|
Problem description: Girlfriend called me in tears saying her laptop was completely broken, she's lost three months of work on her masters thesis, etc. Having repaired a fair number of botched OS installs and broken config files before, I assume the issue is a bad update and tell her to bring the computer over. It's a Lenovo G505. Starting the computer, it goes down the boot list to attempt to boot from LAN without finding anything. I assume her MBR somehow was damaged, and fire up my trusty Windows 8 USB key. Attempted fixes: Attempted to refresh the installation, tried to fix the MBR. Windows errors out on the refresh saying the drive is locked. FixMBR succeeds. I check the BIOS to ensure it's booting in UEFI. It is. I assume the data will be available if I just boot into Linux. Fire up Ubuntu live USB. Boots fine, drives mount fine. I find a partition called Windows8_OS, occupying 457GB of the 500 on the drive... and there's a total of 120MB used. gently caress. Ran testdisk, navigated to the partition... empty directory. Tried to undelete. Nothing. Currently running the full analysis, 10% complete, but I'd really love some help figuring out if there's anything else I can do to recover the data, or if she's totally boned. From my standpoint, it looks like the whole drive has been formatted. But I can't explain how the drive could get so thoroughly wiped accidentally without boning any of the other partitions. The drive contained all of her thesis research (3 months of labor), and all of her photos. Of course, nothing is backed up. Recent changes: So here's the order of events as GF reports it: 1) Windows prompts a restart after an update, she restarts. 2) When restarted, she's prompted to log in. When she does, she's presented with a blank desktop, no applications, etc. 3) She boots into Lenovo's restore service. It tells her it's about to wipe everything, she backs out of the install. 4) Computer restarts, can no longer boot to windows at all, call glorodin. -- Operating system: Was Windows 8, currently running an Ubuntu liveCD. System specs: Lenovo G505: http://www.newegg.com/Product/Product.aspx?Item=N82E16834312827 Location: USA - NYC. I have Googled and read the FAQ: Yes
|
#
?
Aug 27, 2014 02:52
|
|
|
|
| # ? May 2, 2024 17:29 |
|
|
If this is really, truly important, stop touching that drive this instant and send it to a data recovery firm. If you can't do that and you just have to make best efforts with what you have, use that liveUSB to write a bit-for-bit image to another drive using dd. Restore the image to a functioning drive, and then use a file recovery tool like Recuva. It's critical you get anything you can off that hard drive ASAP, because it is likely in the "dying, soon dead" phase of its life. And in the future, back stuff up. Crashplan or Carbonite or, if there's less data involved, something like Google Drive, MS OneDrive, Dropbox, or SpiderOak.
|
|
#
?
Aug 27, 2014 03:03
|
|
|
If you are dead set on working on it yourself, make a full image of that hard drive onto a healthy hard drive on a different computer. Then, run a data recovery program. I haven't had to do this in years, but I have used norton Ghost and GetDataback NTFS/FAT. Both are paid programs.
|
|
#
?
Aug 28, 2014 10:21
|
|
|
The Gardenator posted:If you are dead set on working on it yourself, make a full image of that hard drive onto a healthy hard drive on a different computer. Then, run a data recovery program. I haven't had to do this in years, but I have used norton Ghost and GetDataback NTFS/FAT. Both are paid programs. Ghost copies files from the source filesystem onto a new filesystem. GetDataBack attempts to recover files from a raw device that contains a severely damaged filesystem. "Imaging the drive" is neither of those. As Factory Factory said, copy the entire disk, bit-for-bit, to another device (or to a big file on another filesystem). I would recommend using GNU ddrescue instead; this is invoked as ddrescue /dev/source-disk /path/to-destination logfile and repeated runs with the same log file will avoid copying data that has already been recovered.
|
|
#
?
Aug 28, 2014 14:35
|
|
|
Ghost can do a block level image of an entire drive. You should get the same result as dd. Might only be in older versions though. That said, dd-rescue is still probably the better option.
|
|
#
?
Aug 28, 2014 14:52
|
|
|
The whole purpose of my post was to give an alternative to using non-windows programs. I prefer to use windows programs when working on clients computers. I should have put that in so that there was no confusion.
|
|
#
?
Aug 29, 2014 05:43
|
|
|
The Gardenator posted:The whole purpose of my post was to give an alternative to using non-windows programs. I prefer to use windows programs when working on clients computers. I should have put that in so that there was no confusion. Using Windows to recover an image of a failing hard drive is a horrible idea. You should feel bad for using Windows for this, and for suggesting it to someone who isn't already expert in data recovery and aware of the potential pitfalls. Windows tends to do a lot of automatic things to a disk and its filesystem, like automatically mounting the filesystem and assigning it a drive letter, boot-time filesystem checks if the dirty bit is set, scheduled defragmentation, content indexing, etc. All of those are great ways to completely kill a disk that's already in the process of dying. In the OP's case, any writes to the disk (for any of the above reasons) will wipe out any potentially-recoverable data, which is exactly what he doesn't want to do.
|
|
#
?
Aug 30, 2014 16:30
|
|
|
|
| # ? May 2, 2024 17:29 |
|
|
That is a good point to consider, thank you for explaining the reasoning for not using windows to image a failing drive. As far as data recovery, I only attempt to pull documents, photos and videos. I guess I have been lucky and will look into a live cd alternative if I have to do it again.
|
|
#
?
Aug 31, 2014 08:15
|
|