Thursday, August 11, 2005

Crash recovery - a litany of errors

Here's how NOT to recover from a faulty hard drive.

I turned on my laptop and got an error while booting about a faulty NTLDR.SYS file - or some name like that. The error said to insert the Windows CD and select option "R" to recover.

My Acer laptop didn't come with a Windows CD, it came with a "Recovery CD". So I inserted that CD, booted from it, and the damned thing started formatting my hard drive. Yes there was some vague warnings in broken English about backing up data, but I was expecting to see a Windows message, and got something totally different.

"Ah!!!!" I screamed as I saw what was happening, and turned my machine off in the middle of the format.

Now the disk drive was partially formatted, and had no directory info on it.

So I plugged in my trusty USB drive backup, and went about getting the machine ready to Ghost the backup drive back to the original drive.

Getting a laptop to boot from a CD and run Ghost is an effort in itself and took me about 2 hours to figure out. If you want to try it yourself, get Ghost to burn a bootable floppy that does the same thing, and use something like UBCD to convert the floppy to a CD.

So I ghosted the backup drive back to the laptop, booted the laptop and.... NOTHING. The USB drive was faulty, and the backup drive was unreadable.

"Ah!!!!" I screamed again in a Homer Simpsonesque panic.

I ran Spinrite on the USB drive in a vain attempt to fix it. But the back up drive was faulty (remember, Neil?) and so it just made things worse - and I lost the partition table on the backup drive.

So I threw the USB drive caddy out the window, and connected te Backup drive to a spare IDE port on my desktop computer. Still no joy.

So I tried a thing called "Diskpatch" which is supposed to fix partition tables. It said a few encouraging words, and did absolutely nothing.

Finally, I tried a thing caled "iRecover". It was able to see stuff on the drive. Most of it was scrambled, but I used it to pump as much corrupted data from the drive as I could.

It has been running for about 7 days, and has almost finished pumping everything from the 60GB backup drive. about 75% of the stuff is rubbish. I was able to recover one or two snippets that were some use to me.

Bottom line - I lost about 6 months worth of work - but was able to scrounge a lot of it back from other sources.

I NEVER EVER want to go through this again. It's bad for my health, my marriage and my business. Here's what I will do in future:

1. Backup more regularly to multiple locations.
2. Use something like NTI to create a bootable backup DVD of my drive.
3. Get a new Laptop - the Acer Travelmate is rubbish.
4. Never try to run windows repair on a faulty drive until I've pumped it for all the information I can.
5. Never trust a USB drive. Especially one that runs hot.
6. Backup more regularly to multiple locations.
7. Buy high quality equipment

The other thing with Laptops - don't move them around until you've put the machine in standby mode. If you do, the diskdrive is still spinning, and there's a good chance you'll stuff the drive up.

You will have one of your disks crash on you sometime in the next few years. It's happened to me 4 times in the last 12 months on 2 different machines. Make sure you can recover from it. Do something about it today.

iRecover is available from

It works, but it is damned slow.


rehiddenUser said...

I just read your little but useful musing.
I will try all of the recovery apps you mentioned because I just had clusterfudge of a time trying to see what Win2k deleted from my cluster chains.

omigosh, it's going to be a long weekend.

anyway, thanks buddy, I sure hope iRecover does the trick.

Gunjan Joshi said...

How much of the data is crap and how much usable?

Gunjan Joshi said...

Is it worth it to use iRecover after WinRecovery? I've gone through Windows Recovery myself and it has been extremely helpful in telling me how screwed up my system is..

Neil Ennis said...

Gunjan - you end up with a lot of crap, but I managed to recover some key files. It was worth it for me.

These days I keep all of my key data backed up using SVN in an offline repository, and run virtual machines which are easy to back up - you just copy a few large files from one drive to another.

Ridhi Sharma said...

I have a 2009 Packard Bell laptop that has experienced a system crash. I tried different recovery methods (which before execution, stated that all data would be erased). These methods all failed, so now I am forced to take the laptop in to a computer shop.
Will the data still be recoverable after my failed recovery attempts? And since my laptop has password protected user accounts, will the data be exposed to the technicians?

Brad Fallon

Neil Ennis said...

Ridhi, best of luck with your data recovery. There's no guarantees that you'll get all the data back, but there are some pretty clever utilities out there which will give you (or the computer shop) a good chance.

Yes - if the shop recovers the data, they may have access to private user files (unless you encrypted the disk).