Skip to main content

How do you copy/rescue data from a failing/damaged Windows NTFS drive?

When a Windows NTFS drive has a significant hardware problem, it is normally still possible to copy/rescue data from the failing drive.  As long as the drive is recognized by the System BIOS or Disk Controller, the likelihood of data being copied from the failing Windows drive to a working drive are extremely high using a Linux System Rescue CD.  Using Windows, attemps to copy data from the failing drive will lock up Windows or result in the error message: Cyclic redundancy check. However, the Linux System Rescue CD is able to browse the failing NTFS file system and copy data without issue.

The following documentation addresses a drive that is failing due to a physical hardware isssue.  This documentation does not involve drives that fail to boot because the MBR needs to be rewritten, etc.  Examples of a drive with a physical hardware issue: The drive is not always being reconized by the System - it is periodically dropping offline.  The drive is making an unusual griding whirring or clicking sound.  The drive is overheating, etc.

If the problem is a physical hardware issue, immediately remove the drive from the Computer System. 

  • Please do not boot from the drive or attempt to read/write from the drive. 

  • Please do not attempt to repair the file system/blocks/sectors using CHKDSK or any other method. 

  • Please do not attempt to copy data from the bad drive using Microsoft Windows.

Continued use of the drive significantly reduces your chances of salvaging data from the drive.


To rescue data from a failing drive, please perform the following steps:

  1. Place the failing drive inside of a zip top freezer bag.

  2. Seal the zip top freezer bag and insure the drive is properly protected from the elements.

  3. Place the zip top freezer bag containing your failing drive into the freezer.

  4. Leave the zip top freezer bag untouched for 12 hours.

  5. Download the Linux System Rescue ISO Image.

  6. Burn the Linux System Rescue ISO Image to CDROM.

  7. Boot computer without failing drive connected.  As computer is booting, enter BIOS and insure that BIOS is not set to boot from external drive.  Save settings and reboot.

  8. Connect external USB drive to computer.  This is the destintation drive.  Data from the failing drive will be copied to the external USB drive.

  9. After 12 hours, remove the failing drive from the freezer and connect it to the computer.

  10. Boot computer.  As computer is booting, enter BIOS or Disk Controller and insure that failing drive is properly detected.  As the drive is failing, you may have to reboot more than once until the drive is properly recognized by BIOS and/or Disk Controller.

  11. Once the failing drive is recognized, reboot the computer.

  12. Insert the Linux System Rescue CD into the CDROM Drive.

  13. Reboot computer.

  14. At Linux System Rescue boot: prompt, hit Enter.

  15. At Load Keymap, hit Enter.

  16. Type: mkdir /mnt/mydrive

  17. Hit Enter.  This makes the mount point for the failing drive (source).

  18. Type: mkdir /mnt/myusb

  19. Hit Enter.  This makes the mount point for the external USB drive (destination).

  20. Type: fdisk -l

  21. Hit Enter. The command fdisk -l lists the drives/partitions identified by Linux.

    Example: /dev/hda1, /dev/sda1, /dev/sdb1, etc.  hda1 stands for PATA/IDE drives.  SDA and SDB stands for SCSI, SATA and USB drives.  To identify the correct /dev or drive that contains your source data - you can compare the size of the drive and drive order.  This documentation assumes the /dev of the failing drive is hda1 and the /dev of the external USB drive is /sdb1.  In your instance, it may be hda2 or sda2 for example.  To insure you are using the correct /dev, please refer to fdisk -l.

  22. Type: ntfs-3g /dev/hda1 /mnt/mydrive

  23. Hit Enter.

  24. Type: mount /dev/sdb1 /mnt/myusb

  25. Hit Enter.

  26. Type: ls -l /mnt/mydrive

  27. Hit Enter.  You should now see the contents of the failing drive.

  28. Type: cd /mnt/mydrive

  29. Hit Enter.  This changes directory to the failing drive.

  30. Type: cd "Documents and Settings" or cd "Users"

  31. Hit Enter.  In Windows XP, the typical data location is under Documents and Settings.  In Windows Vista/Windows 7, the typical data location is under Users.

  32. Type: ls -l

  33. Hit Enter.  You should now see the User Directories.  If you like, you can cd again to go forward another level into the exact user account the you wish to copy.  Once you are in the directory which contains the data and subdirectories you wish to copy, please proceed to the next step.

  34. Type: cp -r * /mnt/myusb

  35. Hit Enter.  This copies the current directory and all subdirectories to the external USB drive.

You may find that because the drive is failing, you may have to navigate to different directories and/or subdirectories in the process of copying data.  Sometimes the cp command will copy a significant amount of information but then suddenly stop due to the drive failure.  It is important to make note of the point where the failure took place and then either attempt to use the cp command again from the current directory or navigate to a different directory and/or subdirectory and then execute the cp command again.

This issue has been resolved.
Labels:

Comments

Post a Comment

Popular posts from this blog

Access Denied (policy_denied). Your system policy has denied access to the requested URL. For assistance, contact your network support team.

While browsing the internet, you may encounter the message: "Access Denied (policy_denied).  Your system policy has denied access to the requested URL.  For assistance, contact your network support team."   This message indicates the internet traffic is being filtered.  The most common source of an internet traffic filter is in corporate environments that use a proxy server or a firewall appliance designed to filter web traffic.  Some businesses are configured as satellite locations using a VPN tunnel.  In these configurations, the VPN may be configured to filter internet traffic.  In rare instances, the Internet Service Provider is filtering internet traffic.  Typically though, your IT Department or a Network Management Team has configured your internet traffic to be filtered.  Isolating Source of Web Filtering In an environment that is unmanaged and the source of the filtering is unknown, following are some steps you may wish to peform: Th...
3 comments
Read more

Event ID: 7001 - Source: VSS - Unable to create a shadow copy

When using Microsoft Windows Server, you may encounter the error message: "Unable to create a shadow copy."  In the Event Viewer, you may find the following Event: "Event ID: 7001 - Source: VSS - Unable to create a shadow copy."  This event involves the Volume Shadow Copy Service (VSS).  Most likely the Server was rebooted while creating a Shadow Copy.  Many websites describe deleting or renaming the C:\WINDOWS\SYSTEM32\WBEM directory used by Windows Management Instrumentation to resolve this issue.  This is not correct.  Following are the steps to resolve this issue: Double-click My Computer. Right-mouse click the Hard Drive causing the problem. Click the Shadow Copies tab. Select the appropriate Volume. Click Disable. Click OK. Click Start - Control Panel - Administrative Tools - Scheduled Tasks. Delete all tasks related to the Volume Shadow Copy Service. Reboot the Server. Double-click My Computer. Right-mouse click the Hard Drive causing the problem. Cl...
Post a Comment
Read more

How do you stop an unstoppable Windows Service?

You may encounter a Windows Service in Services that has the buttons for Start, Stop, Pause and Resume greyed out.  If you attempt to stop the Service using sc stop [servicename], you encounter the error message: "The requested control is not valid for this service."  To resolve this issue, please perform the following steps: Click Start - Control Panel - Administrative Tools - Services. Double-click the relevant Service. Change the Service Start-Up Type to Disabled. Click Apply. Click OK. Hit CTRL-ALT-DEL on your keyboard. Select Task Manger. Perform an End Task on the relevant Service. This issue has been resolved. http://www.smartnetadmin.com
Post a Comment
Read more