Malwareteks: Forums / Hardware Support / Failing Hard Drive: File Recovery

Forums

Malwareteks :: Forums :: Technical Support :: Hardware Support		<< Previous thread \| Next thread >>
Failing Hard Drive: File Recovery


Moderators: ShadowPuterDude, Greg, D3m3nt3d, Brandon, Vmarm, peterparker, siljaline, jholland1964, TurcoLoco, Windsor, JeanInMontana, KZ, RatHat, Jason Amison, MrCharlie

Author

Post

Speedy

Fri Mar 28 2008, 09:15PM

Registered Member #84

Joined: Sat Aug 04 2007, 09:49PM
Location: Seattle, Washington
Posts: 58
Thanked 0 times in 0 posts

I'm not sure where to put this, so this seems like as good of place as any.

One of my clients gave me a hard drive loaded with files, when he boots in to windows, he can't see the files but it says that the space is taken up for them on the disk.

I tested it out, I get the same result most of the time within windows, though occasionally it will allow me to find the files, but it will error out when I try to open them.

So I put the hard drive in to my Ubuntu machine. Loaded it up, found the files, I can open them, play them, whatever. I copied them to my hard drive for loading up in Windows, and they don't exist. Windows asks me to run check disk on the drive I put them on.

Any suggestions for getting the files to a state where they can be once again used in Windows?

ShadowPuterDude

Fri Mar 28 2008, 11:17PM

...the Shadow knows

Registered Member #1

Joined: Thu Apr 27 2006, 04:52PM
Location: Northern NY
Posts: 251
Thanked 12 times in 12 posts

Sounds like a corrupt MFT. Run CHKDSK /R from the Recovery console. What does that find/fix.

"Only those who fail greatly can ever achieve greatly" - Robert F. Kennedy
Microsoft Most Valuable Professional - Consumer Security (2007-2008)
Member - Alliance of Security Analysis Professionals - Since 2006
Linux Registered User # 363218

Speedy

Sat Mar 29 2008, 12:26AM

Registered Member #84

Joined: Sat Aug 04 2007, 09:49PM
Location: Seattle, Washington
Posts: 58
Thanked 0 times in 0 posts

I'll run that and see what happens. Though I would think that moving the files to a new drive would fix that.

Edit: I see that the MFT follows the files around.

[ Edited Sat Mar 29 2008, 01:29AM ]

Speedy

Sat Mar 29 2008, 03:40AM

Registered Member #84

Joined: Sat Aug 04 2007, 09:49PM
Location: Seattle, Washington
Posts: 58
Thanked 0 times in 0 posts

It finds a bad index on the 3 folders I copied over to my hard drive, it deletes the index says recovering index or something along those lines and in the end, it just winds up deleting the files.

ShadowPuterDude

Sat Mar 29 2008, 11:10AM

...the Shadow knows

Registered Member #1

Joined: Thu Apr 27 2006, 04:52PM
Location: Northern NY
Posts: 251
Thanked 12 times in 12 posts

Try creating the new folders on the new drive then copying just the files to the new folders.

Speedy

Fri Apr 11 2008, 02:52AM

Registered Member #84

Joined: Sat Aug 04 2007, 09:49PM
Location: Seattle, Washington
Posts: 58
Thanked 0 times in 0 posts

Okay, tried that. Boot into Windows, open the file:

The file or directory is corrupted and unreadable.

ShadowPuterDude

Fri Apr 11 2008, 07:26AM

...the Shadow knows

Registered Member #1

Joined: Thu Apr 27 2006, 04:52PM
Location: Northern NY
Posts: 251
Thanked 12 times in 12 posts

Open the files in Linux and then save them with new file names.

After transferring them to the new drive try opening them in Windows.

If they are Multimedia files they may not be recoverable.

Speedy

Fri Apr 11 2008, 06:50PM

Registered Member #84

Joined: Sat Aug 04 2007, 09:49PM
Location: Seattle, Washington
Posts: 58
Thanked 0 times in 0 posts

Weird, my last message didn't go through.

Anyways, if I put them on my USB Hard drive, they work just fine no matter where I put them. However if I put them locally to my internal hard drive, they go all corrupted.

I seem to have a system for getting them back now, lets hope it works.

Thanks!

ShadowPuterDude

Fri Apr 11 2008, 08:32PM

...the Shadow knows

Registered Member #1

Joined: Thu Apr 27 2006, 04:52PM
Location: Northern NY
Posts: 251
Thanked 12 times in 12 posts

That certainly is wried.

Hope it all works.

Speedy

Wed Apr 16 2008, 11:29AM

Registered Member #84

Joined: Sat Aug 04 2007, 09:49PM
Location: Seattle, Washington
Posts: 58
Thanked 0 times in 0 posts

It took 9 hours, but they all copied over, I am able to move them between computers now. Success!


Jump: Back to top