Tuesday, March 24, 2009

Data loss after unsafe removal part 1

So today I was transferring files to my friends portable harddrive plugged into the USB on my laptop, and because it had a few autorun.inf viruses on it, it infected my PC and I couldn't safely eject since it was read/writing all the time (virus activity).

So I pulled the thing out, and of course being NTFS it now shows up as a RAW drive, unformated 0KB total size, 0KB space used, when right clicking properties in my computer.

I ran partition magic 8 in windows XP and you can see that drive is still there, and the file system seems ok, but anyway, tommorow I will
1) use get-databack-NTFS from Hiren's Boot CD, and wait 2 hours for it to read the drive data and chose the data to backup - 2 hours
2) shift the data off the drive onto my laptop drive (requiring about 50GB of free space) taking about 1 hour
3) format the drive to FAT32, since I think it is safer! - 2 minutes
4) shift the data back across - 1hour

So you can see there goes about 4 hours of downtime for this guy, lucky I know what I am doing, he would have just re-formatted and started again, but 4 hours is no problem, leave it running in the background and keep working on my VM project.

Moral of the story: Always have NOD32 installed before plugging in a strangers USB drive, and disable autoruns if you're not running the latest version 4! Also scan and clean, then you can safely eject it properly. I ALSO recommend to use FAT32 as the data container, as it seems to get corrupted less easily, if you insist of NTFS for the extra benefits eg, files bigger than 4GB, extra security, not being able to read on windows 9x (benefit?), then make sure you eject it properly and set your deivce manager for quick removal option.

No comments:

Post a Comment