Unknown Kadath

How To Fix: Recover Data From a Scratched or Damaged CD or DVD

Posted on February 10th, 2013 by James Litten

How To Fix: Recover Data From a Scratched or Damaged CD or DVD

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In the course of repairs that my clients ask me to perform, occasionally I am confronted with a CD or DVD that they wish to get the data from but are having difficulty.

There are many reasons that this can happen such as scratches, dirt, ink seeping through from the label or even cracks.
IF THE CD/DVD IS CRACKED, BE PREPARED FOR THE POSSIBILITY THAT IT MAY SHATTER IN THE DRIVE. SINCE TIME MAY BE LIMITED, YOU PROBABLY WANT TO MOVE STRAIGHT TO ATTEMPTING TO IMAGE THE DISC AND HANDLE IT AS LITTLE AS POSSIBLE.
I have lost two optical drives to exploding discs. Both times the discs were badly cracked and attempts were made to limit the speed and maintain the best possible balance but they still exploded. Fortunately a large amount of data (all of it in one case) was recovered prior to the disc self destructing.

Normally though, I encounter discs that are scratched and scuffed to the point that they are no longer readable. Often you can view the disc and the files on it but any attempts to open or read the files gives an error.

Let’s make a mess.

First, we’ll make a CD with some public domain documents, video and audio files.

Read more on “How To Fix: Recover Data From a Scratched or Damaged CD or DVD” »

Accessing and Assessing a Hard Drive’s S.M.A.R.T. Data

Posted on January 21st, 2013 by James Litten

Accessing and Assessing a Hard Drive’s S.M.A.R.T. Data

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

1.0 Introduction

Being able to effectively analyze the S.M.A.R.T. data on a hard disk drive (HDD) enables you to quickly identify problems that can aid you in recovering all of the data from it before it becomes irretrievable or requires significant expense to retrieve.

The vast majority of hardware repairs that I do for clients involve problems with hard disk drives. If the computer’s BIOS sees the drive okay and it is not making any unusual sounds, the first thing I do is examine the S.M.A.R.T. data on the drive.

S.M.A.R.T. stands for Self-Monitoring, Analysis and Reporting Technology and is the hard drive’s record of its internal diagnostic monitoring and usage statistics packaged for being accessed externally. The primary purpose of S.M.A.R.T. is to alert us to an impending failure of the drive while there is still time to save the data. When a hard drive reports that the S.M.A.R.T. health is FAILED you must get the important data off of it immediately and not use the drive anymore.

IT IS IMPORTANT TO UNDERSTAND THAT DIFFERENT MANUFACTURERS AND DIFFERENT DRIVE MODELS CAN STORE AND DISPLAY DIFFERENT SUBSETS OF S.M.A.R.T. DATA AND CALCULATE VALUES AND TOLERANCES DIFFERENTLY.

S.M.A.R.T. data is best used as a general guide. For specifics, the hard drive’s technical documentation must be consulted. Sometimes that information is difficult to come by and can be proprietary. For example, the formulas for how some manufacturers calculate normalized values for attributes can be very difficult to find.

Wikipedia entry for S.M.A.R.T.



Proper analysis of S.M.A.R.T. data
  • Can help determine if the problem is physical damage or just logical damage.
    • With logical damage, the drive can be trusted and continue to be used after being repaired.
    • With physical damage, you want to get any important data off of the drive and replace it.
  • Helps you choose the best method for recovering all of the data from the drive.
  • Prevents you from accidentally doing things that may make matters worse.


In order to check the S.M.A.R.T. data on a HDD
  • The drive should not be making strange clicking or beeping noises. That means that there is definitely physical damage and it should be sent to a facility with the proper tools and environment to repair/recover it.
  • The drive needs to be accessible by the computer’s BIOS during POST (responds to the ATA command IDENTFY_DEVICE).
  • In the case of external drives connected via USB they need to be detected by the computer’s Plug and Play software (responds to the ATA command IDENTFY_DEVICE).

Read more on “Accessing and Assessing a Hard Drive’s S.M.A.R.T. Data” »

Data Recovery Flowchart

Posted on September 17th, 2012 by James Litten

Data Recovery Flowchart

Use this when the drive is still detected by the computer but the data on it has become inaccessible.

Click any of the flowchart blocks for a more detailed explanation.


If you need personal help from me go here

Windows ‘File Recovery’ series : Part 6 Reading/Editing The Windows Registry From Outside of Windows

Posted on May 14th, 2012 by James Litten

Windows ‘File Recovery’ series
Part 6 Reading/Editing The Windows Registry From Outside of Windows

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

Caution
Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Caution
Do not edit the registry directly unless you have no alternative. These techniques bypasses standard safeguards, allowing settings that can degrade performance, damage your system, or even require you to reinstall Windows. If you must edit the registry directly, back it up first.

Most of the time you can use standard registry editing tools on a Windows computer that cannot boot into Windows.


If you are able to boot the machine into Safe Mode with Command Prompt then you can use the reg command
Reg Command
http://technet.microsoft.com/en-us/library/bb490984.aspx

Recovery Console Command prompt on Windows Vista / 7
You can run regedit.exe.
You can also use the reg.exe command.

Windows 8 Startup Repair Command Prompt
You can run regedit.exe.
You can also use the reg.exe command.



I’m sure that there are other ways. Computers are always full of new surprises when it comes to breaking them.

Then there is Windows XP
Recovery Console Command prompt in Windows XP has no reg or regedit command.

Using chntpw as a Windows registry editor

Anyone who repairs consumer computers on a regular basis comes across this scenario sooner or later.

Client has a Windows XP computer with a problem that can be easily repaired from the XP Recovery Console. You proceed to boot into XP Recovery Console and ask the client “Is there an administrator password to this machine?” and they respond with something like “I don’t think so…”.

Read more on “Windows ‘File Recovery’ series : Part 6 Reading/Editing The Windows Registry From Outside of Windows” »

Windows ‘File Recovery’ series : Part 5 Manually Recover a Deleted File From an NTFS File System

Posted on March 12th, 2012 by James Litten

Windows ‘File Recovery’ series
Part 5 Manually Recover a Deleted File From an NTFS File System

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

For this post we will be looking at Windows NTFS filesystems.

How files are deleted

Deleted files are not removed from the hard drive until the space that they occupy is needed by a new file.

When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. If the file wasn’t fragmented and the clusters haven’t been reused, you should have a great chance of getting it back.

Recovery is often done by looking at the raw data on the disk for data in areas that are marked as being available for use, then determine the file type and directory structure, copy them and save them elsewhere.

NTFS and the MFT

Read more on “Windows ‘File Recovery’ series : Part 5 Manually Recover a Deleted File From an NTFS File System” »

Windows ‘File Recovery’ series : Part 4 Recover Files From a Bad Hard Drive

Posted on March 10th, 2012 by James Litten

Windows ‘File Recovery’ series
Part 4 Recover Files From a Bad Hard Drive

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How it usually starts

Often as a hard drive begins to go ‘bad’ you start to get strange errors in programs and your computer occassionally shuts down with a blue screen error. You may also start to notice sounds from the hard drive that you have not heard before. In many cases, the computer will not boot to Windows at all and none of the repair options will seem to work. Disk diagnostics programs either crash, show errors on the disk or don’t run at all.

At this point the user realizes that they need to completely re-install Windows (and hopefully, but not always, understand that they need to replace the hard drive). How do they get their data from a crashing or unbootable drive?

How to Recover the Data

A broken hard drive isn’t just ‘broken’ it is almost always still in the process of ‘breaking’ and everything we do to it is going to make it worse. That means we have to be as efficient as possible in our recovery efforts.

Read more on “Windows ‘File Recovery’ series : Part 4 Recover Files From a Bad Hard Drive” »

Windows ‘File Recovery’ series : Part 3 Recover A Deleted Partition with Testdisk

Posted on March 8th, 2012 by James Litten

Windows ‘File Recovery’ series
Part 3 Recover A Deleted Partition with Testdisk

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How partitions are deleted

This post is not about partitions disappearing due to damage or corruption of the file system. That kind of recovery will be covered later in this series. Here we will discuss solutions for recovering from accidental removal of a partition.

From personal experience, there are three ways that I have seen partitions accidentally deleted.


1. While trying to use partition changing software. Usually while changing the size of an existing partition or adding a new one.

2. When adding an operating system to make a multiboot computer.

3. When re-installing an operating system on a drive with multiple partitions.



I’m sure that there are other ways that it happens too. Computers are always full of new surprises when it comes to breaking them.

Deleted Partition Recovery with TestDisk

Read more on “Windows ‘File Recovery’ series : Part 3 Recover A Deleted Partition with Testdisk” »

Windows ‘File Recovery’ series : Part 2 Recover Deleted files with Testdisk and PhotoRec

Posted on March 8th, 2012 by James Litten

Windows ‘File Recovery’ series
Part 2 Recover Deleted files with Testdisk and PhotoRec

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

Data recovery from hard drives has not changed much in decades. However, the effectiveness and ease of use of free tools has increased greatly. Also, the fact that CD’s, DVD’s, flash drives, SD cards and USB keys are made to behave like hard drives makes them candidates for recovery using the same tools. SSD’s provide some new challenges due to techniques they use to extend their life expectancy but for the most part are recoverable in the same manner as platter based drives.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How files are deleted

Deleted files are not removed from the hard drive until the space that they occupy is needed by a new file.

When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. If the file wasn’t fragmented and the clusters haven’t been reused, you should have a great chance of getting it back.

Recovery is often done by looking at the raw data on the disk for unreferenced data, then determine the file type and directory structure, rebuild them and save them elsewhere.

Simple Recovery with Testdisk and PhotoRec

We’ll do this in Windows XP Professional Service Pack 3

TestDisk is a program that does lots of things that we will talk about later in this series but for this post we are looking at its file undelete capabilities. It also comes with the program PhotoRec which has some advantages for recovering specific file types like pictures or Outlook mailboxes (currently over 200 file types).

When to use TestDisk or PhotoRec for Deleted File Recovery

Read more on “Windows ‘File Recovery’ series : Part 2 Recover Deleted files with Testdisk and PhotoRec” »

Windows ‘File Recovery’ series : Part 1 Recover Deleted files with Recuva

Posted on March 7th, 2012 by James Litten

Windows ‘File Recovery’ series
Part 1 Recover Deleted files with Recuva

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

Data recovery from hard drives has not changed much in decades. However, the effectiveness and ease of use of free tools has increased greatly. Also, the fact that CD’s, DVD’s, flash drives, SD cards and USB keys are made to behave like hard drives makes them candidates for recovery using the same tools. SSD’s provide some new challenges due to techniques they use to extend their life expectancy but for the most part are recoverable in the same manner as platter based drives.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How files are deleted

Deleted files are not removed from the hard drive until the space that they occupy is needed by a new file.

When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. If the file wasn’t fragmented and the clusters haven’t been reused, you should have a great chance of getting it back.

Recovery is often done by looking at the raw data on the disk for unreferenced data, then determine the file type and directory structure, rebuild them and save them elsewhere.

Read more on “Windows ‘File Recovery’ series : Part 1 Recover Deleted files with Recuva” »

Monitoring the impact of Google/Webkit Prerendering of Pages with Piwik Analytics

Posted on June 21st, 2011 by admin

Google has announced that their search engine will begin prerendering pages. http://googlewebmastercentral.blogspot.com/2011/06/announcing-instant-pages.html

The potential problem with Google’s prerendering…
It’s done with Javascript.

That means that it happens on the client and not on Google’s server. There is no way to tell if my page was actually viewed by the user or if the page was prefetched and cached by the user’s browser because the search page they were viewing told it to prerender the page. Well, no way to tell by just looking at my normal stats. There is a way to detect whether or not the user actually views the page using some javascript.

I use Piwik on many websites in parallel with Google Analytics. Piwik gives me the ability to monitor performance and trends in real time.

I use Google Analytics for monitoring trends over greater periods of time like weeks, months or years.

Google Analytics will likely give me the ability to filter out and monitor prerendered pages in the near future. Piwik will probably add an option for this eventually also but right now, I want to begin monitoring it to see how often it happens and how important it is to my infrastructure.


1. How much bandwidth is used by pages that are prerendered but never viewed?

2. What pages does Google rank highly enough that they feel the need to prerender them and what keywords are they resulting from?

3. Who else is causing my pages to prerender besides Google.com?


Using some javascript we can check on the webkitVisibilityState of the page as it is viewed or cached by the client based on the W3C Page Visibility spec http://www.w3.org/TR/2011/WD-page-visibility-20110602/

Google Chrome Labs has a page on this http://code.google.com/chrome/whitepapers/pagevisibility.html

We’ll use their technique to log our Piwik stats differently if the page is prerendered and then properly log the visit if the prerendered page is subsequently viewed.

A simple Piwik tracking image will be sufficient for our tests. We can add full javascript based tracking once we know that it works. If it is prerendered then we will track it to a different website account on Piwik using the querystring variable idsite and then monitor it with an event listener so that if it is subsequently viewed then it will track it as normal.

var isPrerendering = false;

function handleVisibilityChange(evt) {
if (!isPrerendering) return;
countView();
isPrerendering = false;
}

function countView(){
document.write('<img src="http://PIWIK WEBHOST/piwik/
   piwik.php?idsite=[ID OF NORMAL SITE]&rec=1" />');
}

/*
* We can count the view right now if the document isn't being prerendered.
* Browsers that don't support the API will return undefined for
* webkitVisibilityState.
*/
if (document.webkitVisibilityState != "prerender") {
countView();
} else {
//We'll need to count the pageview later
isPrerendering = true;
document.write('<img src="http://PIWIK WEBHOST/piwik/
   piwik.php?idsite=[ID OF PRERENDER TRACKING SITE]&rec=1" />');
document.addEventListener("webkitvisibilitychange", 
   handleVisibilityChange, false);
}


Trying it out
Using Chrome 13 http://tools.google.com/dlpage/chromesxs enable prerendering by starting Chrome like this…
chrome.exe –prerender=enabled

To test this I go to http://prerender-test.appspot.com/ and enter the address of a page that I am tracking like this one and it will show a prerendered hit in the Piwik website I set up for tracking them.

I like it.
It’s fast and enhances the users experience. Using javascript puts all of the cost (processing and bandwidth) on my webserver and user’s browser so we’ll see if this causes problems for its adoption. I’ll keep playing with it and when it does become mainstream, I hope to be ready to embrace it and not allow it to adversely affect my servers, visitors or analytics.