Data Recovery help needed after CHDSK

[Takshaka]

I need some advice on the best way to approach a data recovery operation.

 

 

The HD in question is my boot drive, Windows XP, 1 TB.

 

 

A few days ago I rebooted my computer and came back to see CHDSK had auto started it ran for a few hours, I left it unattended most of the time, but from what I saw it was reporting/fixing a lot of bad sectors, deleting corrupt attribute records and deleting index entries. There was a LOT of activity.

 

 

Please don't ask if I have a recent backup... answering that question will only cause me a great deal of embarrassment and self-loathing :(

 

 

On completion it rebooted to the Windows login screen, after logging in I got a windows explorer error message and my desktop was blank and the only thing it was possible to do was open Task Manager (couldn't even open the Start menu). I rebooted into Safe Mode, got the windows explorer error again. I rebooted again and tried starting up using Last Known Good Configuration but this triggered CHDSK again after which it was no longer possible to boot to the Windows Login screen, I get a Blue Screen registry error. I tried using the Win XP disc to attempt a repair installation but this too gave a registry error.

 

 

At this point I realised (probably later than I should) that I was doing more harm than good and stopped, the computer has been off since then.

 

 

So now I am in data recovery mode and want to make sure I have as much info as possible before doing anything! Priority 1 is to recover as many files as possible. If possible I would also like to get the windows installation bootable again, but that is a secondary goal.

 

 

I am waiting for a new computer to be delivered next week and will probably wait for that before doing anything since it will be able to move files faster than with my laptop, I am also awaiting delivery of a HD enclosure to put the damaged drive in.

 

 

The first thing I plan on doing is making an image copy of the drive onto a new HD and running the recovery operation on that to leave the old disc in tact in case anything goes wrong. Am I right in thinking that, using the right tools, I can make an exact duplicate of the data on the drive so that working on it for recovery will be exactly the same as working on the original drive?

 

 

That is about as far as I have got with my plan since I don't know exactly which tools to use or in what order. Should I use a tool to recover files deleted/changed by CHKDSK first? Or should I use a more general data recovery tool? Or a HD analysis tool?

 

 

I also have these specific questions

 

 

1. What are the best tools for making an exact clone of all the data on the damaged drive including any deleted file data etc?

2. Does the HD I put the image on need to be the same size or would a larger drive have advantages?

3. Will the fact that the computer I will be using to run any recovery tools will be Win7 whereas the HD to be worked on is a WinXP boot drive?

4. What tools are recommended for this data recovery operation and should they be used in a specific order?

 

 

 

 

I am in need of a lot of guidance here! I will be very grateful for any help and recommendations you can give me.

 

 

Thanks in advance

[Plastic Nev]

Hi and welcome to Extreme Tech Support - Free PC Help.

So far you are going in the right direction having ordered an enclosure, also you recognise that the drive may be damaged.

 

Once you have the new computer plus the enclosure, and the old drive fitted in the enclosure, connect it to the new computer which providing the drive hasn't died altogether, it will be recognised as a storage device.

 

All the data on it should be seen if not corrupted by the damage and should be no more difficult to copy to the new computer by drag and drop as if copying data from a flash or pen drive.

I wouldn't try any sort of disk clone or imaging as it may stress the old and possibly damaged drive too much. Just rely on copying data over to the new computer in as few moves as possible to avoid forcing the old drive to do too much work.

 

Please note, any programs installed on the old drive cannot be copied over, they will have to be installed separately on the new computer, however any downloaded program files kept in the original downloads folder, if you have them, can be copied over as a complete file for later installation.

 

Nev.

[Synapse]

Use a tool like dd_rescue to clone the drive. It can jump faulty sectors and reset the drive controller to carry on copying.

 

You can use a larger drive to image to, I can't see any advantage, but it does work ok.

 

Win 7 v Win XP is fine, but when I have done this I have used Linux on a boot CD to recover data - Windows is rubbish for this type of job.

 

So, you need to set up your PC with the two drives. Be really careful here, getting them the wrong way around would result in your faulty drive being written with data from the new drive ie it would be wiped.

 

Check them in the BIOS, know 100% what is connected where.

 

You need something like Knoppix to boot from ( I think it has dd_rescue built in).

 

Have a look at this page for more info on how to use it.

 

http://www.tivocommunity.com/tivo-vb/showthread.php?postid=2165825

 

It takes hours to copy, the worse the faulty drive is the longer is takes.

 

When complete you may be able to recover data using Win 7, I'd tend to boot to Live Linux, Linux Mint or Ubuntu are ones I have used. Copy your data out to where you can store it.

 

Thats a quick once over, it takes some sorting, have a read and let us know what you think.

 

Just a quick note....there is a ddrescue program, very similar name, it is not one I have used.

 

Edit: I've just see Nev's post. IMHO cloning is ok with dd_rescue, it copies in a linear fashion through the disc, it can even do a reverse copy, starting at the end, although I have forgotten how to do it!

Edited August 3, 2012 by Synapse