Data Recovery: Data Loss and Drive Failures

File Systems & Drive Slaving

Now that the term “file system” has been thrown out a bit, so it would probably be best to describe what it is and the different file systems that exist. A file system merely the way files are organized. It is the format in which files are stored and arranged, similar to the way goods are organized in grocery stores. At their most basic level, file systems all do the same thing. However, like grocery stores, different file systems organize data in little bit different ways. The most common formats among Windows platforms are FAT16, FAT32 and NTFS. FAT 16 is usually found with a Windows 95 operating system, but still can be used with Windows 98, ME, 2000, and XP. The catch is that with the 4GB partition limit, it is not reccomended for use outside its native operating system unless it is needed for a muli-boot setup that must have FAT 16 compatibility (any operating system that lacks FAT32 or NTFS compatibility). FAT32 can be found with Windows 95B, 98, ME, 2000 and XP. The new NTFS file system was introduced with Windows NT and can only be found with Windows NT, Windows 2000 or XP systems. Both 2000 and XP can run on either FAT32 or NTFS. Operating systems using the FAT file structure cannot read drives using the NTFS file system, so don’t be alarmed if you come across this scenario while trying to recover data. On the other hand, operating systems using the NTFS file structure can read any drives formatted with any type of FAT file system, excluding Windows NT. Windows NT cannot read FAT32 drives. The general rule of thumb is that older file systems cannot read new ones, but newer ones can still read older ones. Being as that there is an exception to every rule, if you have Windows 95B, you will be able to read drives formatted with FAT32, even though the Windows 95B may be running on FAT16.

When trying to recover data off a drive using a Unix/Linux system, older main-stream versions are guaranteed to have build-in support for FAT file systems, and newer main-stream versions have full read/write support for FAT file systems, but can only provide NTFS read support. Write support is by no means reliable as of yet. Even so, this should suffice for data recovery. If the situation happens to be the other way around where data needs to be recovered off of a Linux/Unix drive using a Windows platform, a program called Explore2fs can be used to read the data on the drive.

When using an older Windows file system and/or any kind of older machine as a host for a newer drive, there are a few problems that may pop up. First, FAT16 file systems can only see partitions that are less than 2GB, and Windows 98 has a limiting partition size of 137GB. Anything larger, and it just doesn’t exist as far as the host machine is concerned. There are really no workarounds for these two limitations. The issue with older machines is that no matter what file system is being used, the motherboard’s BIOS may not support large capacity partitions. Yes, this hardware limitation carries over to Unix/Linux platforms, not being a software issue. There are partition limits with older BIOS chips: 137GB, 32GB, 8GB, 2GB, and 504MB, depending on the age and the type of BIOS. This leaves you a few ways to get around this limiting factor. One workaround is to install a PCI IDE card (with SATA capabilities, if needed). The other is to simply use a newer machine. A riskier third option would be to see if a newer BIOS revision was released that fixes the limitation, and to perform a BIOS flash with this update. If done incorrectly, the BIOS flash can effectively render your motherboard useless. There is one exception to the partition limitation you should be aware of among modern systems: note that if you are running Windows XP without SP1 (Service Pack 1), there is a software limitation of seeing partitions larger than 137GB. Installing SP1 fixes this issue. Windows 2000 has a similar issue with the 137GB limitation, but if you have either SP3 or SP4, the problem will be resolved. Anything lower than SP3, and you’re stuck with the 137GB limit.

Making sure that the file system on the host computer is able to read the drive being slaved is one of the problems that needs to be kept in mind when connecting a drive. When it comes to slaving drives, the big issue is keeping track of what machines are FAT32 and which are NTFS, since there are operating systems that can use either one. Nevertheless, drive slaving is often much easier than to trying to repair the operating system first (if it is damaged), and then attempting to pull data off of the drive.

Before connecting the hard drive to another system, make sure that the system that is going to serve as a host has up-to-date AntiVirus protection. There is a risk of infection of the system if there is a virus hidden among the data that is being copied over. Another thing to keep in mind while slaving your drive, sometimes different drive brands have conflicts with each other if they are on the same IDE controller. If one or both drives are rendered undetectable in this case, simply moving the slave drive to another controller will remedy the problem.