've already beat myself up over this! Crying or Very sad

Thank you so much in advance for any insight anyone can provide. And please, be easy on me Wink

Del · Joined: 08 Jul 2006 Posts: 11 Location: IE, CA, US

Fire up a shell window (click ATerminal on desktop)
Type "sudo su" without quotes
Type "more /etc/fstab" without quotes
Make note of lines that look like this;
/dev/hda1 /mnt/hda1 ntfs noauto,users,exec 0 0
For each one type "mount /mnt/hdXN" (no quotes, X being a letter, N being a number, eg /mnt/hda2 or /mnt/hdb1)
type "cd /mnt/hdXX"
type "ls -la" for a detailed listing of what's in that directory
type "cp -Rp /mnt/hdXN/* /path/to/backup/drive" to copy everything in hdXN to your backup drive (if you've got one, don't know just what your strategy is)
Lather, Rinse, Repeat

WDef · Joined: 30 Apr 2006 Posts: 20

A few blahs on this topic in general.

If you are serious about recovering partially lost or at-risk data on that drive, first use df to copy everything from the unmounted device to another device of the same or greater size (google). Then work on the copy drive, not the original - if you accidentally write to the copy and overwrite something, you've still got the original. Or use something like (eg) Norton Ghost to make a drive image. Then use a good data recovery tool on the copy. Commercial forensic programs (eg EnCase (Windows)) come with a built-in imaging and data recovery capability and sophisticated search tools. No doubt there are linux equivalents.

Live cds like INSERT and KnoppixSTD come with built in data recovery progs, I haven't tried these.

If the data on the drive is absolutely critical, don't try to recover or even mount it yourself. Take it to a specialist data recovery firm (will cost $$$).