Reading Windows

The recovery software on my BartPE CD is not half bad: R-Studio NE & Agent, PC-Inspector File Recovery and SmartRecovery, O&O Unerase, Advanced EFS Data Recovery and a bunch of drive image tools.
Yet this whole collection has entirely failed me when faced with a disk where the NTFS structure was partially unreadable due to hard errors. (Windows loves to hang or crash when somebody tries to access a mounted NTFS volume with a badly broken MFT.) I ended up booting my Knoppix CD, using dd/netcat to stream a disk image to another server and resuming dd every time it encountered an unreadable block and died.

This inspired me to write my own data recovery software. It's not an undelete tool - there are tons of excellent undelete tools available - but provides me with the means necessary to salvage any usable data and transfer it to another system for further analysis.

What it can do:

• List all available drives by category: Windows volumes, drive letters and physical drives.

• Display the raw data of any item (Hex View).

• Create raw image files of items (these can be read by R-Studio or mounted as Windows drives using filedisk/CrossCrypt)

• Scan badly fscked up drives for patterns of known file types and store the potential salvaged files in a broken ZIP archive. (The ZIP file works well if you can instruct your unzip to ignore checksum errors)

• Scan physical drives for lost partitions.

Image files and ZIP archives can be saved to a file, sent via TCP/IP (think netcat) or stored on an FTP server.
The program will salvage whatever data is recoverable and replace unreadable sectors with zero-filled dummy sectors.

It's currently freeware but requires a certain amount of computer knowledge (HDD geekiness) and is not intended to be used by computer illiterates.

Links:
Download (just unzip and run)
Screenshot

Consider yourself hugged.

This post was edited by null on Feb 17, 2006.

One suggestion - can you add the ability to reclaim bad sectors?

I've recently had a bad sector appear on my hard drive - a standard CRC error. Since it got tagged as a bad cluster, I figured that there was no way any real data could be hosed anymore. The instant I wrote something to that bad sector, it was working fine once again.

I don't expect getting that thing ready to reclaim the bad sector in the logical filesystem - it would be absolute murder under NTFS.

can you add the ability to reclaim bad sectors?

I have no idea how this would be done - I suppose it can't be done with regular Windows API calls, as they (officially) refuse to deliver any data if there's an error.
But I've added it to my to-do list, let's see what happens :-)

Consider yourself hugged.

I have no idea how this would be done - I suppose it can't be done with regular Windows API calls, as they (officially) refuse to deliver any data if there's an error.
But I've added it to my to-do list, let's see what happens :-)

There's no need to deliver data - only the ability to reclaim the bad sector. It's a simple two step process:

- Overwrite the bad sector weth data. This eliminates the CRC error.
- Unmark the cluster as bad. Trivial on FAT/FAT32, but more complex on NTFS.

If you run into problems, there's always the option of a Floppy disk version that doesn't need to use the API. But that's hard to write. :)

Oh, overwriting a sector is a rather easy task. Changing its status from bad to free is a bit more work but probably still possible.
What bugs me about CRC errors is that there's usually a reason for them... and frankly, since I don't have backups of everything, when one of my HDDs starts producing bad sectors, reclaiming the lost space to store potentially important data on it isn't exactly my top priority. :-)

Consider yourself hugged.

The recovery software on my BartPE CD

Your BartPE CD was and still is badass (I modified it and added testdisk to the ...root folder I think). I started to make my own (with updated partition magics and testdisk and such) but havn't needed it in a while.

Pistol Grip Pump In My Lap At All Times

This post was edited by eljefe on Mar 08, 2006.