recovering my HD

[gusl]

I'd like a bootable CD that contains software to scan my HD and recover lost NTFS files (such as Disk Investigator).

I haven't been able to build bootable CDs running Windows, because of copy-protection issues. Therefore, I need an application that runs in a free Unix-like system (such as Linux, BSD, etc). My Knoppix Linux Live CD doesn't seem to come with anything like that, so I could hopefully install it onto the RAM (since the Live CD has no write access to the HD, AFAIK). Anyway, first I need to find such an app.

Comments

[peamasii.livejournal.com]

Lost files, eh? something like this might work:

http://gparted.sourceforge.net/livecd.php

[peamasii.livejournal.com]

this looks interesting too:

http://ntfsundelete.com/

Actually, check out these listings:

http://www.thefreecountry.com/utilities/datarecovery.shtml

[gustavolacerda.livejournal.com]

Thanks.

But since I began formatting the disk, it looks like I've lost my main partition table (I can't boot with external boot media), and probably also the pointers to files. This means that I need to boot to an OS (again NOT Windows) with *scanning* recovery, and which can write to my external HD.

In particular, what I need is not:
* partition editors
* Windows apps

[peamasii.livejournal.com]

Ah, I understand. But you could hook up your drive to another windows machine and fix the volume there? (though, depending on what the fixes are required, it may or may not be possible).

[gustavolacerda.livejournal.com]

Since the damaged HD is inside my laptop, the only way I know of accessing it from another computer would be to remove it, which voids the warranty.

[peamasii.livejournal.com]

OK... I found this:

http://www.linux.com/articles/56588

pointing to this software:

http://www.cgsecurity.org/wiki/TestDisk

[gustavolacerda.livejournal.com]

this looks spot-on. Thanks!

[gustavolacerda.livejournal.com]

PhotoRec is included in my Knoppix!

I also want option #1 ("Recover the files to a separate hard drive"), but I can't install two HDs... my second HD is external.

I shouldn't be afraid of writing stuff onto my damaged HD, since it's not mounted.

<< Make sure that the recovery partition is mounted (I mounted it at /var/recovery) >>

I should figure out how to do this.

[peamasii.livejournal.com]

give it a try, it sounds like the best option right now

[gustavolacerda.livejournal.com]

I will, as soon as TestDisk is done trying to recover the partition :-)

(unless it succeeds!!)

[gustavolacerda.livejournal.com]

by going to X (startx), I see that the external HD is mounted by default, at /media/sdb1 , but I can't write to it (when I try to modify permissions, it says "Read-only file-system"). Maybe I need unmount and remount it as a rewriteable file system.

[gustavolacerda.livejournal.com]

running 'mount', I see that my external HD is NTFS, so it looks like I'll need captive-ntfs.

[gustavolacerda.livejournal.com]

or, ntfs-3g, which comes with my Knoppix.

[gustavolacerda.livejournal.com]

when I do
sudo ntfs-3g /dev/sdb1 mnt/sdb1

I get:

<< Mount denied because NTFS is marked to be in use. Choose one action:

Choice 1: If you have Windows, disconnected the external devices by clicking on 'Safely Remove Hardware'

Choice 2: you can use the 'force' option for your own responsibility. >>

I'm wondering if choice 2 could destroy my external HD and my data.

[peamasii.livejournal.com]

Why is it saying it's in use? Did it get automatically mounted or something? Look at /etc/mtab and do "df -H" to see what is currently mounted.

[peamasii.livejournal.com]

i use NTFS on USB drives too, probably FAT32 would have been better since I don't have security need for NTFS

[gustavolacerda.livejournal.com]

oops, didn't see your reply.
My concern now is whether forcing a mount is dangerous.

[peamasii.livejournal.com]

i think recovery mount is always in read only, you need to connect an external drive or memory stick and copy the files you need to it, because the OS on the drive is probably hosed

[gustavolacerda.livejournal.com]

this is understood.

what I'm trying to mount as read-write is the external HD.

[peamasii.livejournal.com]

so you'd have to remount it as read-write, but first use
umount /media/sdb1
and then
mount -t ntfs-3g /dev/sdb1 /media/sdb1
this should mount it safely as read-write

see here:

http://www.swerdna.net.au/linhowtontfs.html

[gustavolacerda.livejournal.com]

I get the same error as here
http://gustavolacerda.livejournal.com/762354.html?thread=2743794#t2743794


It is dangerous to use "-o force"?

[peamasii.livejournal.com]

Am not sure, really. But you get the error when you try the umount command? You have to unmount a volume before re-mounting, but that error means it's actually in use by a process so you can't unmount it. did you connect the drive only after booting up? Are there running processes which do anything on that drive?

[gustavolacerda.livejournal.com]

(1) yes. I also verified it was unmounted before attempting to mount.
(2) yes.
(3) I don't know about running processes. It was plugged onto my Windows machine previously. For some reason, Windows doesn't offer "Remove Hardware Safely" for my external HD.

[peamasii.livejournal.com]

then you should just connect another USB stick of flash memory and copy your files there, i don't know what else to try.