Trying to retrieve data from broken 2.5" HDD

My gf's old old laptop hard drive has recently started to fail - it
can't be booted from and sometimes makes a slight clicking noise. I've
tried booting the laptop into various rescue CDs (knoppix 5,
sysresccd.org) and they can each see the partition, correctly, as NTFS
(it was a Win2K system) but can't mount it, saying 'input/output error'
after about 10mins each.

They can, however, access the system tools partition **on the same
drive** that Compaq helpfully put on there, which makes me wonder if
something can be done. I've also tried chkdsk /f and /r within the W2K
recovery console, with no luck.

Is there maybe a way to trawl through the disk at a very low level and
just get the partition back 'bit-by-bit'? It sounds like a physical
problem with the drive but I can still see some of the data.

The laptop is definitely getting replaced anyway but she would really
like to get all the old data - photos, music, college work etc - back.
Ideally I'd like to just boot it into to Knoppix or something and copy
it all across the network. It's a 2.5 inch, 6.2Gig IBM Travelstar.

mjdimond <mark_dimond@hotmail.com> wrote:

> My gf's old old laptop hard drive has recently started to fail - it
> can't be booted from and sometimes makes a slight clicking noise.

That clicking is the drive recalibrating on bad sectors.

> I've tried booting the laptop into various rescue CDs (knoppix 5,
> sysresccd.org) and they can each see the partition, correctly,
> as NTFS (it was a Win2K system) but can't mount it, saying
> 'input/output error' after about 10mins each.

> They can, however, access the system tools partition
> **on the same drive** that Compaq helpfully put on there,
> which makes me wonder if something can be done.

Unlikely, the bad sectors will be in the other partition
and thats whats stopping it from being mounted.

> I've also tried chkdsk /f and /r within the W2K recovery console, with no luck.

That isnt a good idea with a drive that bad.

> Is there maybe a way to trawl through the disk at a very
> low level and just get the partition back 'bit-by-bit'?

Yes, there are 'forensic' cloners that will attempt to clone
the drive to another sector by sector and wont give up on
the first bad sector. You can then use a low level recovery
program to get what files are recoverable from the clone.

Unfortunately I dont know of a free one of those. Not that expensive
tho. But you'd need to put the drive in a desktop system to do the clone.

> It sounds like a physical problem with the drive

Yes, looks like bad sectors have developed.

> but I can still see some of the data.

Yeah, thats pretty typical too with that sort of fault.

> The laptop is definitely getting replaced anyway but she would really
> like to get all the old data - photos, music, college work etc - back.
> Ideally I'd like to just boot it into to Knoppix or something and copy
> it all across the network. It's a 2.5 inch, 6.2Gig IBM Travelstar.

Trouble is that it appears to have bad sectors in the directory structures
and thats why knoppix cant mount it. If the bad sectors were just in the
files, knoppix would be able to mount it even if Win2K refuses to mount it.

A forensic clone likely would allow you to recover some of the data.
How much depends on how many bad sectors there are. The low
level file recovery programs basically scan the drive for known
file headers and do quite well with the sort of data she wants back.
But they arent guaranteed to get the entire file back when its fragmented
and with a small drive like that there may well be a significant percentage
that are fragmented.

Show her how to backup properly when the drive is replaced.

Cheers for that mate, I'll have a look at forensic cloners. I've read
that you can use the linux dd command with the right switches to read
from a dodgy device whilst ignoring errors, but this is probably a long
shot isn't it? I guess it might not be clever enough to tell the drive
to keep going sector-after-sector?

mjdimond <mark_dimond@hotmail.com> wrote:

> Cheers for that mate, I'll have a look at forensic cloners.
> I've read that you can use the linux dd command with the
> right switches to read from a dodgy device whilst ignoring
> errors, but this is probably a long shot isn't it?

Nope, it works fine.

> I guess it might not be clever enough to tell
> the drive to keep going sector-after-sector?

Its more that you dont want to pound on a dying drive too
enthusiastically because you can kill the drive in the process
of trying to clone it. Thats one area where a forensic cloner
can be better, a good one can treat the drive more gently etc.

Have a look at clonedisk at http://www.invircible.com/resq.php
its not free, but isnt very expensive.