computer nerd question - help asap please?

phoenix · 10.31.2009, 02:18 AM

Is it possible to slave a laptop HDD(which is fully functioning) to another computer without removing it from the laptop?

I have system recovery software that can "see" the mapped drive, but it won't let me scan it because it is not actually connected. It's a DELL and it's a laptop and I don't really want to(feel comfortable with) take it apart..

I'm so sure I can do this and just can't think how..

thanx.

both comps are running xp, could also have the one trying to recover data as a vista OS but, the recovery sofwtare I found is only for xp ( PC inspector)

(a database file was deleted from a shared folder, and so doesn't appear in recycle bin to recover. I'm open to other solutions but I know the thing is still there at the moment and I think this is the best way to go about getting itback)

phoenix · 10.31.2009, 02:39 AM

ok, I think I'm just going to try removing it and connecting it via cradle to the pc with the recovery software. But this wont happen until a few days from now ( since my cradle is at home)

any other suggestions before then are more than welcome! :P

phoenix · 10.31.2009, 04:54 AM

yeh I have a dock/cradle that I can plug hard drives into that connects via usb so I've just done that. It's finding lost files now, unfortunately the laptop/drive is about 3 years old and has never had a full format.. So far it's at 15k lost/found files, and still says it has 60 mins left to go before it finishes scanning the drive.

thanks for yr help, there are a couple here too so that's good to know for the macs, but this just happened to be on a pc.

verme (prevaricator) · 10.31.2009, 06:56 AM

get a live cd w/ ntfsprogs like clonezilla.
boot up
man ntfsundelete

Keeping It Simple · 10.31.2009, 02:06 PM

Isn't slavery banned?

floatingslowly · 10.31.2009, 04:14 PM

Quote:

Originally Posted by verme (prevaricator)

get a live cd w/ ntfsprogs like clonezilla.
boot up
man ntfsundelete

quoted for the verme (prevaricator) post-preservation society (VPPPS).

phoenix · 10.31.2009, 06:22 PM

after finding 64k lost files none of them were the db, or if they were they were multiple clusters and one file. Will try yr solution this week verm for one last check. At least i don't have to re build the thing.

verme (prevaricator) · 11.01.2009, 09:57 AM

that wasn't very helpful was it?
i'm a lazy twat and always in a hurry.

i'll spare some time and attention to this place for a change and hopefully help you or some google tourist.

there really is no need to plug the hdd to other machine, in fact it doesn't make much sense, and by mounting the drive you'll potentially overwrite your precious mistakenly erased data.
live cd's, live usb's or whatever load into ram, allowing you to access your hdd without compromising data.

you can get clonezilla here:
http://clonezilla.org/download/sourc...-zip-files.php

i'm guessing you know how to burn an iso file and boot a cd, if you don't, just ask it here.
once you're booting up that cd what you want to do is to load the kernel to ram and enter a shell.
clonezilla has a graphical interface so you just have to pick those options using the arrow keys.
once you're looking at a flashing bar you can start interacting with the shell.

ntfsundelete is a program that can scan your ntfs partition for deleted files and recover them.
you can read about it by typing in the shell:

Code:

man ntfsundelete

use the arrow keys to skim through it, press q to close the manual.

you need to tell ntfsundelete where and what to look for. to find the path for your ntfs partition type in the shell:

Code:

sudo fdisk -l

this prints out the hdd partition table, the path to your partition should be something like /dev/sda2

type in:

Code:

sudo ntfsundelete fullpathtoyourpartition -m 'filename' -p 100 > filesfound.lst

this scans for fully recoverable files that match the filename and outputs the results to a file.

you can have a look at the results by typing in:

Code:

cat filesfound.lst

with luck, ntfsundelete found something.
plug a usb drive and take a look at the partition to get it's path.

Code:

sudo fdisk -l

it should be something like /dev/sda3

create a directory for it and mount the drive.

Code:

sudo mkdir /media/phoenixpendrive && sudo mount fullpathtoyourdrive /media/phoenixdrive && sudo mkdir /media/phoenixdrive/restoredfiles

recover the files and send them to your usbdrive:

Code:

sudo ntfsundelete fullpathtoyourpartition -u -m 'filename' -p 100 -d /media/phoenixdrive/restoredfiles

unmount the usb drive

Code:

sudo umount /media/phoenixdrive

and that's it.

Code:

echo goodbye phoenix && sudo shutdown -r now

p.s. if you dont recall the filelame use '*.mdb', '*.ldb' or whatever your file extension was.

!@#$%! · 11.01.2009, 01:01 PM

Quote:

Originally Posted by verme (prevaricator)

that wasn't very helpful was it?
i'm a lazy twat and always in a hurry.

i'll spare some time and attention to this place for a change and hopefully help you or some google tourist.

there really is no need to plug the hdd to other machine, in fact it doesn't make much sense, and by mounting the drive you'll potentially overwrite your precious mistakenly erased data.
live cd's, live usb's or whatever load into ram, allowing you to access your hdd without compromising data.

you can get clonezilla here:
http://clonezilla.org/download/sourc...-zip-files.php

i'm guessing you know how to burn an iso file and boot a cd, if you don't, just ask it here.
once you're booting up that cd what you want to do is to load the kernel to ram and enter a shell.
clonezilla has a graphical interface so you just have to pick those options using the arrow keys.
once you're looking at a flashing bar you can start interacting with the shell.

ntfsundelete is a program that can scan your ntfs partition for deleted files and recover them.
you can read about it by typing in the shell:

Code:

man ntfsundelete

use the arrow keys to skim through it, press q to close the manual.

you need to tell ntfsundelete where and what to look for. to find the path for your ntfs partition type in the shell:

Code:

sudo fdisk -l

this prints out the hdd partition table, the path to your partition should be something like /dev/sda2

type in:

Code:

sudo ntfsundelete fullpathtoyourpartition -m 'filename' -p 100 > filesfound.lst

this scans for fully recoverable files that match the filename and outputs the results to a file.

you can have a look at the results by typing in:

Code:

cat filesfound.lst

with luck, ntfsundelete found something.
plug a usb drive and take a look at the partition to get it's path.

Code:

sudo fdisk -l

it should be something like /dev/sda3

create a directory for it and mount the drive.

Code:

sudo mkdir /media/phoenixpendrive && sudo mount fullpathtoyourdrive /media/phoenixdrive && sudo mkdir /media/phoenixdrive/restoredfiles

recover the files and send them to your usbdrive:

Code:

sudo ntfsundelete fullpathtoyourpartition -u -m 'filename' -p 100 -d /media/phoenixdrive/restoredfiles

unmount the usb drive

Code:

sudo umount /media/phoenixdrive

and that's it.

Code:

echo goodbye phoenix && sudo shutdown -r now

p.s. if you dont recall the filelame use '*.mdb', '*.ldb' or whatever your file extension was.

hot damn dude

hot damn

do you freelance?

verme (prevaricator) · 11.01.2009, 04:35 PM

those are just some basic unix instructions, nothing special.
i should've made a little shell script but i was too lazy.

phoenix · 11.01.2009, 06:37 PM

ace, i will give this a try during the week. My reasoning behind setting the drive as slave /plugging it in with another was so that i didn't neede to instal anything on the drive and therefore over write if it was still there..
Thanks for yr nerdness i will write back here when i need help

10.31.2009, 02:18 AM	#1
phoenix invito al cielo Join Date: Apr 2007 Location: the future where it's hot and dark Posts: 5,926	Is it possible to slave a laptop HDD(which is fully functioning) to another computer without removing it from the laptop? I have system recovery software that can "see" the mapped drive, but it won't let me scan it because it is not actually connected. It's a DELL and it's a laptop and I don't really want to(feel comfortable with) take it apart.. I'm so sure I can do this and just can't think how.. thanx. both comps are running xp, could also have the one trying to recover data as a vista OS but, the recovery sofwtare I found is only for xp ( PC inspector) (a database file was deleted from a shared folder, and so doesn't appear in recycle bin to recover. I'm open to other solutions but I know the thing is still there at the moment and I think this is the best way to go about getting itback) __________________ tiny and lost.
	\|QUOTE AND REPLY\|

10.31.2009, 02:39 AM	#2
phoenix invito al cielo Join Date: Apr 2007 Location: the future where it's hot and dark Posts: 5,926	ok, I think I'm just going to try removing it and connecting it via cradle to the pc with the recovery software. But this wont happen until a few days from now ( since my cradle is at home) any other suggestions before then are more than welcome! :P __________________ tiny and lost.
	\|QUOTE AND REPLY\|

10.31.2009, 04:54 AM	#3
phoenix invito al cielo Join Date: Apr 2007 Location: the future where it's hot and dark Posts: 5,926	yeh I have a dock/cradle that I can plug hard drives into that connects via usb so I've just done that. It's finding lost files now, unfortunately the laptop/drive is about 3 years old and has never had a full format.. So far it's at 15k lost/found files, and still says it has 60 mins left to go before it finishes scanning the drive. thanks for yr help, there are a couple here too so that's good to know for the macs, but this just happened to be on a pc. __________________ tiny and lost.
	\|QUOTE AND REPLY\|

10.31.2009, 06:56 AM	#4
verme (prevaricator) 100% Join Date: May 2009 Posts: 785	get a live cd w/ ntfsprogs like clonezilla. boot up man ntfsundelete
	\|QUOTE AND REPLY\|

10.31.2009, 02:06 PM	#5
Keeping It Simple invito al cielo Join Date: May 2009 Posts: 3,721	Isn't slavery banned?
	\|QUOTE AND REPLY\|

10.31.2009, 06:22 PM	#7
phoenix invito al cielo Join Date: Apr 2007 Location: the future where it's hot and dark Posts: 5,926	after finding 64k lost files none of them were the db, or if they were they were multiple clusters and one file. Will try yr solution this week verm for one last check. At least i don't have to re build the thing. __________________ tiny and lost.
	\|QUOTE AND REPLY\|

11.01.2009, 09:57 AM	#8
verme (prevaricator) 100% Join Date: May 2009 Posts: 785	that wasn't very helpful was it? i'm a lazy twat and always in a hurry. i'll spare some time and attention to this place for a change and hopefully help you or some google tourist. there really is no need to plug the hdd to other machine, in fact it doesn't make much sense, and by mounting the drive you'll potentially overwrite your precious mistakenly erased data. live cd's, live usb's or whatever load into ram, allowing you to access your hdd without compromising data. you can get clonezilla here: http://clonezilla.org/download/sourc...-zip-files.php i'm guessing you know how to burn an iso file and boot a cd, if you don't, just ask it here. once you're booting up that cd what you want to do is to load the kernel to ram and enter a shell. clonezilla has a graphical interface so you just have to pick those options using the arrow keys. once you're looking at a flashing bar you can start interacting with the shell. ntfsundelete is a program that can scan your ntfs partition for deleted files and recover them. you can read about it by typing in the shell: Code: man ntfsundelete use the arrow keys to skim through it, press q to close the manual. you need to tell ntfsundelete where and what to look for. to find the path for your ntfs partition type in the shell: Code: sudo fdisk -l this prints out the hdd partition table, the path to your partition should be something like /dev/sda2 type in: Code: sudo ntfsundelete fullpathtoyourpartition -m 'filename' -p 100 > filesfound.lst this scans for fully recoverable files that match the filename and outputs the results to a file. you can have a look at the results by typing in: Code: cat filesfound.lst with luck, ntfsundelete found something. plug a usb drive and take a look at the partition to get it's path. Code: sudo fdisk -l it should be something like /dev/sda3 create a directory for it and mount the drive. Code: sudo mkdir /media/phoenixpendrive && sudo mount fullpathtoyourdrive /media/phoenixdrive && sudo mkdir /media/phoenixdrive/restoredfiles recover the files and send them to your usbdrive: Code: sudo ntfsundelete fullpathtoyourpartition -u -m 'filename' -p 100 -d /media/phoenixdrive/restoredfiles unmount the usb drive Code: sudo umount /media/phoenixdrive and that's it. Code: echo goodbye phoenix && sudo shutdown -r now p.s. if you dont recall the filelame use '.mdb', '.ldb' or whatever your file extension was.
	\|QUOTE AND REPLY\|

11.01.2009, 04:35 PM	#10
verme (prevaricator) 100% Join Date: May 2009 Posts: 785	those are just some basic unix instructions, nothing special. i should've made a little shell script but i was too lazy.
	\|QUOTE AND REPLY\|

11.01.2009, 06:37 PM	#11
phoenix invito al cielo Join Date: Apr 2007 Location: the future where it's hot and dark Posts: 5,926	ace, i will give this a try during the week. My reasoning behind setting the drive as slave /plugging it in with another was so that i didn't neede to instal anything on the drive and therefore over write if it was still there.. Thanks for yr nerdness i will write back here when i need help __________________ tiny and lost.
	\|QUOTE AND REPLY\|