Hard Drive Recovery Video Series - How To Slave a Laptop Hard Drive

If you have a clicking hard disk drive chances are you need hard drive recovery and slaving your laptop will not help you get your files back. This method is for hard drives that are still recognized by the BIOS, they just don’t show you your data, or let you access it.

The software that you need to recover your data is dependent upon the Operating System that was on your laptop.

• For Windows XP or Microsoft Vista with NTFS File System use DART XP - this program will scan your laptop drive and show you the files that can be recovered before you actually buy the software. You can download the demo version for FREE without having to sign up for anything. DART XP Data Recovery Software. If the scan shows you the data you want, you can purchase it right through the software interface.
• For All other types of Windows or for external hard drives that are running NTFS, FAT, FAT 32 or FAT 16 you will need Recover It All. The Demo version also is FREE and will show you the data before you buy it. You can save the scan and purchase the sofrtware off of our website. Like all our products you don’t have to register it to get the demo and will receive the full version within seconds of purchasing it. Click here for the demo of Recover It All Data Recovery Software.

All of our data recovery software is guaranteed to work or you get your money back. Just like our data recovery services which are No Fix No Fee, we will show you your data before you buy!

DTI also has extended software support. Our software support people work right here in Florida. We don’t outsource anything ever! Our support phones are answered from 9 AM EST to 10 PM EST at 727-345-9665, if you are calling after normal business hours choose the software tech support option with your phone.

Remember if you need hard drive recovery DTI has the best support in the business, a class 100 clean room and a strict no data no charge policy on hard drive recovery. When it comes to laptop data recovery, DTI Data is second to none!

Some day soon they will have the best of both worlds by introducing a high capacity laptop hard drive that has the large capacity that most users require in their laptop hard drives as well as high speed for those of us into gaming and media.

DTI Data Recovery has been doing research and Development on Samsung’s laptop hard drives in preparation for the data recovery and hard drive repair that will be required by these new hard disk drives.

If you happen to fall victem to a hard drive crash and have data that needs to be recovered, DTI has the skills and tools to perform hard drive recovery on even these new high capacity hard disks.

My hard drive crashed in a laptop that was not even 20 days old. It not only crashed, but had significant sector damage. How could this happen in a brand new laptop? Well the fact is every hard drive that goes out to the general public is released with bad sectors. There is S.M.A.R.T Technology and Sector Maps that are there to protect clients from data loss. If you want to know more about those 2 things read my wife Victoria’s post: Hard Drives A Destiny Of Failure to learn more.

Anyway, here I am with a damaged hard drive and a laptop so new that I hadn’t started backing up my data fully yet. I then remembered an article that Jacqui Best, our support team leader wrote about BART PE which is a Bootable CD For Data Recovery, and I used the info in that post to get off my files.

The moral of this story is to start your data backup routines at once! After you have all you settings customized to your needs, clone your hard drive! This way the restore process is much easier. I spent 2 days getting my laptop back to were it needed to be. Fortunately I did not need hard drive recovery!

 
                Welcome back to my series of articles that pertain to Spyware, Malware, and Viruses and what you may not know about them. In my first article, I gave you and overview and some information on the history of these 3 nasty applications or bots that infect most computers at some time or another. There is a TON of information availible on these subjects on the Internet, so if there is anything more specific that you are curious about or that you didn’t understand from this article you can usually go to http://www.google.com and you can reference it there. In this article, I am going to be  discussing what Viruses and Spyware are, and how you locate them on your PC.

                The first thing that you have to understand is how these malicious applications get onto your systems. Studies show that the number one way to catch a virus or to obtain Spyware on your system is through P2P (Peer to Peer) file sharing applications like Napster, Limewire, Bit Torrent, and any other program of that variety. You may think you are downloading a harmless MP3 file, or you may think you are getting the latest MPEG for free, but the fact is that over 40% of all files that are transferred through P2P programs are actually viruses or Spyware and key loggers that are camouflaged as the file you are looking for. Remember this ONE rule about the Internet, if you only remember ONE thing from this article, and that is there is NO SUCH THING as FREE on the P2P applications. No matter how perfect or scamless the situation may seem, if it is FREE and on the P2P programs than you can guarantee that there are strings attached. So try to stay as far away from P2P programs and applications as you can, because no matter how hard you try and no matter how much protection your system has, you are bound to override your protection to view a file that you shouldn’t because of infection, and you will sooner or later end up destroying your system.

                I’m sure as you are reading this article you are thinking that you are probably secure, and that you have Antivirus and Antispyware software on your system, so none of this applies to you. But remember this, those programs are only good if you do updates to their data files at least once a day, and they can only stop what you tell it to stop. So if you try and access a website that you THINK is safe, and your Antivirus software tries to tell you it is not, and you bypass your antivirus software and access the site anyway, then you may have just let a Trojan or key logger onto your system and your Antivirus software can now do nothing about it. Understand that protection software is only as good as it owner. It also only takes ONE piece of Spyware or Malware to get onto your system to corrupt your Antivirus or Antispyware programs so that they cannot detect future attacks against your system. The first thing a virus or piece of spyware does, is look for the services and applications that run your Antivirus software, and disable them, or even worse, cloak themselves so that your antivirus software thinks everything is running smoothly when in all reality, your system is being destroyed one piece at a time.  A lot of viruses and Trojans will disguise themselves as system services and then they become nearly impossible even by a trained professional to remove from your PC without formatting the computer. There are so many different variations of spyware, Trojans, key loggers, malware, and backdoors that can attack your system, that you have to be on the lookout for strange occurrences at ALL times when surfing the Internet.

                Your best bet for protection is to follow the steps in my next article and try to stick to the rule of Internet thumb, and that is if you don’t know the website or file your are downloading and cannot verify its integrity, then DON’T  go to that site or download that file. It is a very simple rule, but end users seem to forget it a lot, I myself am included in that statement.

So check back later this week for my last installment of, “Spyware and Malware protection and removal and what you MAY not know!”, which will explain how to understand, locate, and eliminate spyware, malware, and viruses.

Until then, take care, and if you have any questions or comments about the articles please leave a comment or send an email to my address below.

Richard Correa, MCSA, MCPS, MCSE, MCNPS, MCDBA
Senior Network Engineer
Lead Web Programmer and Developer
DTI Data – DTI Networks
Office :: 727.345.9665 ext.206
rcorrea@dtidata.com

http://www.dtidata.com
http://www.dtinetworking.com

1. Hardware:

The RAID went down for some reason. Many times it is because the hardware housing the array may have some issues. There may be cabling problems, heat problems, back plane problems, or a hundred and one other hardware issues that can cause the RAID to degrade.

2. Hard drives

A simple surface scan of all drives in the array can give you an indication of the state of the drives. A report outlining any anomalies found for each drive is always critical when diagnosing the array.

3. RAID Consistency

A RAID five bases its integrity on a simple XOR algorithm that is stored on a block by block basis within the array stripe. The firmware of a RAID five uses this algorithm to ensure that the data stored on the RAID is consistent. It also ensures that if a single drive goes down and the array becomes degraded, the technician has ample time to do a quick backup of critical data, get all users off in a timely manner, and cleanly shut down any database handlers that may residing and open on the array. In other words, don’t have a dirty shutdown of your exchange store.

A degraded RAID 5 should NEVER BE PRODUCTION RUN!!! However, this is not normally the case and is why RAID recovery is a multi-million dollar business. A degraded RAID five that is run in production for longer than twenty four hours now contains data on the offending drive that is considered stale. If a second drive goes down then the entire array goes down as RAID five cannot run with two drives out.

When I get a call from a technician that their RAID is down because the array lost two drives, I immediately assume that one of the drives is stale and quickly advise the technician not to do a rebuild. I can count on one hand in the entire time I have been recovering RAIDs that a client has lost two drives simultaneously.

Although items 1 and 2 are not my bread and butter, I am familiar with techniques used to do their respective checks. Item 3, however, I am very familiar with and can help you ascertain if in fact there is a stale drive within your array. The following are set of steps, as well as a free piece of software that you can use before any rebuild is initiated.

Step 1: Pull all drives that are in the array out. Get the drives that are configured as part of the array away from the hardware. This does not include any hot swap drives, only those drives configured in the array and working at time of degrade.

Step 2: Make images of all the drives in the array. This serves several purposes. First, during an imaging session you may find bad sectors on the drives. Secondly, you never want to work on the live data as the drives may be on their last legs and any recovery, rebuild, or diagnostic run on live data may kill the drive. Lastly, if something happens to the drives then you will have the images as a way to recreate the original data set.

Step 3: Download the RAID Diagnostic Toolkit from our website and install it on a Windows NT type machine. The software is very easy to use and very self explanatory. There are options in the software that are not currently active, this is because I will be introducing them in later posts. So I just pop up a little window to let you know that this is a future software enhancement or the function is grayed out.

Currently the software defaults to a 64K, or 128 sector stripe size. Although, the stripe size, for this particular function has no bearing on the test, it is nevertheless used on 95 percent of the RAID fives that I work on and can give us a more real world type map.

The software will run the consistency check on your set of images and give you a report on whether the stripe is corrupt. It will not tell you which drive is the stale drive if the stripe is corrupt, only that a rebuild, using this set of drives would not be advisable.

First we must populate the RAID with streams. There are basically two types of streams that we will use, the first is a physical data stream or ‘hard drive’. The second is an image data stream or ‘file’. Figure A depicts populating the ’stream list’ with physical streams. As you can see the ‘Populate Stream List’ menu item is highlighted. Clicking on this will poll all hard drives on the local machine and display them as shown in Figure B.

Figure A

Figure B

The best way to test an array is to make images of the hard drives and then use the images for testing. From the ‘Configuration’ menu option click on “Add File Stream To List”. A standard Windows file selection dialog box will appear. Go to the proper folder and choose the image that you would like to add to your stream list. Click on the file, and then open and the file will be added to your stream list. You are now free to add this item into your RAID Configuration list.

In order to add an item from the stream list into the RAID Configuration simply double-click on the stream list item and it will be added into the RAID Configuration list of items as depicted in Figure C.

Figure C

Next, in order to start the parity test click on the menu item “Diagnostics”. Doing so will reveal the menu item “Raid Five Parity Check”. Click on that menu item and the diagnostic will begin. This function will check the RAID five on a stripe by stripe basis and validate the parity using XOR mathematics.

In the lower left hand corner of the software is a small status/information window that offers real time data of the parity scan. this window contains five items which describe the state of the diagnostic.

Type: The configured RAID/River type

Ident: Identifier give to the RAID/River type

Block: The block, currenty being scanned by the software

Time: Time remaining till the scan has completed.

Errors: The total blocks that a parity error has been found.

Two of the five items are most pertinent for this particular function. They are the “Errors” item and the “Block” item. If the “Error” item is ten to fifteen percent of the array then the array stripe is probably corrupt and you may have a stale drive in the array. For all practical purposes however, there should be less that or a total of three or four total errors for the entire array. A healthy array will have no errors and if even only one appears that could mean either the hardware is starting to fail, or worse, the firmware and or its accompanying memory me be buggy. Either scenario could spell disaster for your array and should be looked at immediately. View Figure D as an example.

Figure D

Finally, if you wish to interrupt the diagnostic just click on the “Configuration” menu item, and then the “Interrupt Processing” item and all processing will stop.

That’s it! Of course you must always bear in mind that even if the RAID does not pass the parity test there may still be data to recover. Alternatively if it does pass, this does not necessarily mean that the RAID is good for a rebuild. There will be other functions added to the software that will help you better determine if a rebuild is advisable.

Dick Correa

I have had the luxury of being in some sort of IT Industry in one way or another for the last 17 years of my life. I have worked in fields from standard PSTN Telecom, to basic PC building and repair, to Corporate Network Design and Infrastructure Integration, down to Web Design and Programming. I would say that over the years I have seen MANY drastic transitions in technology, some greater than others. I watched as I saw a standard telephone line connected to one personal computer at a time sending messages and files through a BBS (Bulletin Board System), develop into the large scale high speed data network we use now known as the Internet. One thing that has ALWAYS held true in the communications and data networking industry is that there is always someone out there trying to make a quick scamming buck or to take down systems of the masses by playing on the end users lack of knowledge on how to protect and secure their computers. Since the early days of BBSing, I remember even in the late 80’s and early 90’s, there were Trojan viruses and infections that were in place for NO other reason but to annoy and destroy file systems. Anyone who remembers Wildcat and Oblivion BBS’s and was ever struck by the Michelangelo or Jerusalem viruses knows exactly what I’m talking about.

Since the inception or communications, there has always been the need to secure and prevent hackers, warez freaks, and script kiddies from getting into your computers. The only thing I have seen change over the years, is that it is no longer just a 12 year old kid slurping down mellow yellow until 4 am that is hacking your system and corrupting your files, or even worse, stealing your personal information. Now it has become a multibillion dollar BIG BUSINESS for companies which I won’t mention in this article to install Spyware, Malware, and Scamware onto your system so they can collect information about your personal life, your personal preferences, your web surfing habits, and even your credit card and social security number so they can store your information into a database and sell your information off to the highest bidder.

Now please understand, I am not a conspiracy theory type of guy, and I don’t think that big brother is trying to get me, but I am a realist and I know for a FACT that EVERYONE that is reading this article has at some point in time in one way, shape, or form has had a virus, a Trojan, some Spyware, or Malware on their system. So that is not a conspiracy, it is the plain and cold hard truth. We as a community of Internet surfers and knowledge seekers have to be able to protect ourselves and our family’s against the unwanted bots, programs, and software that is being installed onto our systems and is invading our privacy without knowledge. So my next few articles are going to explain a few ways on how to spot the malicious software and viruses on your system, and a few of the best tools to protect and guarantee your computers and family’s safety from these devious applications.

So check back later this week for my next installment of, “Spyware and Malware protection and removal and what you MAY not know!”, which will explain how to understand, locate, and eliminate spyware, malware, and viruses.

Until then, take care, and if you have any questions or comments about the articles please leave a comment or send an email to my address below.

Richard Correa, MCSA, MCPS, MCSE, MCNPS, MCDBA
Senior Network Engineer
Lead Web Programmer and Developer
DTI Data – DTI Networks
Office :: 727.345.9665 ext.206
rcorrea@dtidata.com

http://www.dtidata.com
http://www.dtinetworking.com

Starting Exchange Server with a blank Information Store

There are some situations where starting Microsoft Exchange with a blank database may be necessary. In my line of work, I run across a large amount of businesses that have had their Exchange Private Information Store corrupted and the whole organizations Email capabilities halted as well. Quite often, getting the users back up and running takes precedence over getting the data back. Don’t get me wrong; the data is still extremely important, however not having email capability can stop some businesses day to day operations dead in their tracks.

In a perfect world, there would and should be a backup Exchange server just waiting to take over in case of a catastrophic event. But in reality, that is rarely the case. Rather than wait a complete day or two, or even longer, for the systems administrator to get the Exchange database recovered, a viable alternative is to restart the information store with a blank database and import the data back in when it is recovered.

There may be other reasons for wanting to create a blank database as well. You may have an Exchange server that is years old, with tons of residual data from users no longer at the company. You may need to free up disk space on your server. You may have a database with minor corruption and decide to ExMerge your data out and import it back in to a clean corruption-free database. Whatever the reason, make sure you have a complete plan of action and be sure to backup your data in case you run into difficulties. The following article explains how to create a new database with Exchange Server.

To start Exchange Server with a blank Information Store:

1. Locate the Exchange database directory and transaction log directory
   1. Open Exchange System Manager
   2. Navigate to Administrative Groups->First Administrative Group->Servers->servername
   3. Underneath servername click First Storage Group and then Action->Properties
   4. Transaction Log location will be listed on the General tab. Note this location (Image 1d)
   5. Navigate under First Storage Group to your Mailbox Store and click Action->Properties
   6. Click the Database tab to note the Exchange Database and Exchange Streaming Database locations (Image 1f)
   7. Do the same for the Public Store

Image 1d	Image 1f

2. Stop the Exchange Information Store (IS) if it is currently running
   1. Click on Start->Programs->Administrative Tools and then on Services or you can go to Computer Management by Right-Clicking on My Computer and choosing “Manage”

      i. If using Computer Management, drill down to Services and Applications, and then Services underneath that

   2. In the right window of the Services or Computer Management console, locate Microsoft Exchange Information Store
   3. If it’s status is listed as “Started”, Right-Click it and choose “Stop” (Image 2c)
   4. It may give you a message stating that dependency services such as Microsoft Exchange Event will need to stop as well. Choose “Yes” to continue stopping the IS

Image 2c

3. Rename database and transaction log directories and create new ones
   1. Rename the database location MDBDATA directory to MDBDATA-old (Image 3a)
   2. Create a new MDBDATA directory
   3. Rename the transaction log MDBDATA directory to MDBDATA-old (if location is different from the database location)
   4. Create a new MDBDATA directory for the transaction logs (Image 3d)

Image 3a	Image 3d

4. Start the Exchange Information Store service
5. Create new data files
   1. From Exchange System Manager navigate to Administrative Groups->First Administrative Group->Servers->servername->First Storage Group
   2. Click on the Mailbox Store and then on Action->Mount Store (Image 5b)
   3. You will receive a message stating that mounting this store will force the creation of an empty database, choose “Yes” to continue (Image 5c)
   4. The Store should mount, give you a message stating it successfully mounted and the data files should be created in the MDBDATA directory. (Images 5d1 & 5d2)
   5. Follow the same steps for the Public database

 

 

Image 5b
Image 5c
Image 5d1	Image 5d2

6. Test and Verify
   1. Verify the data files were created in the MDBDATA directory
   2. Check the Event Log for any errors
   3. Test connection to the Exchange server from Outlook

  In addition to the infomation stored in the Master File Table it has been my experience that if a previous copy of the Master File Table had been saved off into a file onto a remote site I could have easily imported that file and used it to recover the data.  In other words, it is rarely the occasion that an entire file system gets totally wiped out.  It is usually some small piece of information either corrupted or omitted from the Master File Table that causes the problem.  Even a restore disk used on a hard drive that totally destroys all remnants of a file system cannot keep a backup copy of the Master File Table from recovering some data.

  How, you may ask can this be?  Well grasshopper, read on and see.  Imagine a book.  A reference book preferably.  Now, let us define the attributes of a reference  book.  Lets see, there is a forward where the author may offer a few remarks so we know how intelligent he is.  There is a table of contents that give you a general idea of what is in the book and where it is located. There is the body of the book, the actual information.  Last but not least, an index.  A detailed description, with page numbers that tell you exactly where the data is that you are looking for. For illustration purposes we can  say that the index of the book is the Master File Table, and the body of the book is the data on your hard drive.  If the index of the book is ripped out of the back, how would it be possible to find the information you are looking for?  I suppose you could wade through the entire book and possibly, after several hours of searching, find the answers you are looking for.  I have done that with some of my older books where the back, and the front of the book have disappeared.   A book may have 200, 300, 400, maybe even 500 pages to look through, and if the information is important enough it is worth the look.  However, wouldn’t it have been easier if I would have just photo copied the index and placed that in a nice safe place.  Then, when the book gets old, and I lose the index, I have this nice copy that I have kept to help me find my information.

   Leafing through a 500 page book may be time consuming but it is feasible, however, apply that same logic of the index and the book to a hard drive.  Who wants to scan through 234,000,000 sectors looking for data.  If the data is fragmented then the data is probably lost.  Wouldn’t have been nice to have a copy of the Master File Table to use and find all of your old tax returns, or doctoral thesis, or the only pictures of your grandsons birth?  I would say, “Yeah!! It would’ve been nice!”. 

  Please don’t get the wrong idea.  This is not the same as entire backup, on another set of media.  There are holes to this system.  First, if the drive actually goes bad, then it will be difficult if not impossible to get the data back.  Secondly, any thing that writes to the data portion of the drive will make the Master File Table useless. However, it takes a long time to destroy a 250 GB  hard drives data area.  Lastly, I have not been able to find a piece of software that just dumps the Master File Table to a remote site.  Looks like someone should write one?

The fact that we have in-house software developers gives DTI data recovery an edge when it comes to recovering damaged hard drives. There are many situations that call for custom data recovery solutions. DTI has the technology and experience to create software on the fly for any given situation.

Data Recovery Engineers

The main thing that separates DTI from the pack is our engineers. We have specialists that are expert at Linux file systems, others that are focused on NTFS and FAT, this gives us the most experience with data recovery. The fact is, hard drive repair isn’t rocket science. With a clean room, experience, proper parts and technology DTI is able to repair just about any type of physical damage to a hard drive and get the data off and on to stable media. It is what happens next that makes DTI special.

Data Recovery is a lot more than hard drive repair. It also means that the files on the hard drive need to work again. That is why our engineers have the upper hand. We can take databases down to the hex level and repair them, we can fix file systems, we can rebuild partitions. If you need data recovery, then DTI is the logical choice!