General Discussions => General discussions => Topic started by: Julie Marie on May 09, 2009, 12:03:19 PM Return to Full Version
Title: Anyone know if data can be recovered from a crashed hard drive?
Post by: Julie Marie on May 09, 2009, 12:03:19 PM
Post by: Julie Marie on May 09, 2009, 12:03:19 PM
Yes, we were both idiots and didn't have our data backed up and now we're paying for our stupidity. :eusa_wall:
My hard drive crashed while loading in an updated version of Kaspersky's Anti-Virus. Yes, the updated version of an anti virus program had a killer virus attached to it. I've gotten around many viruses but this one was death.
I bought a new hard drive and loaded in Windows XP Pro. I then tried to create a master-slave setup (I have SATA drives) but when I turned on the computer the virus infected the new hard drive too and I had to reformat the new one to get rid of it. Like I said, this was a killer virus.
Julie's computer then crashed before I could get mine set up again and load her data onto mine. Her's just crapped out. I tried the same master-slave setup to see if I could get any data off the crashed hard drive but the computer couldn't see it. I ran the repair function on the old drive through the Windows XP CD and ran chkdsk. It came back that it had one or more unrepairable problems.
We are thinking about taking the drives to a local computer store (Micro Center) and seeing if they can extract the data. Does anyone know if this could work? Is there anything else I can try to get the data myself?
Thanks in advance for any help.
Julie
My hard drive crashed while loading in an updated version of Kaspersky's Anti-Virus. Yes, the updated version of an anti virus program had a killer virus attached to it. I've gotten around many viruses but this one was death.
I bought a new hard drive and loaded in Windows XP Pro. I then tried to create a master-slave setup (I have SATA drives) but when I turned on the computer the virus infected the new hard drive too and I had to reformat the new one to get rid of it. Like I said, this was a killer virus.
Julie's computer then crashed before I could get mine set up again and load her data onto mine. Her's just crapped out. I tried the same master-slave setup to see if I could get any data off the crashed hard drive but the computer couldn't see it. I ran the repair function on the old drive through the Windows XP CD and ran chkdsk. It came back that it had one or more unrepairable problems.
We are thinking about taking the drives to a local computer store (Micro Center) and seeing if they can extract the data. Does anyone know if this could work? Is there anything else I can try to get the data myself?
Thanks in advance for any help.
Julie
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Miniar on May 09, 2009, 12:31:05 PM
Post by: Miniar on May 09, 2009, 12:31:05 PM
Local computer stores can tell you where the best bet is to go to get your data restored. It can cost you a fair bit though.
There are companies that specialize in data recovery.
There are companies that specialize in data recovery.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: sd on May 09, 2009, 02:30:24 PM
Post by: sd on May 09, 2009, 02:30:24 PM
Put the drive in a plastic bag, then place it in the freezer for a bit. Hook it back up and pray.
This works more times than people think.
If that fails, you have two options.
The first is find an identical drive on Ebay, and swap the boards. If that fails you can try swapping teh drive internals (minus platters of course). I knew a guy who used to do this in a garage and had decent results, though technically you need a clean room or you can't expect the drive to last long. If this fails though, you are pretty much hosed.
The alternative is a data recovery service. This is the more reliable method, however expect several hundred dollars for the charge.
Try the freezer first.
This works more times than people think.
If that fails, you have two options.
The first is find an identical drive on Ebay, and swap the boards. If that fails you can try swapping teh drive internals (minus platters of course). I knew a guy who used to do this in a garage and had decent results, though technically you need a clean room or you can't expect the drive to last long. If this fails though, you are pretty much hosed.
The alternative is a data recovery service. This is the more reliable method, however expect several hundred dollars for the charge.
Try the freezer first.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Ellieka on May 09, 2009, 02:43:54 PM
Post by: Ellieka on May 09, 2009, 02:43:54 PM
Find some one that has a linux system. they can mount the drive in it and extract quite a lot but If the drive is physically damaged its going to be tricky and expensive.
You can do as Miniar suggested. I have done it several times but your going to have a detailed list of the directories or files you want saved before you start because more times then not it's a one shot deal. If you have it done by a data recovery service its going to be very costly.
You can do it yourself but it is a very delicate process. One wrong slip can destroy the platters.
You can do as Miniar suggested. I have done it several times but your going to have a detailed list of the directories or files you want saved before you start because more times then not it's a one shot deal. If you have it done by a data recovery service its going to be very costly.
You can do it yourself but it is a very delicate process. One wrong slip can destroy the platters.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: stacyB on May 09, 2009, 03:02:07 PM
Post by: stacyB on May 09, 2009, 03:02:07 PM
The linux idea is not a bad approach, but you will need to be able to read NTFS partitions from the linux box. I am guessing the idea with this approach is that the virus will not migrate to the linux volume, but if its x86 code I wouldnt bet on it being a windows only type virus...
Since we are in the same geographical locale, I can suggest some local spots that can tackle this problem, but as has been pointed out, it wont be cheap. I would avoid MicroCenter or GeekSquad or any of those repair places as they will likely do more damage than good...
We often have to deal with the problem for our clients, we typically go directly to the pros like Drive Solutions, etc. Having a virus dormant on the disk is only an issue when trying to mount the drive as an OS recognize storage device... these places actually go down to the bit level to extract the data off the drive.
One more aside -- ignoring cost for a moment, its almost impossible to actually lose data from the platters even in the event of a hard crash. So the obvious moral is if you wanna save it, back it up...
but
...if you dont want it to be retrievable (recoverable by others), use an old fashion method like pencil and paper. ;)
Since we are in the same geographical locale, I can suggest some local spots that can tackle this problem, but as has been pointed out, it wont be cheap. I would avoid MicroCenter or GeekSquad or any of those repair places as they will likely do more damage than good...
We often have to deal with the problem for our clients, we typically go directly to the pros like Drive Solutions, etc. Having a virus dormant on the disk is only an issue when trying to mount the drive as an OS recognize storage device... these places actually go down to the bit level to extract the data off the drive.
One more aside -- ignoring cost for a moment, its almost impossible to actually lose data from the platters even in the event of a hard crash. So the obvious moral is if you wanna save it, back it up...
but
...if you dont want it to be retrievable (recoverable by others), use an old fashion method like pencil and paper. ;)
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: tekla on May 09, 2009, 03:13:55 PM
Post by: tekla on May 09, 2009, 03:13:55 PM
So the obvious moral is if you wanna save it, back it up... but ...if you dont want it to be retrievable (recoverable by others), use an old fashion method
Yeah, when we switch out hard-drives at work, we take the old ones out and play with them and sledgehammers to ittsy-bittsy tiny pieces.
And yes, taking it to a pro to do is going to cost a couple hundred dollars. I like using a remote storage deal, just for files and data, and leaving the programs, and only the programs on the machine itself.
Yeah, when we switch out hard-drives at work, we take the old ones out and play with them and sledgehammers to ittsy-bittsy tiny pieces.
And yes, taking it to a pro to do is going to cost a couple hundred dollars. I like using a remote storage deal, just for files and data, and leaving the programs, and only the programs on the machine itself.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Lily on May 14, 2009, 12:53:22 AM
Post by: Lily on May 14, 2009, 12:53:22 AM
We had a virus on our laptop once that made the laptop not booting. A friend used linux to view the data and copied it to an external hard drive. I had to move the files into new folders in an administrator name cuz the files was protected from the previous account and wouldn't open otherwise with regular accounts. So if you can get into dos, then chances are very good you'll be able to retrieve your data. I wouldn't suggest operating on your hard drive tho.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Julie Marie on May 14, 2009, 01:00:10 AM
Post by: Julie Marie on May 14, 2009, 01:00:10 AM
Quote from: Leslie Ann on May 09, 2009, 02:30:24 PM
Put the drive in a plastic bag, then place it in the freezer for a bit. Hook it back up and pray.
This works more times than people think.
Did the freezer thing with the one drive - no luck. As far as the drive that's infected, I'm leaving that to the pros. That virus I got from Kaspersky Anti Virus is death.
How on earth can a company that sells software protecting you from viruses (KASPERSKY) allow a virus to infect their online upgrade?
Julie
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Ellieka on May 14, 2009, 08:34:57 AM
Post by: Ellieka on May 14, 2009, 08:34:57 AM
Dem compooter bugs is tricksy like that.
The virus creators find all sorts of tricky ways to trick you into downloading them. Often once it downloaded it will first disable any atnivirus and firewall software then it starts munching on you private data and quite often makes your system part of a large Botnet (http://en.wikipedia.org/wiki/Botnet) to attack other systems.
I've seen several times where the victim is not to blame but rather the operating System publisher. Unpatched vulnerabilities can allow an attacker access to your system without you ever doing anything to it.
Case in point: Take a new system and install Windows XP (prior to Service Pack 2) on it with no antivirus. Then connect it to the internet and just wait. With in hours the system will be compromised and infected.
The virus creators find all sorts of tricky ways to trick you into downloading them. Often once it downloaded it will first disable any atnivirus and firewall software then it starts munching on you private data and quite often makes your system part of a large Botnet (http://en.wikipedia.org/wiki/Botnet) to attack other systems.
I've seen several times where the victim is not to blame but rather the operating System publisher. Unpatched vulnerabilities can allow an attacker access to your system without you ever doing anything to it.
Case in point: Take a new system and install Windows XP (prior to Service Pack 2) on it with no antivirus. Then connect it to the internet and just wait. With in hours the system will be compromised and infected.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Julie Marie on May 14, 2009, 12:03:14 PM
Post by: Julie Marie on May 14, 2009, 12:03:14 PM
Seems on my drive (the one with the virus) the master boot record has been damaged. Before that happened I was able to boot up but within a minute or so I'd get the blue screen saying that there was a problem with klif.sys, a file loaded in by the Kaspersky Anti-Virus program.
The other drive, the one I froze, seems to be gone. It's about five years old.
Thank you all for your help.
Julie
The other drive, the one I froze, seems to be gone. It's about five years old.
Thank you all for your help.
Julie
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Sarah Louise on May 14, 2009, 12:06:43 PM
Post by: Sarah Louise on May 14, 2009, 12:06:43 PM
DriveSavers (800-440-1904) has recovered damaged drives for me in the past.
Sarah L.
Sarah L.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: fluffy jorgen on May 14, 2009, 12:10:02 PM
Post by: fluffy jorgen on May 14, 2009, 12:10:02 PM
In future, buy upgrades and Anti- viruses in computer shops, not online. It is not that they allow these viruses to be attached, it is that the viruses have found a way in without the company realizing. Report it to them?
Others have already given advice about recovering the hard drive. The freezer one seems a tad unethical but I will try it myself if worst comes to the worst.
Others have already given advice about recovering the hard drive. The freezer one seems a tad unethical but I will try it myself if worst comes to the worst.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: myles on May 14, 2009, 12:13:46 PM
Post by: myles on May 14, 2009, 12:13:46 PM
I sent mine to my brother he worked on it for a few weeks (yes weeks) when this happened and almost nothing was retrieved. The next step was to send it somewhere with more sophisticated equipment but I did not want to shell out $1000, through his work he had some basic recover stuff but not as advances as what someone like DriveSavers have. Also I got my virus from a computer shop (it was in Cambodia though).
Myles
Myles
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Flan on May 14, 2009, 12:20:20 PM
Post by: Flan on May 14, 2009, 12:20:20 PM
A quick and dirty fix for a non-hardware problem with WinXP is to do a "Repair" install using an install disc that doesn't re-image the hard drive, I'm not sure how effective it would be aginst a virus laden drive, but it beats calling a place like Kroll Ontrack (http://www.krollontrack.com/). (cost wise)
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: tekla on May 14, 2009, 12:21:41 PM
Post by: tekla on May 14, 2009, 12:21:41 PM
What's the first rule of fight club? Don't talk about fight club.
What's the first rule of computers? Back up your work.
What's the second rule? Back-up the backup.
What's the third rule? Media is cheep, So backup the backup of the backup.
What's the first rule of computers? Back up your work.
What's the second rule? Back-up the backup.
What's the third rule? Media is cheep, So backup the backup of the backup.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: sd on May 14, 2009, 02:10:44 PM
Post by: sd on May 14, 2009, 02:10:44 PM
The dead drive can be saved by pros.
The non-dead could be fixed by slaving the drive and deleting the Kapersky file and then using a fix mbr command with a Windows disk.
The non-dead could be fixed by slaving the drive and deleting the Kapersky file and then using a fix mbr command with a Windows disk.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Julie Marie on May 14, 2009, 03:47:36 PM
Post by: Julie Marie on May 14, 2009, 03:47:36 PM
Quote from: Leslie Ann on May 14, 2009, 02:10:44 PM
The dead drive can be saved by pros.
The non-dead could be fixed by slaving the drive and deleting the Kaspersky file and then using a fix mbr command with a Windows disk.
How do you slave a drive with SATA? I bought a new SATA drive and loaded in Windows XP Pro. Then I shutdown the computer and connected the infected drive. It took a long time to load then when it tried to open Windows I got the blue screen. After I disconnected the infected drive I tried to reboot the new drive but it too went to the blue screen. It seemed the virus got onto the new drive.
I reformatted the new drive and reloaded Windows and it works fine but I'm afraid to connect the old drive again. Is there a way to isolate the infected drive so it can't infect the new drive?
Julie
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Sandy on May 14, 2009, 04:34:49 PM
Post by: Sandy on May 14, 2009, 04:34:49 PM
Quote from: Julie Marie on May 14, 2009, 03:47:36 PM<geekspeak>
How do you slave a drive with SATA? I bought a new SATA drive and loaded in Windows XP Pro. Then I shutdown the computer and connected the infected drive. It took a long time to load then when it tried to open Windows I got the blue screen. After I disconnected the infected drive I tried to reboot the new drive but it too went to the blue screen. It seemed the virus got onto the new drive.
I reformatted the new drive and reloaded Windows and it works fine but I'm afraid to connect the old drive again. Is there a way to isolate the infected drive so it can't infect the new drive?
Julie
Technically, you don't "slave" a drive using SATA the same way you would using IDE. You specify in the bios the drive you wish to boot off of. In this case it would be the freshly reformatted/reloaded windows drive.
You can connect the second / infested drive to either socket. Just make sure to get to the bios prompt before it attempts to boot.
What "should" happen once the bios has been properly set is that the uninfested drive would boot into Windows and automatically mount the other drive as a secondary drive.
Once Windows boots, it will attempt to inspect the drive for an autostart file as if it were a CD. You may notice a "Searching..." window pop up as it attempts to scan the drive. You can cancel close this window.
If the infested drive has only had the MBR and Kaspersky file trashed, then it should mount correctly and be viewed through explorer. You may then pull data at your leisure.
FOR THE LOVE OF GOD! DO NOT ATTEMPT TO START OR COPY ANY PROGRAMS THAT MAY RESIDE ON THE INFECTED DRIVE!!!
Data may be trashed by a belligerent virus and you may lose pictures, data files, excel spreadsheets, ...etc. So inspect the data you find be prepared for the worst.
Once you have copied the data from the infested drive, then reformat it to protect yourself from future problems.
An additional way to mount the drive is to get an external SATA enclosure that is firewire or USB 2.0 connected. That way you could mount/unmount the drive after the clean windows is booted and dismount it when you are done. You could also keep the drive in a safe place for further recovery efforts.
</geekspeak>
-Sandy
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Susan on May 14, 2009, 04:46:26 PM
Post by: Susan on May 14, 2009, 04:46:26 PM
Sometimes turning the old drive upside down will enable you to get the material off of it. But that doesn't always work. Also for bad mbr sometimes you can do fdisk /mbr but you do that at your own risk...
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Sandy on May 14, 2009, 04:59:21 PM
Post by: Sandy on May 14, 2009, 04:59:21 PM
Quote from: Susan on May 14, 2009, 04:46:26 PMDoesn't the data fall off? ;)
Sometimes turning the old drive upside down will enable you to get the material off of it. But that doesn't always work.
That is what the bit bucket is for.
-Sandy(old geekess)
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Vexing on May 14, 2009, 06:15:28 PM
Post by: Vexing on May 14, 2009, 06:15:28 PM
Get an external USB HDD enclosure:
(https://www.susans.org/proxy.php?request=http%3A%2F%2Fwww.anyware.com.au%2FContent%2FProductImagesLarge%2FME-940J_0.jpg&hash=5326e92c75b1d569096520d72f726aab6329607a)
http://www.anyware.com.au/Browse/0790ca0c02fb424bbc2d28852f91b4a4001ItemDetail.aspx (http://www.anyware.com.au/Browse/0790ca0c02fb424bbc2d28852f91b4a4001ItemDetail.aspx)
You can then connect your old HDD via USB and do a full file scan with something fairly reliable, like AVG. This should clean out the infected files and enable you to recover the data you require from the disk.
(https://www.susans.org/proxy.php?request=http%3A%2F%2Fwww.anyware.com.au%2FContent%2FProductImagesLarge%2FME-940J_0.jpg&hash=5326e92c75b1d569096520d72f726aab6329607a)
http://www.anyware.com.au/Browse/0790ca0c02fb424bbc2d28852f91b4a4001ItemDetail.aspx (http://www.anyware.com.au/Browse/0790ca0c02fb424bbc2d28852f91b4a4001ItemDetail.aspx)
You can then connect your old HDD via USB and do a full file scan with something fairly reliable, like AVG. This should clean out the infected files and enable you to recover the data you require from the disk.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Lori on May 14, 2009, 07:02:18 PM
Post by: Lori on May 14, 2009, 07:02:18 PM
Vexing has the right idea with the external drive.
The most powerful tool I have been using is Malwarebytes. Free download.
http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html (http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html)
When you are done, download the Avast Home Free edition. You can register it and use it for free. Comes with free updates like AVG but it does a better job I have found.
http://www.avast.com/eng/download-avast-home.html (http://www.avast.com/eng/download-avast-home.html)
The most powerful tool I have been using is Malwarebytes. Free download.
http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html (http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html)
When you are done, download the Avast Home Free edition. You can register it and use it for free. Comes with free updates like AVG but it does a better job I have found.
http://www.avast.com/eng/download-avast-home.html (http://www.avast.com/eng/download-avast-home.html)
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Vexing on May 14, 2009, 08:12:15 PM
Post by: Vexing on May 14, 2009, 08:12:15 PM
And has a cooler name!
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: sd on May 15, 2009, 04:53:55 AM
Post by: sd on May 15, 2009, 04:53:55 AM
I would recommend putting Avast or AVG on there BEFORE you connect the old drive.
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Julie Marie on May 15, 2009, 10:51:38 AM
Post by: Julie Marie on May 15, 2009, 10:51:38 AM
I have ESET Suite but will try Avast too. Then I'll give the HDD enclosure a try. Is there any chance the virus can get into the new drive? I'd hate to have to start all over again.
Julie
Julie
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Linda on May 15, 2009, 11:19:05 AM
Post by: Linda on May 15, 2009, 11:19:05 AM
Hi Julie Marie,
I hope, besides the cump virus thingy, that you are doing well.
I'm not a super techy person, but have some skills as they say. I would research the virus online, get any patches, (on a removable medium) particular to the OS you're running and update them to the primary HDD. After the secondary/crashed drive is connected to the CPU, SCAN AND REMOVE any threats with an AV application which has current protection for the threats you killer virus attacks before you try to explore any data. It seems like good AV info has been mentioned previously.
I've never treated a totally crashed drive, but have rescued more than a few friends systems with viruses less malignant than yours sounds. Do you know what name it has?
I hope this helps you some.
I hate cumputahs. ;)
I hope, besides the cump virus thingy, that you are doing well.
I'm not a super techy person, but have some skills as they say. I would research the virus online, get any patches, (on a removable medium) particular to the OS you're running and update them to the primary HDD. After the secondary/crashed drive is connected to the CPU, SCAN AND REMOVE any threats with an AV application which has current protection for the threats you killer virus attacks before you try to explore any data. It seems like good AV info has been mentioned previously.
I've never treated a totally crashed drive, but have rescued more than a few friends systems with viruses less malignant than yours sounds. Do you know what name it has?
I hope this helps you some.
I hate cumputahs. ;)
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Sandy on May 15, 2009, 11:19:14 AM
Post by: Sandy on May 15, 2009, 11:19:14 AM
Quote from: Julie Marie on May 15, 2009, 10:51:38 AMAs long as you do not attempt to start any programs that reside on the infested drive you should be safe.
I have ESET Suite but will try Avast too. Then I'll give the HDD enclosure a try. Is there any chance the virus can get into the new drive? I'd hate to have to start all over again.
Julie
Just copy the data (not programs) that you want to save off the old drive, demount it and either reformat it or store it in a safe place.
The only way that programs can be started on that drive is if you double click the .exe file in explorer or attempt to start it from a command line prompt. Your desktop icons and start menu items should not be pointing to anything on the infested drive when it is mounted like that.
Give me a call if you want some help stepping through here once you get the drive into the enclosure.
-Sandy
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Ms Jessica on May 15, 2009, 12:48:40 PM
Post by: Ms Jessica on May 15, 2009, 12:48:40 PM
I've had boot sector viruses before, the advice about booting off the clean drive is important, make changes to the BIOS first before the system tries to access your drives. Vex's idea about the external enclosure might enable you to connect up the bad drive without having to worry about corrupting the boot sector of your clean drive.
For dead drives, I looked into data recovery when mine crashed a while ago. It was several hundred, not a couple hundred, to recover the data, and totally not worth it. In the end, I've been using it as a paperweight, and just made do without the files I had lost. Fortunately not much trouble, some pictures and songs, but nothing to kill myself over. That's when I started taking Tekla's advice about backing up (and not talking about fight club) :)
For dead drives, I looked into data recovery when mine crashed a while ago. It was several hundred, not a couple hundred, to recover the data, and totally not worth it. In the end, I've been using it as a paperweight, and just made do without the files I had lost. Fortunately not much trouble, some pictures and songs, but nothing to kill myself over. That's when I started taking Tekla's advice about backing up (and not talking about fight club) :)
Title: Re: Anyone know if data can be recovered from a crashed hard drive?
Post by: Lori on May 15, 2009, 05:02:43 PM
Post by: Lori on May 15, 2009, 05:02:43 PM
Quote from: Julie Marie on May 15, 2009, 10:51:38 AM
I have ESET Suite but will try Avast too. Then I'll give the HDD enclosure a try. Is there any chance the virus can get into the new drive? I'd hate to have to start all over again.
Julie
Just make sure avast is running and updated before plugging in the drive.