Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
25% Recurring Discount on NVMe VPS
Try EnsoVPN - Reliable VPN - 1-Day Free Trial
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
CloudLinux
Try EnsoVPN - Fast & Private VPN - 1-Day Free Trial
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

How to recover data from Windows if installed by IPMI?

RurikoRuriko Member
edited July 2 in Help

I have a kimsufi LE-1 and it has a defective HDD so it can no longer boot into windows. Is there anyway to recover data from a windows installed machine? it was installed via IPMI and not template. I have access to debian rescue mode

Comments

  • aphexaphex Member

    boot to rescue
    dd entire disk into over network to second machine

    Thanked by 1tentor
  • backtogeekbacktogeek Member, Host Rep

    Boot to rescue and use ddrescue not plain DD as it will not stall on bad blocks so takes less time for better recovery chances.

  • RurikoRuriko Member

    @backtogeek said:
    Boot to rescue and use ddrescue not plain DD as it will not stall on bad blocks so takes less time for better recovery chances.

    if the drive can't be detected with lsblk does it mean it's not recoverable?

  • tenjitenji Member

    there is tool in hirens boot cd that can scan for partition(s) and recover their partitions mapping so lsblk can see it. but it might be in mbr scheme only, don't know if it had gpt support, so don't get your hope high yet. forgot their name, let me check on their list of dozens of apps.
    use hirens cd 9.x which include all hacked licenseregistered apps first; if it's freeware, you can check the latest hirens cd.

  • tenjitenji Member

    @tenji said:
    there is tool in hirens boot cd that can scan for partition(s) and recover their partitions mapping so lsblk can see it. but it might be in mbr scheme only, don't know if it had gpt support, so don't get your hope high yet. forgot their name, let me check on their list of dozens of apps.
    use hirens cd 9.x which include all hacked licenseregistered apps first; if it's freeware, you can check the latest hirens cd.

    found it, it's called "partition find and mount". it's freeware so you can use latest hirens bootcd.
    there are also "Smart Partition Recovery" (freeware) and "DiskGenius" (shareware).

    good luck.

  • edited July 3

    @Ruriko said:

    @backtogeek said:
    Boot to rescue and use ddrescue not plain DD as it will not stall on bad blocks so takes less time for better recovery chances.

    if the drive can't be detected with lsblk does it mean it's not recoverable?

    If the drive isn't detected at all i fear there's little you can do.

    If it is detected though: Don't try anything fancy. Use ddrescue as mentioned by @backtogeek to create an image at a remote location (i figure you don't have any other storage in the box where you could work on the image - use something like ddrescue if=/dev/sdX of=/dev/stdout bs=1M | gzip -9 | ssh user@remote 'gzip -d | dd if=/dev/stdin of=windisk.img bs=1M') since with any access to the disk the chances of it failing completely rise. Any recovery attempts should use (ideally a copy of) the resulting image.

    Dealing with the image is probably best done using losetup (man page), which will give you an actual device that's backed by your image. Depending on how damaged the Windows partition is you might be lucky enough to be able to just mount it using ntfs-3g (man page).

    Thanked by 1rsk
  • backtogeekbacktogeek Member, Host Rep

    is it an HDD or NVMe ?

  • RurikoRuriko Member

    @backtogeek said:
    is it an HDD or NVMe ?

    It is SATA HDD

  • backtogeekbacktogeek Member, Host Rep

    @Ruriko said:

    @backtogeek said:
    is it an HDD or NVMe ?

    It is SATA HDD

    hmm, sometimes nvme's come back after leaving the server powered off a while to cool down, sometimes in read only, but HDD... if its not showing up at all, I am afraid it is probably not going to be possible.

    Maybe give someone experienced and trusted access to the server in rescue mode to triple check but you should plan for the worst.

  • WilliamWilliam Member

    If you dont see it in lsblk (or lspci for NVMe) anymore your board is gone. OVH will ship you the HDD at massive cost and you can have the PCB replaced by a specialised service.
    Its often just ca capacitor or similar but you need an exact donor drive and a cleanroom.

    The HDD as in the spinning rust is in 90% of cases perfectly fine unless it was dropped while on. It is way harder to kill modern drives than ever, hell even the 1.8" ZIF drives in iPods survived hundreds of falls.

  • forestforest Member
    edited July 4

    @William said: Its often just ca capacitor or similar but you need an exact donor drive and a cleanroom.

    Is it? I thought it was usually head crashes and lubrication drying up, and other generally physical issues.

    [Electrolytic] capacitors are often the first components on a circuit board to fail in general, but they last a lot longer than the typical failing HDD and it'll never cause SMART reports.

  • WilliamWilliam Member

    If you see SMART yes its toast, if it just disappered chances with a donor are good

  • DataRecoveryDataRecovery Member
    edited July 4

    @Ruriko said:

    @backtogeek said:
    Boot to rescue and use ddrescue not plain DD as it will not stall on bad blocks so takes less time for better recovery chances.

    if the drive can't be detected with lsblk does it mean it's not recoverable?

    If you don't see the drive, then the only option is getting it physically.

    The newer the model, the less are the chances that you'll be able to do anything yourself afterwards. Quite likely you'll need to contact a specialized company (that isn't cheap usually).

    If the drive is detected, create an image, preferably with gddrescue (GNU ddrescue).

    @William said: Its often just ca capacitor or similar but you need an exact donor drive and a cleanroom.

    Things are more complicated these days, unfortunately.

    Capacitor (and other elements') issues are rare. You probably meant a 12V TVS diode, back in the days it was possible to remove it and replace with a bridge.

    PCB issue is more realistic. Just a PCB swap is unlikely to help. If that's the case, then most likely at least ROM transfer is also needed.

    Clean room required for a head swap, but that's way beyond even an advanced user's capabilities. Professional help is necessary.

    Important P.S. (to OP and other interested)
    Following an "advice" from youtube video with some Indian dude doing a head swap or even just opening a drive at home is a straight way to disaster.

    If you're unsure about the issue, better to avoid even powering the HDD on.

  • WilliamWilliam Member

    @DataRecovery said: The newer the model, the less are the chances that you'll be able to do anything yourself afterwards. Quite likely you'll need to contact a specialized company (that isn't cheap usually).

    Zero chance. You fail at the Helium refill even if you manage to not fuck up before.

    @DataRecovery said: PCB issue is more realistic. Just a PCB swap is unlikely to help. If that's the case, then most likely at least ROM transfer is also needed.

    I only have seen it in videos but the PCB swap seems to be rather common.

    Of course for (NVMe) SSDs and eHDDs with integrated encryption you can absolutely forget any repair if your controller is toast.

  • DataRecoveryDataRecovery Member
    edited July 4

    @William said: Zero chance. You fail at the Helium refill even if you manage to not fuck up before.

    Helium drives are recoverable (not each and every though - newest models aren't well-researched yet), but definitely more expensive than the "regular" ones. Some models are way more expensive.

    Some models can read (not write) without helium, for others there are specialized boxes, which can be filled with helium (ain't cheap stuff either).

    @William said: I only have seen it in videos but the PCB swap seems to be rather common.

    Just a swap was feasible years ago. Most relatively modern drives are unique (calibrated individually at the factory).
    Google for adaptives (adaptive parameters). Without those HDD won't be able to read.
    Hence the need for ROM transfer.

    @William said: Of course for (NVMe) SSDs

    SATA SSDs and NVMe ones are two very different stories :)

    @William said: eHDDs with integrated encryption you can absolutely forget any repair

    Some "encryptions" can be decrypted, but that's at least a separate article as well.

    @William said: It is way harder to kill modern drives than ever

    Also vice versa, unfortunately.
    The newer the drive, the more fragile it is. Miniaturization + more complex technologies under the hood.

    SMR HDDs can just kill themselves during some relatively typical activities. They also may not survive incidents, which would be mostly OK for a CMR drive.

  • WilliamWilliam Member

    @DataRecovery said: SMR HDDs can just kill themselves during some relatively typical activities. They also may not survive incidents, which would be mostly OK for a CMR drive.

    Oh g-d dont remind me, we had hundreds of the first gen SMR drives just randomly die. It was so bad they shipped you a new HDD even out of warranty, afraid of class action suit.

Sign In or Register to comment.