Two and a half years ago I wrote about recovering data from corrupted hard drives (here, here, and here). Two weeks ago I wrote about having to move my hard drive from one laptop to another, because my old one was suffering from some kind of motherboard failures. Well, while the computer "worked" well enough, it obviously had an issue or two (probably due to subtle system or driver changes due to the dying motherboard), because once in a blue moon it would suffer a BSD (blue screen of death) when I was doing something fairly innocuous. But, since a brand new computer was coming RSN ("real soon now"), I figured I would keep my MIS guy off my back by coaxing the laptop along until then. You have figured I’d learn by now …
Late last week, right after a BSD incident, the laptop complained upon rebooting that it had determined that the failure was because I needed to install the latest service pack for Visual Studio .NET, and all would be well. Okay, I tell it, I’m game, go ahead. It proceded to take an hour or so to download the 417MB of data (wow, that’s big). Unfortunately, somewhere in the middle of the installation (I wasn’t there at the time), another BSD occured. This time, it wouldn’t wake up again. When I rebooted it, I’d get the manufacturers splash screen, and then … nothing. Not the standard black screen w/ white status bar and then the XP Loading picture, just nothing. Okay, sweat starting to bead on the forehead, let’s hit the old F8 key. Nothing. No hard drive activity, just plain dead.
I try the "move the hard drive to another computer" trick that worked so well before. Nothing. So I go to my MIS guy, and he presses the magic keys, and the system tries to boot from the network (VERY neat trick!). Okay, so the system is fine. He starts a network backup of the hard drive (since there is VERY important, and naturally not-backed up data on the drive), and he can read everything. Unfortunately, it’s a binary image copy, which means that if doesn’t have another drive of EXACTLY the same topology, the copy is meaningless. But it does mean that the drive isn’t completely dead.
So, I borrow a USB drive caddy, with the SATA-ATA adapter, and I try reading the hard drive from another desktop. I plug in the USB cable, and see a message on the screen "The drive is not formatted. Do you wish to format it?" NOOOO!!!! This drive is telling me that it’s got serious issues, with either the partition table or the partition boot record. (Yes, from a past life I know about both; I used to live there.) But I don’t want to take a hack at it (literally) until my MIS guy has one more shot at it.
He tries a couple of more obscure recovery tools he’s got, and late yesterday tells me that there’s nothing he can do, it’s all up to me. I happen to have a couple of periods free this morning, so I take the drive back. I also take another identical drive (the original drive from the laptop I hijacked two weeks ago) to serve as the valid data point. (For clarity’s sake, let’s call my original laptop and drive the A units, and the borrowed laptop and its drive the B units.) Armed with hard drive A, hard drive B, the SATA-ATA adapter, and a bootable floppy (with some of my magical tools from a dozen years ago), I opened up a desktop computer.
I put hard drive B into the desktop, booted the floppy, and used a home brew disk editor to look at the individual sectors. I see the Master Boot Record (MBR) with a valid partition table (which I dutifully copy down), pointing to a valid partition, whose partition boot sector (PBS) looks healthy. Good to know. There’s lots of empty space between the MBR and PBS; this is expected. I’m a little disconcerted that live file data follows the PBS; I would have expected the equivalent of the FAT, but I know that NTFS doesn’t have to have the FAT equivalent in any particular location, so I’m okay with this.
Then I put hard drive A into the desktop. MBR with a partition table identical to the other (expected), some blank space … wait a moment, there’s data here! The first track is not all empty! And there’s no PBS at the start of the partition! Whatever overwrote this continued on, because the data that starts mid first track continues on beyond where the live stuff was. Okay, this is not good, but the explanation is here: SOMETHING corrupted the start of the drive!
Okay, take a breath, time to think. I reload hard drive B, and using another obscure and ancient tool of mine, I copy a bunch of the sectors from the "good drive" (including the PBS and the live data that followed) directly to the floppy. Reload hard drive A, and … no, don’t paste it down yet. First preserve the same sectors onto the floppy, in case this doesn’t work. Okay, NOW copy the saved sectors from the good drive onto the same location on the bad drive. Done.
Now … no, I still can’t read the drive. I don’t have a bootable floppy disk that can read an NTFS partition. Hmmm, okay, put the drive back into the USB caddy. Plug it into a booted system, and YES! IT SEES ALL THE DATA!
Immediately I start a large scale transfer of all the critical data onto a network drive. All is almost right with the world, I have the stuff I need for school again.
But now that this crisis is over, I have to wonder … can this drive boot in my laptop again? Stay tuned …