Data recovery tools
Posted by jorgenman on Thursday, 17 July 2008
Chelsey’s hard drive crashed a few weeks ago, and I have been doing my darndest to recover what I can from it, since she last backed up in December. The first problem is that I am using the 64-bit version of Windows XP Pro, which means that half of the utilities I could find don’t even work on my OS. But I am here today with a tale of happiness, in the hope that this knowledge can help someone else out in the future.
When I say that Chelsey’s hard drive crashed, I mean a hideous, raging inferno. No file recovery program could even see the drive, much less pull any data off of it. That is, until I found George M. Garner Jr.’s Forensic Acquisition Utilities. Once I found this utility on the internet, I realized I had used it before - when our SD card died and no other utility could do anything with it. FAU actually contains several different utilities, but the one that saved me was dd.exe, which performs the same function as the GNU dd program. For you non-unix-ites out there, dd is a program used for low-level data copying and conversion. Much more low-level, it turns out, than all the other “low-level” Windows utilities out there. Bit-for-bit. In particular, it is much more forgiving of physical damage to the drive than anything else I found. In addition, you can specify a starting address, so you can skip over bad parts of the drive. You have to be careful with dd, though, because you can write over the top of your good drive if you aren’t careful.
So, if I want to copy the bits from L:, starting at address 0×1c9f01c400 to a file called “drive_dump.img”, I type
dd.exe -v if=\\.\L: of=./drive_dump.img conv=noerror --localwrt --skip 0x1c9f01c400
“conv=noerror” tells dd.exe to keep going if there’s an error, and “–localwrt” tells it it’s okay to dump to a local drive. There are a lot of other good options, too.
Unfortunately, there was even more physical damage to Chelsey’s drive than FAU could handle. It was time to get nerdy. When dd.exe can’t go on any further, it spits out the last byte it was able to read successfully. So, I wrote a Perl script to look at the output, and find the last successful byte, in order to know where to start from the next time.
So, now I’ve got a bunch of image files. Of course, there is only one utility out there for 64-bit Windows XP that will mount dd images, and it’s only free for a trial period. Then there’s the question of software to recover the files Chelsey wants - PNGs and XCFs. The software I have only does JPEGs. But behold, another diamond in the rough: PhotoRec. Not only does PhotoRec recover PNG, XCF, and a buttload of other file formats, but it does so straight from a dd image file! Sweet. So, now, Chelsey will have 35 GB of data to mill through, while any other (free) recovery software would have given us nothing.
Posted in Tech | No Comments »














