Doing data recovery for the first time

[Vishera]

I have been prepared for years to the event of drive failure,

I back up my data regularly and have a USB with suite of tools and bootable emergency environment.

 

The problem is that i did not back up the data on the drive that failed,it's an 8 years old 512GB 5400RPM SATA III hard drive.

I didn't back up the data because i thought that the data on the drive is not important - until it failed.

 

From the get go i realized that the drive is bad when i had trouble booting into the OS,it acted weird and also took into consideration it's age.

I did a big mistake by writing data to the drive while trying to make it boot - it corrupted the partitions on the drive,and now they are not accessible on Windows (I booted from another drive).

 

From this point i have not written anymore data to the drive.

I am using GetDataBack for NTFS 4.33 to extract the data from the corrupted partitions without writing to the drive,

After days of waiting,i can see my data in the software,problem is the software doesn't let you extract the data,only view the files if you don't have a license,so i had to buy one...

Now i am extracting the data,it will take a few days.

 

Does anyone have an advice or recommendation?,

Also what do you think about how i handled it?

[WereCatf]

3 minutes ago, Vishera said:

Does anyone have an advice or recommendation?,

Also what do you think about how i handled it?

You made a mistake: always, ALWAYS work with an image of the drive, not the drive itself directly.

 

Once you realized the drive was bad, you should've used an imaging-tool (ddrescue under Linux, for example) to make an image of it and then used a recovery-tool to try and get your files out of it. Alas, you went and did one round of recovery-tool and now you are doing a second round -- the first round may, quite possible, have already caused more damage to the drive and thus you'll get even less out of it on the second round.

 

It's not entirely clear to me if you had already realized the drive was bad at that point or not. If you had already realized it was bad and decided to mess with the partitions anyway....yeah, a boneheaded idea.

[Vishera]

16 minutes ago, WereCatf said:

You made a mistake: always, ALWAYS work with an image of the drive, not the drive itself directly.

 

Once you realized the drive was bad, you should've used an imaging-tool (ddrescue under Linux, for example) to make an image of it and then used a recovery-tool to try and get your files out of it. 

Yep,you are correct,i knew it and ignored it anyway -_-

I was ignorant,perhaps even arrogant,and that damaged my data.

16 minutes ago, WereCatf said:

Alas, you went and did one round of recovery-tool and now you are doing a second round -- the first round may, quite possible, have already caused more damage to the drive and thus you'll get even less out of it on the second round.

In the first round the partitions got corrupt.

In the second round i made sure to not write to the drive at all.

16 minutes ago, WereCatf said:

It's not entirely clear to me if you had already realized the drive was bad at that point or not. If you had already realized it was bad and decided to mess with the partitions anyway....yeah, a boneheaded idea.

I knew it from the get go,i just didn't think at the time -_-

 

So far the recovery is going well.

[WereCatf]

Just now, Vishera said:

I knew it from the get go,i just didn't think at the time -_-

At least you had the wherewithal to come and ask. Now you'll probably remember what to do next time.

[Vishera]

8 minutes ago, WereCatf said:

At least you had the wherewithal to come and ask. Now you'll probably remember what to do next time.

Thank you for your advice,i will make sure to not repeat it next time,and make sure there is no next time

From now on i will back up all of my data,not just what i think is important.

[Archer42]

Few random thoughts about recovery:

I personally prefer to try recovering partition layout/partitions first. If successful this is much faster, and much more convenient (data recovered by utilities similar to GetDataBack for NTFS tends to contain a lot of junk and you will have to spend a lot of time finding what you need and sorting junk out even after it is recovered).

Since this can involve some experimentation lvm volume is very convinient to hold the image. This way I can create snapshots and avoid wasting time on making copies of huge image files. It also allows easily and transparently storing image on multiple drives if i have to create image of something large, without messing with any raid setups.

 

Also the next step is - check your backups work. Regularly. There is nothing more annoying than to discover backups are broken and were broken for a long time when you need to restore.