hello friends! new(ish)!
Data recovery: Difference between revisions
>Muh6trillion m (Added Forensics Wiki) |
>Toynbeeidea No edit summary |
||
| Line 1: | Line 1: | ||
Here's what you have to do to save your data, if the hard drive still mounts. | Here's what you have to do to save your data, if the hard drive still mounts. | ||
You can tell that your hard drive is failing if it causes your computer to hang in the BIOS when connected, if it has a "Current Pending Sector Count" > 0 in the SMART info, or if it's making unusual noises. | You can tell that your hard drive is failing if it causes your computer to hang in the [[BIOS]] when connected, if it has a "Current Pending Sector Count" > 0 in the SMART info, or if it's making unusual noises. | ||
First, get another hard drive large enough to image the failing one onto. | First, get another hard drive large enough to image the failing one onto. | ||
| Line 7: | Line 7: | ||
Connect the failing hard drive to an internal SATA port on your computer, if it's in a USB enclosure open it up and remove the drive. | Connect the failing hard drive to an internal SATA port on your computer, if it's in a USB enclosure open it up and remove the drive. | ||
Next, boot from a GNU/Linux LiveCD and use an imaging program that doesn't retry I/O errors endlessly. Mount the failing drive Read-Only first. Use dd_rescue [http://www.garloff.de/kurt/linux/ddrescue/] or an equivalent so that it doesn't get stuck forever rereading one sector when it encounters read errors. | Next, boot from a [[GNU/Linux]] LiveCD and use an imaging program that doesn't retry I/O errors endlessly. Mount the failing drive Read-Only first. Use dd_rescue [http://www.garloff.de/kurt/linux/ddrescue/] or an equivalent so that it doesn't get stuck forever rereading one sector when it encounters read errors. | ||
Finally, if you are able to mount the disk image, do that. If not able to mount the copy, try Testdisk and Photorec or Recuva to recover data from the image. Recover the saved data to yet another separate partition. | Finally, if you are able to mount the disk image, do that. If not able to mount the copy, try Testdisk and Photorec or Recuva to recover data from the image. Recover the saved data to yet another separate partition. | ||
| Line 16: | Line 16: | ||
[http://www.forensicswiki.org/wiki/Main_Page Forensics Wiki] | [http://www.forensicswiki.org/wiki/Main_Page Forensics Wiki] | ||
[[Category:Recommendations]] | |||
Revision as of 18:43, 4 February 2014
Here's what you have to do to save your data, if the hard drive still mounts.
You can tell that your hard drive is failing if it causes your computer to hang in the BIOS when connected, if it has a "Current Pending Sector Count" > 0 in the SMART info, or if it's making unusual noises.
First, get another hard drive large enough to image the failing one onto.
Connect the failing hard drive to an internal SATA port on your computer, if it's in a USB enclosure open it up and remove the drive.
Next, boot from a GNU/Linux LiveCD and use an imaging program that doesn't retry I/O errors endlessly. Mount the failing drive Read-Only first. Use dd_rescue [1] or an equivalent so that it doesn't get stuck forever rereading one sector when it encounters read errors.
Finally, if you are able to mount the disk image, do that. If not able to mount the copy, try Testdisk and Photorec or Recuva to recover data from the image. Recover the saved data to yet another separate partition.
If you had to use PhotoRec, you will probably want to disable recovery of plain text files unless there's something in that format you want to save since it produces a massive amount of tiny text files from most hard drives. Stick to photos and Office documents for most people. Fragmented files will probably be unrecoverable.