Recover files from completely crashed computer?

Community Forums/General Help/Recover files from completely crashed computer?

ubergeek(Posted 2009) [#1]
Hi guys,

I wasn't sure where else I could ask this. A friend has a serious computer problem. The computer has whole disk encryption, and a software update caused some serious problems with the OS. Tech support from Dell on how to fix the original issue (the OS would not start correctly), involved using the fixboot command in the DOS prompt, which a supervisor later found out about and informed us that it made the problem even worse, and our only choice would be to reformat the drive and reinstall Windows.

We've researched disk recovery services, but they cost a lot.

I remember reading about something similar in CPU magazine, and that you could boot Linux from a USB flash drive to gain access to the crashed drive and back all of the files up to an external hard drive.

Does anyone know about this? Google hasn't turned up much so far.

Thanks a lot for any help!


Yasha(Posted 2009) [#2]
http://en.wikipedia.org/wiki/Live_CD

You can boot Linux from just about anything. Although if there's a problem with the disk, simply using a different OS might not be enough.


puki(Posted 2009) [#3]
What was the encryption you speak of - how was it encrypted?


ubergeek(Posted 2009) [#4]
@puki: It was encrypted with a whole disk encryption program.

@Yasha: Thanks, I'll look into that!!


xlsior(Posted 2009) [#5]
when using encryption: If you didn't back up your encryption keys, you're pretty much screwed.

That's kind of the point, after all.


ubergeek(Posted 2009) [#6]
As far as I know, for the encryption there is a screen that appears before it boots the OS where it asks for the password (which my friend already has, on a sticky note where it's always been ;-) ). I'm still a little unclear if the encryption screen still appears, but the main problem is getting the data off.

I just thought of something. The encryption was made for Windows XP, so I wonder if by entering in the password another OS can still access the files. Hmm...


xlsior(Posted 2009) [#7]
The problem is that you normally boot from the disk in question, and the encryption software presumable runs under either windows, or it's own mini-OS. since the disk has a problem, you can't boot from it.
If you boot from another drive or OS, then this disk encryption thing wouldn't just magically pop up anymore, as far as the other OS is concerned it just looks like a regular disk that it may or may not be able to read from.

With encrypted drives, having good backups becomes even more important since you're adding an additional single point of failure to the mix. :-?


_Skully(Posted 2009) [#8]
Sometimes... http://www.elcomsoft.com/aefsdr.html?r1=goto&r2=aefsdr


xlsior(Posted 2009) [#9]
It was encrypted with a whole disk encryption program.


there's many of those -- you'd need to know exactly which program was used


BlitzSupport(Posted 2009) [#10]
If only fixboot was used, then the data should all at least still be there. I don't know how the whole disk encryption affects things, but I know that TestDisk worked well for me when my partition data was corrupted (ie. no partitions showed up in Windows). It's pretty scary looking, but by following what 'sounded right', and choosing the default options where I was unsure how to answer, I managed to get all of my partitions back.

Doesn't the encryption program have a utility (perhaps on their web site) to re-write the boot block?


ubergeek(Posted 2009) [#11]
Thanks for all the help guys!

I'm not entirely certain what kind of encryption is on it yet (it's not my computer, it's my friend's), but from what I can tell the password screen still comes up, so hopefully it won't be too big of an issue.

I'm downloading Knoppix to make a CD, since I'm fairly certain the computer can't boot from a USB drive. From what I've read booting from a Knoppix CD should work for this type of problem.

I'll post back once I try it!


ubergeek(Posted 2009) [#12]
I got Knoppix running on the computer, sort of. I can boot into it, but there is no background image (just a black screen), no icons on the desktop, and I can't seem to run file manager, or most of the other programs on it. I can right click on the toolbar and change the properties, and since a menu pops up on the black screen I'm confused as to what the problem is... I'm being very careful with what I'm trying since it took me a while to get a Knoppix disc working.

Any ideas?


ubergeek(Posted 2009) [#13]
Solved!

I eventually got it working, I just had to reburn the disc and try it again a couple times. The data itself was still encrypted, but the important thing is that it was still intact. My friend got on the phone with the company that does the encryption software to explain the problem, and they're sending CDs over with software that will fix the boot partition and unencrypt the data.

Thanks for the help everyone!