Jake Ludington's Digital Lifestyle

There are two major categories of hard disk failures. There's the software kind, where the data on the drive gets corrupted due to something like a corrupted partition table, damaged boot record, or missing root directory information. Software disk failures are typically easy to recover from using readily available information recovery software. The second category of drive failures is a result of some kind of physical malfunction of the drive. When the hard drive is physically damaged in some way, data recovery becomes a little more complicated. When the drive is physically damaged, any additional access to the drive may further corrupt data, making it harder to get key files and information back. My drive failure falls into the second category.

When the drive is physically damaged, a greater level of precaution is needed in order to make sure data is still recoverable. In cases like mine, any need for software to hit the physical disk increases the risk of further data loss. To prevent additional damage, an important first step is to create an image of the drive using an imaging tool. If the damaged drive happens to be the drive containing the operating system, it's best to not even boot the drive, if at all possible. For a desktop system, this is reasonably simple. Just disconnect the boot drive and replace it with a new drive (make sure you have a drive big enough to hold the image of the current drive).

Install an operating system on the new drive. Reconnect the old drive as a slave unit or put it in an external case and connect via USB or FireWire. By creating a new primary drive, you can run the disk imaging software from the new drive, preventing the need for any writing to the old drive. It's important to disconnect the current boot partition because attempting to install the OS on the new drive still results in temp files being written to the old drive because Window XP looks for any existing install and stores all the setup drivers on the current primary boot disk.

Things become more complicated when the failed drive is inside a laptop, as is the case with my drive failure. In theory, installation of Windows XP to an external hard drive is possible, but you still run into the problem of temp files writing to the damaged main drive during the setup process. In some cases, you can avoid this by disabling the IDE controller, which is the controller used by the motherboard to provide access to the hard drive, in the system BIOS. In my case, disabling the IDE controller at the BIOS level also made the CD drive non-functional, making it impossible to transfer files off of the install CD in order to install Windows XP on the external drive. I'm purposely leaving out options like network installs and ghosting, because most home users won't have an easy way to pull these off and still get Windows XP to boot without encountering other problems.

There is a workaround for a lack of hard disk install options. Instead of trying to boot from a hard drive, boot from a CD with all the tools you need already installed. As part of my recovery process, I created a bootable CD with BartPE, which uses some core Windows components and bundles data recovery applications. BartPE runs everything from the CD drive, similar to the Linux based Knoppix OS. BartPE requires files included on either a Windows XP or Windows Server 2003 install CD, which creates a mini OS valid for 24-hours to do diagnostic recovery of lost files. The OS automatically reboots at the 24-hour mark, so this is by no means a permanent solution. However, 24-hours is plenty of time to recover from virtually any drive failure. If I didn't have BartPE, I'm not sure what I would have done to get my data back from the corrupted hard drive.

Some key recovery tools offer versions designed specifically for use with BartPE, which makes it even easier to recover using the CD based temporary OS. I've sworn by a tool called GetDataBack for NTFS ever since it recovered all the data from a corrupted drive several years ago. GetDataBack includes a drive-imaging tool, which makes a replica of the drive on a second hard drive. The recovery portion of the tool scans the image far more quickly than it could possible work through damaged sectors on a drive, resulting in a solid solution for getting back all the missing data. In most cases, it will also recover deleted files as well. In fact, I have the creators of GetDataBack to thank for my discovery of BartPE. My previous experience with drive failures has always been on desktop systems where it was a simple matter to swap the drive and run recovery software. In exploring options on the GetDataBack Website, the mentioned creating a CD using BartPE and including GetDataBack in the build. It worked like a dream. Admittedly, I did not get all the data on the drive back this time because over 10% of the drive was completely unreadable, but I did recover a substantial amount of lost information.

One cautionary note regarding BartPE: There seems to be some controversy from the Microsoft team that creates a competing tool called WinPE (only available to corporate MS customers with a command line interface) regarding whether or not BartPE violates the Windows EULA. From what I can tell, it's perfectly legitimate to put the Windows operating system files on a backup CD, which may be used as long as you aren't simultaneously using the original CD or the installed OS. Of course, I'm no lawyer so don't consider my word indemnifying. My personal opinion is the development team is jealous because Bart created a better product and made it available to the people who can least afford to recover their data in a catastrophic loss situation—Consumers. A smart operating system manufacturer would write him a check.