[ILUG] Recovering data from a corrupt hard drive

[Pádraig Brady]

James Galvin wrote:
> Hello,
> 
> I'm having some trouble recovering data off a corrupt ntfs hard drive.
> I can mount the drive and browse folders and get some of the data, but
> some of the important data I need (including Outlook.pst) cannot be
> copied over.
> 
> I tried using dd_rhelp to get an image of the hard drive, but when I
> attempt to mount that with "mount -o loop -t ntfs hda1_rescue.img
> mountdir" it tells me there is a bad superblock on /dev/loop1, and I get
> the following output from dmesg:

Did you take an image of the drive or of the partition?
If you did take an image of the drive you will
need to find the offset of the ntfs partition,
to mount it loopback.

I've a script to help with this. All you need to
do is provide the partition number to use
(use `fdisk -l file` if you don't know).

http://www.pixelbeat.org/scripts/lomount.sh

personally I've found booting from a knoppix CD,
and moving the data through the NTFS driver
over the network to a backup system, adequate
for recovering systems where windos can no longer boot.

There are dedicated live CDs for this also.
You could look at the rescue or forensics distros available at:
http://www.livecdlist.com/

Pádraig.