need help recovering data from a hard drive

[Chess007]

Hi,

A Windows hard drive failed to boot. Its an 80 gb drive and has 2 partitions. It had bootmagic installed on it as the bootloader. I want to recover the data. Here's a look at my confused attempt:

knoppix@ttyp0[knoppix]$ mount /mnt/hda
mount: I could not determine the filesystem type, and none was specified
knoppix@ttyp0[knoppix]$ mount /mnt/hda fat32
mount: only root can do that
knoppix@ttyp0[knoppix]$ su root
root@ttyp0[knoppix]# mount /mnt/hda
mount: you must specify the filesystem type
root@ttyp0[knoppix]# mount /mnt/hda fat32
mount: mount point fat32 does not exist
root@ttyp0[knoppix]# modprob hda
bash: modprob: command not found
root@ttyp0[knoppix]# modprobe hda
modprobe: Can't locate module hda
root@ttyp0[knoppix]# sudo fdisk -lu

Disk /dev/hda: 255 heads, 63 sectors, 9729 cylinders
Units = sectors of 1 * 512 bytes

Disk /dev/hda doesn't contain a valid partition table
root@ttyp0[knoppix]# gpart /dev/had

*** Fatal error: open(/dev/had): No such file or directory.
root@ttyp0[knoppix]# dmesg
Linux version 2.4.27 (root@Koffer) (gcc version 2.95.4 20011002 (Debian prerelease)) #2 SMP Mo Aug 9 00:39:37 CEST 2004
BIOS-provided physical RAM map:
BIOS-e820: 0000000000000000 - 000000000009f400 (usable)
BIOS-e820: 000000000009f400 - 00000000000a0000 (reserved)
BIOS-e820: 00000000000e6c00 - 0000000000100000 (reserved)
BIOS-e820: 0000000000100000 - 00000000040fd800 (usable)
BIOS-e820: 00000000040fd800 - 00000000040ff800 (ACPI data)
BIOS-e820: 00000000040ff800 - 00000000040ffc00 (ACPI NVS)
BIOS-e820: 00000000040ffc00 - 0000000010000000 (usable)
BIOS-e820: 00000000fff80000 - 0000000100000000 (reserved)
0MB HIGHMEM available.
256MB LOWMEM available.
On node 0 totalpages: 65536
zone(0): 4096 pages.
zone(1): 61440 pages.
zone(2): 0 pages.
ACPI disabled because your bios is from 1999 and too old
You can enable it with acpi=force
Kernel command line: ramdisk_size=100000 init=/etc/init lang=us apm=power-off vga=791 initrd=minirt24.gz nomce quiet BOOT_IMAGE=knoppix BOOT_IMAGE=linux24 lang=us
Local APIC disabled by BIOS -- reenabling.
Found and enabled local APIC!
Initializing CPU#0
Detected 548.748 MHz processor.
Console: colour dummy device 80x25
Calibrating delay loop... 1094.45 BogoMIPS
Memory: 255284k/262144k available (1406k kernel code, 6460k reserved, 574k data, 144k init, 0k highmem)
Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
Inode cache hash table entries: 16384 (order: 5, 131072 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 16384 (order: 4, 65536 bytes)
Page-cache hash table entries: 65536 (order: 6, 262144 bytes)
CPU: L1 I cache: 16K, L1 D cache: 16K
CPU: L2 cache: 512K
CPU: After generic, caps: 0383fbff 00000000 00000000 00000000
CPU: Common caps: 0383fbff 00000000 00000000 00000000
Enabling fast FPU save and restore... done.
Enabling unmasked SIMD FPU exception support... done.
Checking 'hlt' instruction... OK.
Checking for popad bug... OK.
POSIX conformance testing by UNIFIX
mtrr: v1.40 (20010327) Richard Gooch (rgooch@atnf.csiro.au)
mtrr: detected mtrr type: Intel
CPU: L1 I cache: 16K, L1 D cache: 16K
CPU: L2 cache: 512K
CPU: After generic, caps: 0383fbff 00000000 00000000 00000000
CPU: Common caps: 0383fbff 00000000 00000000 00000000
CPU0: Intel Pentium III (Katmai) stepping 03
per-CPU timeslice cutoff: 1462.42 usecs.
SMP motherboard not detected.
enabled ExtINT on CPU#0
ESR value before enabling vector: 00000000
ESR value after enabling vector: 00000000
Using local APIC timer interrupts.
calibrating APIC timer ...
..... CPU clock speed is 548.7464 MHz.
..... host bus clock speed is 99.7718 MHz.
cpu: 0, clocks: 997718, slice: 498859
CPU0<T0:997712,T1:498848,D:5,S:498859,C:997718>
Waiting on wait_init_idle (map = 0x0)
All processors have done init_idle
ACPI: Subsystem revision 20040326
ACPI: Interpreter disabled.
PCI: PCI BIOS revision 2.10 entry at 0xfd993, last bus=1
PCI: Using configuration type 1
PCI: Probing PCI hardware
PCI: Probing PCI hardware (bus 00)
PCI: Using IRQ router PIIX/ICH [8086/7110] at 00:07.0
Limiting direct PCI/PCI transfers.
isapnp: Scanning for PnP cards...
isapnp: No Plug & Play device found
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
VFS: Disk quotas vdquot_6.5.1
vesafb: framebuffer at 0xf5000000, mapped to 0xd080d000, size 3072k
vesafb: mode is 1024x768x16, linelength=2048, pages=4
vesafb: protected mode interface info at c000:4785
vesafb: scrolling: redraw
vesafb: directcolor: size=0:5:6:5, shift=0:11:5:0
Console: switching to colour frame buffer device 128x48
fb0: VESA VGA frame buffer device
pty: 256 Unix98 ptys configured
Floppy drive(s): fd0 is 1.44M
FDC 0 is a post-1991 82077
RAMDISK driver initialized: 16 RAM disks of 100000K size 1024 blocksize
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
PIIX4: IDE controller at PCI slot 00:07.1
PIIX4: chipset revision 1
PIIX4: not 100% native mode: will probe irqs later
ide0: BM-DMA at 0x10a0-0x10a7, BIOS settings: hda:DMA, hdb:pio
ide1: BM-DMA at 0x10a8-0x10af, BIOS settings: hdc:DMA, hdd:pio
hda: ST3802110A, ATA DISK drive
hdc: CR-48X9TE, ATAPI CD/DVD-ROM drive
ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
ide1 at 0x170-0x177,0x376 on irq 15
hda: attached ide-disk driver.
hda: host protected area => 1
hda: 156301488 sectors (80026 MB) w/2048KiB Cache, CHS=9729/255/63
Partition check:
hda: unknown partition table
ide: late registration of driver.
SCSI subsystem driver Revision: 1.00
libata version 1.02 loaded.
kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno = 2
kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno = 2
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 2048 buckets, 16Kbytes
TCP: Hash tables configured (established 16384 bind 16384)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 781k freed
EXT2-fs warning: checktime reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
hdc: attached ide-scsi driver.
scsi0 : SCSI host adapter emulation for IDE ATAPI devices
Vendor: MITSUMI Model: CR-48X9TE Rev: 5.0E
Type: CD-ROM ANSI SCSI revision: 02
Attached scsi CD-ROM sr0 at scsi0, channel 0, id 0, lun 0
sr0: scsi3-mmc drive: 40x/40x writer cd/rw xa/form2 cdda tray
Uniform CD-ROM driver Revision: 3.12
NCR53c406a: no available ports found
aec671x_detect:
scsi: <fdomain> Detection failed (no card)
GDT: Storage RAID Controller Driver. Version: 2.05
GDT: Found 0 PCI Storage RAID Controllers
megaraid: v1.18k (Release Date: Thu Aug 28 10:05:11 EDT 2003)
megaraid: no BIOS enabled.
DC390: 0 adapters found
Failed initialization of WD-7000 SCSI card!
Guestimating sector 156280064 for superblock
driver for Silicon Image(tm) Medley(tm) hardware version 0.0.1: No raid array found
Medley RAID: No usable RAID sets found
Promise Fasttrak(tm) Softwareraid driver 0.03beta: No raid array found
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
usb-uhci.c: $Revision: 1.275 $ time 00:50:50 Aug 9 2004
usb-uhci.c: High bandwidth mode enabled
PCI: Found IRQ 9 for device 00:07.2
PCI: Sharing IRQ 9 with 00:0c.0
usb-uhci.c: USB UHCI at I/O 0x1080, IRQ 9
usb-uhci.c: Detected 2 ports
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
blk: queue c03661a0, I/O limit 4095Mb (mask 0xffffffff)
ISO 9660 Extensions: Microsoft Joliet Level 3
ISO 9660 Extensions: RRIP_1991A
cloop: Initializing cloop v2.01
cloop: loaded (max 8 devices)
cloop: /cdrom/KNOPPIX/KNOPPIX: 30369 blocks, 65536 bytes/block, largest block is 65552 bytes.
ISO 9660 Extensions: RRIP_1991A
Freeing unused kernel memory: 144k freed
Real Time Clock Driver v1.10f
apm: BIOS version 1.2 Flags 0x03 (Driver version 1.16)
Linux Kernel Card Services 3.1.22
options: [pci] [cardbus] [pm]
Intel ISA PCIC probe: not found.
Databook TCIC-2 PCMCIA probe: not found.
usbdevfs: remount parameter error
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI ISAPNP enabled
ttyS00 at 0x03f8 (irq = 4) is a 16550A
parport0: PC-style at 0x378 [PCSPP,TRISTATE,EPP]
PCI: Found IRQ 10 for device 00:0d.0
3c59x: Donald Becker and others. www.scyld.com/network/vortex.html
See Documentation/networking/vortex.txt
00:0d.0: 3Com PCI 3c905C Tornado at 0x1000. Vers LK1.1.18-ac
00:50:da:59:21:c1, IRQ 10
product code 5944 rev 00.11 date 09-18-99
Internal config register is 1800000, transceivers 0xa.
8K byte-wide RAM 5:3 Rx:Tx split, autoselect/Autonegotiate interface.
MII transceiver found at address 24, status 7809.
Enabling bus-master transmits and whole-frame receives.
00:0d.0: scatter/gather enabled. h/w checksums enabled
PCI: Found IRQ 9 for device 00:0c.0
PCI: Sharing IRQ 9 with 00:07.2
ymfpci: YMF724F at 0xf4000000 IRQ 9
ac97_codec: AC97 Audio codec, id: ADS3 (Analog Devices AD1819)
Linux agpgart interface v0.99 (c) Jeff Hartmann
agpgart: Maximum main memory to use for agp memory: 204M
agpgart: Detected Intel 440BX chipset
agpgart: AGP aperture is 64M @ 0xf8000000
FAT: bogus logical sector size 0
VFS: Can't find a valid FAT filesystem on dev 03:00.
EFS: 1.0a - http://aeschi.ch.eu.org/efs/
FAT: bogus logical sector size 0
VFS: Can't find a valid FAT filesystem on dev 03:00.
root@ttyp0[knoppix]# cd dev/hda
bash: cd: dev/hda: No such file or directory
root@ttyp0[knoppix]# cd dev
bash: cd: dev: No such file or directory
root@ttyp0[knoppix]# cd /mnt
root@ttyp0[mnt]# hda
bash: hda: command not found
root@ttyp0[mnt]# mount hda
mount: you must specify the filesystem type
root@ttyp0[mnt]# mount -t vfat /mnt/hda /mnt
mount: /mnt/hda is not a block device
root@ttyp0[mnt]# dmseg |grep hd
bash: dmseg: command not found
root@ttyp0[mnt]# dmesg |grep hd
ide0: BM-DMA at 0x10a0-0x10a7, BIOS settings: hda:DMA, hdb:pio
ide1: BM-DMA at 0x10a8-0x10af, BIOS settings: hdc:DMA, hdd:pio
hda: ST3802110A, ATA DISK drive
hdc: CR-48X9TE, ATAPI CD/DVD-ROM drive
hda: attached ide-disk driver.
hda: host protected area => 1
hda: 156301488 sectors (80026 MB) w/2048KiB Cache, CHS=9729/255/63
hda: unknown partition table
hdc: attached ide-scsi driver.
root@ttyp0[mnt]# fdisk -i
fdisk: invalid option -- i

Usage: fdisk [-b SSZ] [-u] DISK Change partition table
fdisk -l [-b SSZ] [-u] DISK List partition table(s)
fdisk -s PARTITION Give partition size(s) in blocks
fdisk -v Give fdisk version
Here DISK is something like /dev/hdb or /dev/sda
and PARTITION is something like /dev/hda7
-u: give Start and End in sector (instead of cylinder) units
-b 2048: (for certain MO disks) use 2048-byte sectors
root@ttyp0[mnt]# fdisk -l

Disk /dev/hda: 80.0 GB, 80026361856 bytes
255 heads, 63 sectors/track, 9729 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/hda doesn't contain a valid partition table
root@ttyp0[mnt]# gpart /dev/hda

Begin scan...
Possible partition(DOS FAT), size(25682mb), offset(0mb)
Possible extended partition at offset(25682mb)
Possible partition(DOS FAT), size(50634mb), offset(25682mb)
End scan.

Checking partitions...
Partition(DOS or Windows 95 with 32 bit FAT, LBA): primary
Partition(DOS or Windows 95 with 32 bit FAT, LBA): primary
Ok.

Guessed primary partition table:
Primary partition(1)
type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT, LBA)
size: 25682mb #s(52596747) s(63-52596809)
chs: (0/1/1)-(1023/254/63)d (0/1/1)-(3273/254/63)r

Primary partition(2)
type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT, LBA)
size: 50634mb #s(103699512) s(52596873-156296384)
chs: (1023/254/63)-(1023/254/63)d (3274/1/1)-(9728/254/63)r

Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

root@ttyp0[mnt]#

I'm not ery good with the command line. Should I do the following?

"Now if after the check-phase it says Ok, you should check the proposed partition table very carefully. After that you may write back the guessed table by calling "gpart -W /dev/hdc /dev/hdc" (exchange /dev/hdc with your disk device). When gpart has successfully written the new primary partition table, cross your fingers and reboot."

Source:
http://www.stud.uni-hannover.de/user/76201/gpart/

I noted "Partition(DOS or Windows 95 with 32 bit FAT" it has windows 98 on it, not win 95. It was a fat32 file system.

[michaelk]

As you probably figured out your partition table has been corrupted.
testdisk is also a good utility to use to help restore it.

The official partition ID label for 0XC is "WIN95 OSR2 FAT32, LBA-mapped". does not matter if you are running W98.

http://www.win.tue.nl/~aeb/partitions/partition_types-1.html

You will not be able to mount /dev/hda. You need to specify a partition number but since the table has been corrupted this will fail too.

How much data is on this drive? You could use the dd command to create a backup to another drive. If you mess up something trying to repair then you still have your data.

[stumbles]

If you decide to go the "dd" route, I would recommend dd_rescue instead. It works just like dd but will not abort on errors. I have used it before and it works well.

[ehawk]

http://www.ptdd.com/

http://www.datadoctor.org/

http://www.ntfs.com/partition-recovery-concepts.htm

http://www.datadoctor.in/

http://partition-table-recovery.qarchive.org/

http://www.p-dd.us/deleted-files-recovery/windows.asp

http://www.downloadjunction.com/product/store/28570/index.html

http://the-undelete.com/ntfs_partition_recovery.php

http://www.runtime.org/

[Chess007]

Thank you all kindly! :) Linux just batted this one right out of the park! To recover my hard drive all I had to do was:

Note: Enter (or Return) must be pressed after each command.

1. Become root

cd /mnt

gpart /dev/hda

If everything looks right, then:

gpart -W /dev/hda /dev/hda

It asked if I wanted to make changes to the partition table. It looked fine so

no

It asked what partition to make active, I typed

1

After it was done (it only took a second) I restarted the computer. Both partitions showed up. :) I put this information here so that if another newbie (i'm not a linux newbie, just a command line newbie... my command line experience is limited to apt, yum, installing things, cd, etc; simple things.) stumbles across this thread, they will be helped. :)

[trinitous]

Thanks in advance for all the posts so far. They have been helpful. Let me start by saying I am for all practical purposes, a complete linux newbie. As such, please forgive me if I sound like a moron, because, when it comes to linux, I am one.

I have a similar problem to the one listed in this post. I have a notebook hard drive that was being used with an external case for data backup. The case died a few weeks back. The drive appears to be functional as it shows up in windows when plugged in. but it says it needs to be reformatted (I'd just reformat it, except it has some class files that I need, if at all possible.) I have have been reading several sites that discuss using Knoppix for recovering files. I have tried a few other windows based programs, but with no luck. I have also tried reading the drive from knoppix, but I get the following error:
"mount: I could not determine the filesystem type, and none was specified."

I have also tried the steps outlined at the end of this forum, but I get the following results:
input : knoppixx@1[mnt]$gpart /dev/sda
error:****Fatal error: cannot get the sector size on dev(/dev/sda).

If anyone has any thoughts or suggestions, I'd greatly appreciate it. The data that I stand to lose isn't valuable enough to pay the large sums of money required by data recovery specialists, but I will have to redo a great deal of research and writing for my senior project as well as many other classes, if I can't get this data.

[saikee]

trinitous,

Welcome to Justlinux.

I would suggest you start a new thread rather than tagging your case at the end of another thread.

In your case I am not hopeful because you claimed you have just reformatted the hard disk. Formatting will destroy the filing index structure of your filing system.

You may be able to salvage other partitions if you have formatted only one partition and not the whole drive.

You should post the output here by the terminal command
sudo su
fdisk -lto show the structure of the partition table as read by Linux.

You may need to explain further on why the casing had died but you could still read it with a MS Windows, presumable you changed to another casing and the disk should then behave normally.