Charlie said:
My daughter has an old Win 98 computer that she was trying to get some
data from. She has no backup (she's a lawyer, so I suspect that's part
of the problem) and the computer wouldn't boot up. So I removed the
HD. It's an old Seagate, 3 GB, ST33220A. I connected it (PATA
interface) and tried to read the data, without success. Windows will
see it, but won't read anything from it and properties reports zero
size. I'm hoping that it's just the boot tracks that are messed up and
that the data on it is still OK.... but have no clue as to how to get
to the data. I'd appreciate any suggestions.
I agree with the backup sentiment.
What I'd do, is connect the drive to my desktop, boot a Linux LiveCD, and
"dd" the 3GB (if it will all read) and store it somewhere safe. First
attempt would be a plain "dd" command, available in any Linux.
dd if=/dev/hda of=/media/WINXP/downloads/savemybutt.dd
On my machine, my C: partition has a label of "WINXP", and when
Linux runs and I click on the disk icon, my C: drive becomes /media/WINXP.
That command assumes you're using an NTFS partition, because many times
the disk being copied, is larger than the 4GB limit of FAT32. Modern Linux
distros can handle NTFS, so you can save the resulting file on the main hard
drive. Since in your case, the image of the disk is only 3GB in size, it
would even fit on a FAT32 partition which has a 4GB max file size. Normally,
I'd be making sure the destination was an NTFS partition, because the file
would be larger than that.
Once you have some kind of sector by sector backup copy, you can experiment all
you want with the lawyer's data. You can put the image back later, if you
make a mistake.
dd if=/media/WINXP/downloads/savemybutt.dd of=/dev/hda
Part of the fun, is figuring out whether /dev/hda is the 3GB disk or not.
Disks have many potential names, and doing "ls /dev" might hint at the name.
For example, if the disk had one partition, I might see /dev/hda and /dev/hda1,
with the latter being the first partition, and the former being the whole disk.
Since both of my current hard drives, have four primary partitions each, I
end up with at least ten entries in /dev that look interesting.
*******
If the disk has "bad spots", there is a suggestion here.
http://www.cgsecurity.org/wiki/Damaged_Hard_Disk
./ddrescue -n /dev/old_disk /dev/new_disk rescued.log
./ddrescue -r 1 /dev/old_disk /dev/new_disk rescued.log
What that special version does, is keep track of what it can read
and what it can't read. The first pass is quick, and picks up most
of the (easily read) data, while the second pass tries a bit harder
to fill in the gaps. Any sectors which can't be read, are replaced
with zeros, so as far as I know, the output size should still be
the same, even if data is missing. This approach is reserved for
stuff you're about to send off to a $$$Data_Recovery firm, where you
want to keep as much as possible locally, before sending off the disk.
If there wasn't a special approach available, and the disk spent 15 seconds
for each bad sector, and the disk was terabyte sized, a copy attempt
might never finish. That's why at some point, if you notice a "bad spot"
when trying to make your backup copy, then the status of the disk
changes measurably, from "probably just some little thing" to "shit,
I gonna lose the whole thing".
Paul
