Forced migration from Windows XP

[JackSchitt]

A few weeks ago, January 30th, to be exact ( everybody here should recognize THAT date as the date that Vista was released to the public), I swore a blood oath that my next upgrade would be either to Linux of some kind or to MacOS if it was available for non-Apple computers.

Earlier this evening, I received the much dreaded 'NTLDR is missing' message upon rebooting the system (it had had some interesting errors when reading a few files and I figured that some process was using them). This message is being typed from a live boot CD that I will be using until I can recover some source code from the harddrive.

I'd be very interested to know how to mount an unencrypted/uncompressed NTFS file system. I'm not sure if the drive is still functioning, but I am very interested in finding out if it does.

If you have any info on mounting/testing a harddrive and/or any info on recovering data from a hard drive, please reply here.

The live disk I'm running is Mint, though I also have a 64bit Ubuntu that I can use. I might have a spare harddrive that I can use, if needed, but I'd rather fix this quick and dirty without installing anything if possible.

I have a very good understanding of computers in general and a good understanding of Windows XP and .Net. My understanding of Linux is not where I'd like it to be. Telling me to mount a drive does nothing for me. Telling me to open a terminal, type mount -t... is what I'm looking for. (That's just about the only command I'm familiar with.)

If I'm able to get the project off my harddrive that I've been working on for the last six weeks, the person that helped me most directly will receive $20USD via PayPal.

Thanks in advance.

Regards,
A very pissed off Jack Schitt

[arochester]

I don't know Mint or 64bit Ubuntu. I assume that your hard drive does not automatically show with either. To get around mounting you should get a Knoppix LiveCD disk. This should automatically mount and show your hard drive. Have a look at "System recovery with Knoppix" at http://www-128.ibm.com/developerwork...y/l-knopx.html

[JHB]

If you want to recover data on the drive, while running a live cd, you will probably need another drive to copy the data to.

Assuming this, you will need to mount both drives, and maybe create a filesystem if the one is a new drive.

If you run openSuSE, you can click on MyComputer, and it will show your drives, and the copy graphically. You can also use YaST to create partitions and format them graphically.

I will assume you are not running SuSE, so will try to explain using the command line:

Open a terminal. If you are the root user, the prompt should be a #, else become the root user by typing
%su

I would suggest making two directories underneath the mnt directory to mount the two drives.

#mkdir /mnt/drive1
#mkdir /mnt/drive2

Mount the drives:
For this you will need to know if they are scsi, SATA or ATA drives.
You may be able to see there device names in the boot messages file:
type #less /var/log/boot.msg
Look for hda/hdb/sda/sdb etc

mount the drives using:
#mount -t ntfs /dev/hda /mnt/drive1
(Substituting the device name for your drive)

Use ntfs only for the drive you are copying data from.
For the other you can leave it out - actually, it should autodetect it in any case. If you are running SuSE it will.

If you need to create a filesystem on the destination drive, use
#fdisk /dev/hda
m for help
create the partitions and set the type to Linux (probably)
Create the filesystem:
(I use reiserfs)
#mkreiserfs /dev/hd?
or
#mkfs -t ext3 /dev/hd?

mount this drive.
You can create new directories :
#mkdir /mnt/driveX/.....

Copy your files:
#cp -R /mnt/drive1/* /mnt/drive2/

If the drive has errors, download ddrescue
This can copy the whole drive into an image file, which you can then mount as if it was a drive, and copy the data it was able to recover from it.

[ennoil]

OK - Boot to the Live CD (which I am guessing you have done if you are reading this) If you have the time and bandwidth I would suggest Knoppix to be better than the 2 choices you have now...CD version will do fine...If you have a CDR, Damn Small Linux (50mb iso image download) would be even better since that can load completely in your RAM (At boot prompt type "linux toram") then you can free up your CDR to burn the info you want with K3b...
Open up a terminal and type:
sudo mkdir /mnt/h-drive
sudo mount /dev/hda1 /mnt/h-drive
from this you will know if your drive is totally hosed...If it does not mount then use the command:
dmesg | tail -20
to find out why.
If it does mount you can
cd /mnt/h-drive
and start looking for the files you want to save...Your best bet is to copy them to a USB pen drive.
For that:
Insert the drive and wait about 45 seconds to see if the drive is found. If not it will most likely be seen by the system as /dev/sda1 and mount. that...
then use
cp -r /mnt/h-drive/path/to/files/* /mnt/p-drive/
Not being a big friend of windblows I am not too sure but it does sound like a system re-install will be needed.

[foureyes]

Was it that you just needed to read an uncorrupted hard drive or were there other problems? I lost ntfs partitioning and used UBCD to see if info was recoverable. Trouble is it won't restore using the program on it but it will show you if info is still there.

[JackSchitt]

After I posted that message, I did a bit more research. There are apparently a LOT of tools that can read NTFS and recover data from them. Most run under windows.

What I'm doing right now? I found a spare hd (100gb, no less...). I put windows xp on it to run a commercial recovery tool. 30-day trial. Not open-source, but should get the job done.

It includes a neat little feature that allows you to view the drive in raw mode (hex editor viewing the hd).

I did a search for ImageSignature (the name of a class I had been working on) and found the source code. Now I know it's there. The program is currently 'Anylizing' the hard drive for partition info, but it says 16 hours remaining...

Now the story of what led up to this:

I was using VMWare v5.5 for windows to run windows xp. Just playing with it. I was using the physical hard drive (the 100gb spare) as the vm hd. I managed to get windows installed on it and it was working fine.

Now, you should note that I have a keyboard with a power button on it. This is mainly because it is difficult to find one without it. You should also note that having large objects (i.e. glass cups) next to the keyboard is somewhat risky. That said, having such a glass cup filled with liquid is just asking for trouble. Then there's that whole "it can't happen to me" mentality.

As you probably didn't predict, the glass cup didn't spill, land, fall, or even come into contact with the keyboard. It doesn't really even have anything to do with this story and is just here to throw you off from what actually happened: I intentionally hit the power button on the keyboard to induce hibernation mode on the guest, little realizing that it would also induce hibernation mode on the host. I honestly thought that VMWare would filter that particular key from the host. Nope.

VMWare sent the key to the guest and didn't filter it from the host. What follows is what I think happened:

Key is pressed
VMWare sends the key to the guest, without filtering it from the host.
Guest begins to hibernate.
Host begins to hibernate.
HDA2 powers down (dropping the hibernation data for the guest).
VMWare notices the pending hibernation and suspends the guest. (Guest is suspended in the middle of a hibernation, writing data to a drive that is turned off.)
Host hibernates.

When I turn everything back on, VMWare proudly shows the suspended (not powered off) guest.
I reboot the guest and it displays gibberish on the screen (instead of 'Hibernation data corrupt. Delete?') and VMWare crashes.

I browse to HDA2 from the host and it won't let me touch any of the data. Can't delete hiberfile.sys, boot.ini contains data from the wrong file. General mayhem.

Shoot. Time to reinstall guest. Let's delete the guest settings and rebuild.

I created a new VM and attached the drive. This is the part where you might ask if I attached the correct drive. I did. I was very careful to make sure I did. The host drive is 250gb and the guest is 100gb. Boot off of Windows XP iso, delete partition...quick format. WTF? Format failed? Delete partition... long format. 5 minutes later, WTF? Format filed?

Fine... I'll wory about it later. I hadn't yet realized that I would be worrying about it about one minute later.

A little stressed? Time for pr0n. Specific site requires IE. I paid for the site before this requirement came about and I still have 2 months left. IE crashes with an 'An error occured in IEXPLORE.EXE'. How very odd. Open task manager? Nope. Instead, I get a console window and a message saying 'c:\windows\system32\taskmgr.exe is not a valid win32 executable image'. Process explorer still works, but I have to run the exe manually.

Notice that the windows folder is completely empty. I get that 'sinking feeling'.

Plug in thumb drive and attempt back up. It won't let me copy any files and it won't load them either.

Reboot computer and get ntldr is missing.

[foureyes]

How did it go and what program did you use?

I still have to do that hard drive I was talking about. Too much this weekend. Dban scsi drives install in server. Set up Fedora and start learning to use it. Fix desktop hdd's. Set up vectra for audio. and then (how rude) house work too!

Have you managed to save what you were doing?

[JackSchitt]

I'm using a nice little tool called Handy Recovery which is from the aptly named handyrecovery.com.

It seems to have found most of my files and folder structure. It also found a whole shitload of unnamed folders that I'll have to go through (FL Studio and the mixes I was working on at the moment weren't listed in the named section though the sourcecode that I was also working on at the moment was.)

Looking for partitions took 16 hours. The unregistered software only lets you recover one file per day and registration is $40. I'm likely to register the software.

When it was looking for partitions, the hd light on the case stayed on solid. Apperently, the software looks for partitions directly from the drive, incrementing one byte at a time.

A faster method might be to read ~1gb to memory and scan the memory instead. If I end up writing my own recovery tool, I'll look into doing it that way...