DB said:
My friend has a desktop that he cant get to boot.....im not 100% sure
what his prob is but I do know that he doesnt want to lose all his date
files and nope, backing them up was done....
Can I connect a laptop to his pc via a usb cable, power up the laptop...
will this let me see his pc and will i be able to simply drag his files
accross to laptop.
Eventually i will format his hard drive and re-install windows....
What type of usb cable can i use..... would it be a USB male to USB male ?
I've never tried this sort of thing before but did see an engineer at
work connect a cable between 2 pcs and save all the data,,,
All help appreciated....
DB
They do make a computer to computer USB cable, but there is a special
chip in the middle of the cable, that prevents the two USB subsystems
from making direct contact. For this cable to work, both computers
need a running operating system. This cable is the equivalent of
"laplink", only for USB. The provided software is the most important
part of the product, because the OS doesn't know what to do with this
cable by default.
http://www.newegg.com/Product/Product.aspx?Item=N82E16812200198
An operating system doesn't have to recognize the data, to copy
the entire disk. For example, I made an exact copy of my boot drive,
all four partitions (two FAT32, two EXT2), by booting Linux from
a CD (Knoppix) on the computer, then using the dd command -
sudo dd if=/dev/<disk1_identifier> of=/dev/<disk2_identifier>
where the disk identifier string depends on what interface the
drive(s) are connected to. My destination drive happened to be
exactly the same size as the source. The dest should be the same
size or bigger than the source, so that all possible data is
captured. The command stops copying, when it gets to the end
of the first disk.
By copying that way, that is a sector by sector copy of the data.
The copying program (dd), doesn't need to know about the file
systems, and just copies every sector. That would be one way
to get the data from the drive without attempting to repair the
disk, and would give a "backup". The only thing wrong with that
method, is what happens if sector(s) happen to be unreadable.
I don't know whether the command exits with an incomplete copy,
or simply ignores the bits it cannot read. (I scanned my source
disk for bad sectors, before using that recipe, so I had a high
expectation that the source drive was readable.)
"dd" stands for "disk dump" and is not a forensic tool intended
to get every scrap of data. But it does give an example of the
usage of a foreign operating system, one that boots from a CD, to
try and get at some data. If the source disk is physically
damaged, then it cannot perform miracles.
In terms of approaches to probing the disk, this is another
idea. Testdisk is a program for correcting the partition table,
based on recognizing the partitions present on the disk. This
page claims it will run from DOS, if you had a mechanism for
booting DOS on the machine. The difference here, is this
tool is more dangerous - it attempts to repair "in place",
without making a copy of the data. If the repair goes wrong,
the results could make further data recovery (by a data
recovery firm) that much more difficult. By comparison,
copying all the sectors to a separate disk, is safer, in
that short of more mechanical damage happening to the
drive by running it a bit longer, at least no attempt
is being made to write to the dodgy disk.
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
In terms of computers that support direct cabling as
you describe - I believe an Apple laptop with Firewire
port, can run the internal drive in target disk mode,
and you could connect a Firewire equipped computer and
access the disk from another computer. But that is the
only example I know of, where you can get at the drive
on another computer, without booting it somehow.
Physically removing the drive, and using an IDE or SATA
adapter, would be another way to manipulate it. There
are adapters and enclosures for handling 2.5" drives.
Paul
