Hard Drive Data Recovery

Author: Ian Cunningham
Published on: 17-06-2004
Views: 209217


Discuss this article [6 comments]

Methods

Methods of Recovery

More often than not, the cause of the apparent disk failure is due to a corrupt Master Boot Record (MBR) or Partition Table, which often results in a non-booting drive. The most common response to this is to panic and purchase a new drive, or even a new PC in some cases!

Windows includes some very easy to use tools which can sometimes solve this problem, namely the very simplistic SCANDISK and CHKDSK. The former is used on DOS/3.1/95/98/ME whilst the latter is used on NT/XP systems. These applications can often be run from a bootable floppy disk or the Windows installation CD. These built in applications should be your first port of call unless you specifically know what the problem is.

CHKDSK will find and fix most basic MBR problems if you run it directly from a boot disk. If one of your secondary hard drives has failed and you are still able to boot directly in to Windows XP, simply run "CHKDSK /F" from the run command. Usually Windows will automatically attempt to correct such problems without having to run this manually.

If you cannot boot in to Windows XP, copy the CHKDSK file from another PC on to a bootable floppy disk and run it directly from there. You can also run CHKDSK from the Windows XP boot CD via the recovery console.

A very common error which can often render a system unbootable is a "Missing NTLDR or NTDETECT" error. This can be fixed by inserting the Windows XP CD and selecting the Recovery Console. From here you will have to copy the working files from your CD-Rom drive over to your hard drive using the following commands:

COPY X:\i386\NTLDR C:\

COPY X:\i386\NTDETECT.COM C:\

COPY X:\i386\NTDETECT.COM C:\

COPY X:\i386\NTDETECT.COM C:\

COPY X:\i386\NTDETECT.COM C:\

COPY X:\i386\NTDETECT.COM C:\

(where X is the letter of your CD-Rom drive)

The FIXBOOT and FIXMBR commands can repair the Bootsector and Master Boot Record, which can cause major problems when corrupt. These are very straight forward to run, and may need to be run after a particularly nasty virus infection.

One of the most important points for any computer user to remember is to always back up your data. As much as personal computing has advanced over the past 20 years, hard drives still fail. Hard Drives are an amazing piece of mechanical engineering, as then spin (sometimes continuously) at around 120 times per second (7200 rpm). These spinning platters are spinning at such high speeds that a small interference whilst in usage can damage the disk in a certain area. There are now fail safe mechanisms in place to prevent critical failures when there is a small amount of physical damage done to the drive, but accidents do happen.

When some areas of the disk fail, the hard drive is effectively useless. Cases like this usually require specialists to come and recover any data that might be left. If you have made routine backups of your important data, this would be a great inconvenience to restore and install all the applications and data once more, but still recoverable. If you were unfortunate enough not have any backups (or not recent ones), then you are in trouble. Data Recovery is a very time consuming process, and often quite expensive. Fortunately, there are some data recovery procedures that you can try before having to resort to professionals.

Sometimes a hard drive can be partitioned in to several drives that appear on the computer, and in some cases a single partition from several partitions can fail on one physical drive. This means that all is most likely not lost, and it will probably be recoverable with a little work. Many people simply give up and purchase a new drive, loosing all data, when they could easily recover the data first.

If your hard drive makes ill-sounding mechanical failure noises (loud clicking, rattling, scratching), then back up your data as fast as possible and buy a new hard drive. If you fail to recover the data when the drive is on the brink of no return, you will often have to pay for a specialist data recovery company to recover the data from the physically damaged drive.

Understanding

Understanding how Hard Drives store data

You can check the status of your partitions and file systems by running the Computer Management application that comes with Windows XP (Right click 'My Computer', then 'Manage', then 'Disk Management'). The example below shows a single 30GB drive which has one primary FAT32 partition.

Every hard drive runs a type of File System, a method by which the operating system installed can organise data and free space in a way that it can be written to and read from. Each physical disk can be split up into many partitions, each partition can in turn appear as a logical drive (addressed C:, D:, E: etc...). This guide will only deal with the 2 primary partition types used for Windows Operating Systems - FAT16/32 and NTFS.

NTFS (NT File System) is now the most common File System, and it is used by Windows NT/XP. FAT-32 is used by Windows 98 and upwards, where as FAT-16 was used by DOS/3.1/95. The most recent operating systems are backwards compatible with older file systems, and can read/write to secondary disks based on the older file system.

Both file systems organise the way the data is stored by using a Master Boot Record (MBR) and a Partition Table. These are found in the first sector of the drive, and determine how the disk structure is organised and instructs the computer which partition to boot from.