Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My 120GB laptop disk has crashed and is no longer bootable nor readable by Windows. I was running Windows XP Pro SP3 on it (sole partition).

To save embarrassment let's just say that my last backup was more than one week old! (...and I am planning a new PC with RAID-1)

Ideally I would like to recover 3 files with this priority:

  1. a 25MB Access2003 file (in particular the VBA source code)

  2. a different 25MB Access2003 file (all of)

  3. a 250MB outlook.pst file

I have put the disk in an enclosure and run TestDisk which identified the partition and told me that the root folder and MFT are not readable.

So I got TestDisk to dump it to a ~117GB dump file on local disk.

The source code I want should be located in a handful of 4K clusters. It seems that VBA source code is stored as ordinary non-Unicode text (but with more than "cr-lf" line separators)

I had made numerous copies of File #1 (i.e. "Copy of ...") most of which likely reside on the disk, either in the same folder as the latest version, or in the Trash, and if I could recover any one of them it would likely contain the source code I had not backed up.

Are there any recommendations on how to either:

  1. attempt to reconstruct the files (given that root folder and MFT are munged)? - perhaps software which examines the NTFS log?

  2. quickly search the complete disk dump file for source code ? - i.e. a fast viewer with search facility

share|improve this question

migrated from stackoverflow.com Oct 22 '12 at 1:26

This question came from our site for professional and enthusiast programmers.

I'd suggest grabbing a copy of the disk using a forensics or recovery oriented version of DD and working off that. Testdisk isn't the right tool for this job IMO. Always work on an image rather than the real drive

The first thing I'd try is to use prodiscover basic under free tools to see if that picks it up, It'll read a disk image directly, and runs on windows.

If that fails, you need to grab the heavyhitters The 'class' of tool you're looking for is called a 'carver' and uses file headers to find files.I'd recommend doing it on linux cause these are linux native tools. Scapel and foremost are what I suggest. Read the manpage for usage instructions, and check out a few usage guides online (such as this and this). These are not easy tools to use, and if the file types you are using arn't there, you may need to find the headers and footers of filetypes.

share|improve this answer

Advanced filesystem reconstruction is quite difficult for open source tools, when it comes to NTFS. In this case, a commercial (but not very expensive) tool such as Restorer Ultimate may give quite better results.

That software actually has a demo mode which recovers small files for free. In the case of source code files they could end up being recovered without even buying the license. The program is for Windows but it runs under Wine.

If you want to manually search the image file, since source code is plain text, you could use grep and with the binary switch and get the offsets with:

grep -abir "int main("

The above is just an example of a string which appears in C source code. I don't know VBA so I can't suggest on patterns for that language.

share|improve this answer

An early version of Norton GHOST, (pre ver 9) will easily do this job. MY version is Norton Ghost 2003. You build a bootdisk with this product that includes command-line switches, (which in this instance you want the "Ignore errors on disk" switch).

Once you have built the bootdisk place only the corrupt drive, and a blank drive, (or drive with enough free space to hold the corrupt drive's image) in the "HOST" machine, then using the Ghost bootdisk you created. Boot the machine. (Some older system boards will not recognize SATA under Ghost 2003). IF this happens, just grab a different machine, and try again. (Your brother's machine, a friend's?)

Since we are not trying to boot the drive it does not matter what computer you "Host" this operation on. You will load up to a GUI where you use the very simple "Drop-Down" menu to:

Image the corrupt drive. (Select Local->DISK->To Image be sure to know which drive is which!!!)

If ghost encounters any issues on the drive, such as an improper PC shutdown, it will report that issue and normally exit.

Proper switch inclusion will allow the software to continue. I had three issues, hit "Continue " on each.

The image may be stored on the target drive in 2 GiG increments. with a Ghost image file all increments of the file must be present to work with the drive image. No single increment can be worked with individually.

BTW you CAN pump the image file out on DvD's, however, your NOT going to like it if you want to look at ANYthing on the image as you will have to repeatedly insert disks until the whole image is read in. Each disk rePEATedly.... best to write the image to a HDD.

DvD's work fine if you just want to restore the entire image back to the drive upon failure/virus/crash etc...

Once you have an image of the drive you can use the included "GhostExplorer.exe which is a stand alone single file image reader that will load the image file(s) into a "Windows Explorer" like program that will let you browse the image exactly the same as you would explore the drive normally!

Any file can be opened, but not edited. you can drag a copy of the file to the host computer's drive, and edit or cut-and-paste from it there.

WARNING!!!! If you inadvertently attempt to drag any SYSTEM file(s), that file will automatically go to, and over-write it's corresponding file on the HOST's drive! This means if your working on an XP image and you are hosting on Win 7 as an Administrator you could have a whole new problem.

My MFT crashed just from plain old age. Thing is, my Game host Win 2000 machine took the same dump last week. in both cases the machine is un-bootable and you cannot read any files by installing corrupt drive as drive D: in a functioning machine.
This method allowed me in both cases to image the dead drive and drop the image back onto a known good drive. Yes I know this is a three year old post, but it just came up for me today when I decided to see what was out here on this subject. Long live XP!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.