Hard Drive Data Recovery

Hard Drive Data Recovery

One of the most important points for any computer user to remember is to always back up your data. As much as personal computing has advanced over the past 20 years, hard drives still fail. Hard Drives are an amazing piece of mechanical engineering, as then spin (sometimes continuously) at around 120 times per second (7200 rpm). These spinning platters are spinning at such high speeds that a small interference whilst in usage can damage the disk in a certain area. There are now fail safe mechanisms in place to prevent critical failures when there is a small amount of physical damage done to the drive, but accidents do happen.

When some areas of the disk fail, the hard drive is effectively useless. Cases like this usually require specialists to come and recover any data that might be left. If you have made routine backups of your important data, this would be a great inconvenience to restore and install all the applications and data once more, but still recoverable. If you were unfortunate enough not have any backups (or not recent ones), then you are in trouble. Data Recovery is a very time consuming process, and often quite expensive. Fortunately, there are some data recovery procedures that you can try before having to resort to professionals.

Sometimes a hard drive can be partitioned in to several drives that appear on the computer, and in some cases a single partition from several partitions can fail on one physical drive. This means that all is most likely not lost, and it will probably be recoverable with a little work. Many people simply give up and purchase a new drive, loosing all data, when they could easily recover the data first.

If your hard drive makes ill-sounding mechanical failure noises (loud clicking, rattling, scratching), then back up your data as fast as possible and buy a new hard drive. If you fail to recover the data when the drive is on the brink of no return, you will often have to pay for a specialist data recovery company to recover the data from the physically damaged drive.

Understanding how Hard Drives store data

You can check the status of your partitions and file systems by running the Computer Management application that comes with Windows XP (Right click 'My Computer', then 'Manage', then 'Disk Management'). The example below shows a single 30GB drive which has one primary FAT32 partition.

Recovery_DiskMan.gif


Every hard drive runs a type of File System, a method by which the operating system installed can organise data and free space in a way that it can be written to and read from. Each physical disk can be split up into many partitions, each partition can in turn appear as a logical drive (addressed C:, D:, E: etc...). This guide will only deal with the 2 primary partition types used for Windows Operating Systems - FAT16/32 and NTFS.

NTFS (NT File System) is now the most common File System, and it is used by Windows NT/XP. FAT-32 is used by Windows 98 and upwards, where as FAT-16 was used by DOS/3.1/95. The most recent operating systems are backwards compatible with older file systems, and can read/write to secondary disks based on the older file system.

Both file systems organise the way the data is stored by using a Master Boot Record (MBR) and a Partition Table. These are found in the first sector of the drive, and determine how the disk structure is organised and instructs the computer which partition to boot from.

Recovery Methods

More often than not, the cause of the apparent disk failure is due to a corrupt Master Boot Record (MBR) or Partition Table, which often results in a non-booting drive. The most common response to this is to panic and purchase a new drive, or even a new PC in some cases!

Windows includes some very easy to use tools which can sometimes solve this problem, namely the very simplistic SCANDISK and CHKDSK. The former is used on DOS/3.1/95/98/ME whilst the latter is used on NT/XP systems. These applications can often be run from a bootable floppy disk or the Windows installation CD. These built in applications should be your first port of call unless you specifically know what the problem is.

Recovery_CHKDSK.gif

CHKDSK will find and fix most basic MBR problems if you run it directly from a boot disk. If one of your secondary hard drives has failed and you are still able to boot directly in to Windows XP, simply run "CHKDSK /F" from the run command. Usually Windows will automatically attempt to correct such problems without having to run this manually.

If you cannot boot in to Windows XP, copy the CHKDSK file from another PC on to a bootable floppy disk and run it directly from there. You can also run CHKDSK from the Windows XP boot CD via the recovery console.

A very common error which can often render a system unbootable is a "Missing NTLDR or NTDETECT" error. This can be fixed by inserting the Windows XP CD and selecting the Recovery Console. From here you will have to copy the working files from your CD-Rom drive over to your hard drive using the following commands:

COPY X:\i386\NTLDR C:\
COPY X:\i386\NTDETECT.COM C:\

(where X is the letter of your CD-Rom drive)

Code:
[B]C:\>copy x:\i386\ntldr c:\[/B]



[B]Overwrite NTLDR? (Yes/No/All): y
1 file(s) copied.[/B]

[B]C:\>copy x:\i386\ntdetect.com c:\
Overwrite NTDETECT.COM? (Yes/No/All): y
1 file(s) copied.[/B]

The FIXBOOT and FIXMBR commands can repair the Bootsector and Master Boot Record, which can cause major problems when corrupt. These are very straight forward to run, and may need to be run after a particularly nasty virus infection.

Code:
[B]C:\>fixboot[/B] [B]/?[/B]



[B]Writes a new bootsector onto the system partition.[/B]

[B]FIXBOOT [drive:][/B]

[B]Specifies the drive to which a boot sector will be written, overriding the default choice of the system boot partition.[/B]

[B]FIXBOOT is only supported on x86-based computers.[/B]

[B]C:\>fixmbr /?
Repairs the master boot record of the boot partition.[/B]

[B]FIXMBR [device-name][/B]

[B]Optional name that specifies the device that needs a new MBR. If this is left blank then the boot device is used.[/B] [B]If FIXMBR detects an invalid or non-standard partition table signature, it prompts you before rewriting the master boot record (MBR).[/B]

[B]FIXMBR is only supported on x86-based computers.[/B]

Serious Problems

BIOS related errors:

These tips may work when you receive a hard drive error in initial POST or BIOS startup screen. It has been known for the following factors to cause problems, although it is most likely something more serious if it happened spontaneously.



    • Check the CMOS battery
    • Reconnect IDE/SATA cables and Power cable
    • Change IDE channel
    • Swap the IDE Cable
    • Check Jumpers
Post BIOS errors:

If the drive is detected in the BIOS without a problem, but refuses to boot into Windows, you will most likely have a problem with your MBR or partition table. The best approach would be to follow the tips already suggested on the previous page.

No Spin Up / Clicking / Scratching Sounds:

The following solutions are only to be attempted as a last chance to save the data on the drive, if you don't want to use the more expensive professional data recovery services available. These solutions may sound like "old wives tales", but they have worked in many instances where the drive seems to be dead.



    • Remove the hard drive from the drive cage and tap firmly with a knuckle on the outer casing (not hard enough to damage the unit). The shock may free any stuck mechanisms.
    • Place the hard drive upside down in the drive cage. This causes a slight change in head geometry due to gravity and can occasionally solve the problem.
    • Putting the hard drive in a waterproof bag and then sticking it in the freezer overnight and then straight back into the PC. If you are lucky, this method may work and will allow you to quickly transfer the data before it dies again. The physics behind the method is unknown, but could be related to the expansion/contraction of the metal components inside freeing any mechanisms. This has been reported to work quite often, but the effects will not last for long at all.
Conclusion

There is no doubt that hard drives have a finite life, and failures do happen even after only a few years of normal usage. In this case, prevention is better than cure, as it can be difficult and costly to restore data once it is lost.

The most common drive errors such as corrupt MBRs and bad sectors are fairly straight forward to resolve. If you have a mechanical failure, your only hope are the methods suggested within the article, unless you are willing to create a hybrid drive using working components from an identical drive (not recommended unless you have patience, a steady hand and a clean room!).

If the data you have is of great value and you cannot retrieve the data using the aforementioned methods, the only remaining option is a data recovery specialist. The cost will often be as much as 10 times the original cost of the drive, but with a "no recovery, no fee" policy.
Author
Ian Cunningham
First release
Last update

More resources from Ian

Top