Pulling data from HDDs

[skeetmandb]

I have two issues I am hoping to get some help with. The help is greatly appreciated.

1. I have a Dell Dimension 3000 that just died after a power outage (just get the flashing orange light when I try to power it up). This computer has all sorts of pictures as well as i-tunes and document files on the hard drive that I would very much like to recover. Unfortunately it also has the "boot.tideserv" infection that I could never fully eradicate (used TDSS killer and others as well). Can I remove the hard drive from the dead computer and put it in my working Dimension E510 to retrieve the files from it, and if so, what is the risk of also transferring the infection?

2. I also have a WD 500GB external dive that will power up but the computer will not "recognize" it as being connected. That drive has thousands of pictures on it that I would also like to recover. What is my best option for doing so without spending lots of $$ for a data recovery service (if I had lots of $$ I would have better computers to begin with)

Thank you in advance for any and all help!

[mjc]

1. Yes and yes.

To clarify a little...any time you have an infected drive, there is a chance, especially if you boot to it, of transferring the infection. Now if all you want to do is grab the pictures off of it, the chance is low.

You would pop the drive from the dead laptop, place it in an external enclosure and hook that up to a working machine. To do the transfer, since you know there is an infection on it, I would boot to a Linux LiveCD and use that to transfer the pictures, directly to optical media (CD/DVD). This would best be done with a 'light weight' Live CD that can be loaded to RAM (if you have more than 1 GB of RAM). If you don't then create a folder on the hard drive of the working machine and transfer the pictures directly to that folder. Then before doing anything else to them, scan that folder with an up to date AV.

2. For the WD, I'd pull the drive from the enclosure and hook it up directly to the computer (internally). Many times, that is all you need to do to regain access to it.

[Paul Komski]

The Dell flashing orange light can mean something blown or corroded on the mobo or it can be something more simple. You could also Google "Dimension flashing orange light" or similar for further info.

Your good Dell has just one IDE/ATA connector slot so if you want to transfer the IDE drive from the faulty PC you could temporarily detach the ribbon cable and molex connector from the optical drive and attach the drive from the faulty PC to it.

I agree that I would prefer to use a Linux Live CD (there's a Knoppix link in my sig if that helps) if there is a danger of an infected drive being accessed. With nearly all Dells if you press the F12 key during boot-up you will be able to choose the boot device, which is handy for booting to CDs and such like as one-offs rather than go into the BIOS and make a more persistent change.

When you open the enclosure to get at the WD drive inside you will discover if it is IDE or SATA. If IDE do the same as above and if SATA just use the other SATA port on the motherboard.

Another way to attach drives to a working PC is to use an inexpensive specialist adapter to which you can attach both 2.5 (Laptop) and 3.5 (Desktop) drives both IDE and SATA.

Personally for this sort of recovery I like to use Pen Drives or other USB Flash memory or another hard drive rather than use CDs and DVDs - but that is everyones own choice.