Drive has LOTS of Bad Sectors - Help

[Vicenarian]

Ok, got a laptop in today that won't boot Vista.

Anyway, did HDD diag using DFT, gave me 0x70 code or something, ran Seatools and it detected about 80 bad sectors with the test only at 4% or so, of the drive. However, the tests did NOT say that SMART had been tripped (not sure if that means that the drive is physically OK or not?). The drive makes no weird noises or anything. I tried accessing it from Ubuntu, but it won't mount it.

So, I have done a little reading on data recovery in the past, but what I am wondering is what steps to take next. Of course, I will contact the client and let them know their data could be lost, etc.

Does this sound right:

1) Make image of drive to get as much readable data off of it as possible now (Any recommendations? I'm not sure if Clonezilla/Acrosnis TI will cut it, or should I buy something more advanced?)

2) Run HDD Regenerator or Spinrite on original drive, to see if I can recover data from the bad sectors.

3) ???


Help for this data recovery noob would be greatly appreciated.

 

[Martyn]

I did a recovery on a drive the other day with Getdataback. Made an image first. 10% of the drive was errors and took 6hours then the rest took an hour and I got 100% of the data the client wanted back.

 

[gazza]

It really depends on how bad the drive is, unfortunately as techs we don't have a crystal ball to predict how much life the drive has left and whether the drive will withstand the pressures of data recovery software.

Use Getdata back to image the drive.(puts less stress on the drive) do not do a recovery off the drive, recover the data from the image.

 

[MrUnknown]

if you have any concerns that the drive will fail, do not run HDD Regenerator or Spinrite on it.

 

[Hercomputers]

H-m-m-m, I'm not sure if I would make an image BEFORE the data recovery....I'm pausing on that but that's just my personal opinion. I've used GetDataBack many, many times when I worked at the company's laptop depot and the program bypassed the bad sectors BUT depending on the condition of the drive, some, all or none of the data was recoverable. In these instances, the client got a brand new drive, new image, etc. Personally, I like doing the data recovery first. No cloning, imaging of the existing bad drive - nothing like that.

Are you replacing the drive or just getting the data off to reimage the same hard drive?

 

[gazza]

H-m-m-m, I'm not sure if I would make an image BEFORE the data recovery....I'm pausing on that but that's just my personal opinion. I've used GetDataBack many, many times when I worked at the company's laptop depot and the program bypassed the bad sectors BUT depending on the condition of the drive, some, all or none of the data was recoverable. In these instances, the client got a brand new drive, new image, etc. Personally, I like doing the data recovery first. No cloning, imaging of the existing bad drive - nothing like that.

Are you replacing the drive or just getting the data off to reimage the same hard drive?

Are you sure about not taking image first on a drive with bad sectors. Below is a statement from the Getdataback website http://www.runtime.org/data-recovery.htm

If you notice any mechanical problems with the drive, such as bad sectors or unusual noise, you should stop the recovery and make a drive image first. When successfully created, you can recover from this drive image as you would recover from the original drive. A mechanically damaged drive can fail entirely every second. It must be your primary goal to pull all raw data off such a drive as fast as possible. Making an image also reduces the load on the drive because each sector is read only once. Professional data recovery companies always make an image of the drive before trying to retrieve any files.

 

[PcTek9]

unfortunately as techs we don't have a crystal ball to predict how much life the drive has left

sure we do champ! if you can check the smart of the drive, one of the things is how many HOURS it has been run. If you have a drive that has been running way over it's warrantied hours, i'd say you are close to a failure wouldn't you?

In fact... Preventing these sorts of situations should be PARAMOUNT for all your business customers. Make them change drives that are past x amount of hours of operation.

Move the magnifying glass away from the gas can, as opposed to putting out a fire later.

As far as lots of bad sectors... Well... that doesn't sound encouraging. Could the O.P. inform us of the hours the drive has been in operation by look at the smart data please? T.Y.

 

[gazza]

sure we do champ! if you can check the smart of the drive, one of the things is how many HOURS it has been run. If you have a drive that has been running way over it's warrantied hours, i'd say you are close to a failure wouldn't you?

In fact... Preventing these sorts of situations should be PARAMOUNT for all your business customers. Make them change drives that are past x amount of hours of operation.

Move the magnifying glass away from the gas can, as opposed to putting out a fire later.

As far as lots of bad sectors... Well... that doesn't sound encouraging. Could the O.P. inform us of the hours the drive has been in operation by look at the smart data please? T.Y.

The original poster wants to get the data off a drive that it is unstable and full of bad sectors and you want him to check the smart data. That's great Champ! lets fire up that drive one last time!

 

[Hercomputers]

Are you sure about not taking image first on a drive with bad sectors. Below is a statement from the Getdataback website http://www.runtime.org/data-recovery.htm

If you notice any mechanical problems with the drive, such as bad sectors or unusual noise, you should stop the recovery and make a drive image first. When successfully created, you can recover from this drive image as you would recover from the original drive. A mechanically damaged drive can fail entirely every second. It must be your primary goal to pull all raw data off such a drive as fast as possible. Making an image also reduces the load on the drive because each sector is read only once. Professional data recovery companies always make an image of the drive before trying to retrieve any files.

Thanks for that link Gazza, but the last bullet states 'if the drive has mechanical problems'.....and everyone has their way of doing things. That's why I stated 'my personal opinion is...'

I'm still curious to know if V is replacing that drive or he just wants to try for data recovery and reimage that same 'bad drive'. Waiting for his response.

 

[MobileTechie]

GetDataBack is designed primarily to find deleted files by searching the drive for known file headers and working out from them which bits of data are files. You don't need to use it in this sort of situation unless you cannot find any files on the image you make.

The reason you should clone the drive first is that it might be the only chance you get to do so, depending on what is wrong with the drive. Also, in order to find files, GDB will attempt to use the MFT and read non-deleted files too. This involves the head being moved about as in normal drive use, which is to say being swung about very rapidly indeed. If the drive is on the way out then this is likely to accelerate it depending on what is wrong. Since we don't know what is causing the bad sectors we have to proceed cautiously.

You need to use an app which will ignore bad sectors and move on. Most the leading players can do this. Acronis, CloneZilla, Paragon etc etc all ignore bad sectors if you tell them to. On a really hard to read drive a reverse clone can work better. DD Rescue does it for free. Media Tools Pro does it for money.

Although 60 bad sectors is bad news, it's not actually much data so plenty of usable data could still be found.

After I've made an image, I'd have a crack at repairing the sectors with something like HDD Regen. Sometimes this will do a good job and allow a second but perfect image to be made. You still have to chuck the old drive of course. You might also need to run chkdsk /f on the restored image if the filesystem is damaged.

The phrase that Runtime actually use "any mechanical problems with the drive, such as bad sectors". This drive has bad sectors.

BTW I think the idea of being able to tell drives are about to go bad because they out outside of the warrantied hours is erroneous. Plenty of drives fail well before their alloted time and plenty last a lot longer. It's just not a reliable method.

 

[BigFrog_Computing]

Boot the system with PartedMagic live CD and image the drive to a new one with ddrescue. You don't have to mount the drive when you do this. Note that it can take all day or longer depending on the number of bad sectors. Be very, very careful not to reverse the "if" and "of" parameters or you'll overwrite the bad drive with empty data.

Now you've got as much of the customers data on the new drive as possible, however NTFS will likely be corrupted. Slave the new drive to another Windows box and run chkdsk to repair the filesystem. Then you should be good to go!

BTW, the latest Parted Magic supports USB 3.0 if you have the hardware. I bought an EliteBook 8540w just to image drives from eSATA -> USB 3.0. Works awesome.

 

[gazza]

Thanks for your constructive input MobileTechie, it's a pity some other posters don't do the same.

 

[anonymous Mac Tech]

The reason you should clone the drive first is that it might be the only chance you get to do so, depending on what is wrong with the drive.

+1. Then if the drive completely craps out, which bad drives will during recovery, there is something to work with. If I can get an image, I can usually get a majority of the data. Only in extreme circumstances that its not the case. Many times all it takes is an image and some powerful directory structure repair software to get everything.

 

[Bitleveldata]

With all due respect to my fellow members, suggesting Spinrite/HDD Regenerator on a customer's live drive, where the end user might have some critical data in it - doesn't sound like the best approach.

Spinrite "scratches" the surface with its rigid steps of reading and writing wheres, HDD Regenerator does a simple set of "Verify->Write->Verify" operations, which isn't going to help in "recovering" the data from the dust either.

If the drive has even a single bad sector, the very first recommended approach would be to make two set of replicas, put the first copy safely just in case I need it later and work on the second copy of the image. Also, for an exact estimation of drive's health, query it's smart status and post the values (RAW) of "Reallocated Sectors Count" and "Reallocation Event Count". That will hopefully clear the smoke in the air we can determine that how weak the drive has actually been.

For imaging, Best one is the Deepspar, followed by the Data Extractor as the second choice. They both have excellent functions of hardware based "Smart" imagers, basically can read with the power control, resetting stuff, soft reset, sectors skip, ECC control, Time out..such functions are not to find in the software based imagers. However, if the hardware device is out of question for some reasons, Media Tools pro is the best one in the software category. Although, it is painfully slow, but can extract the dirtiest bit of the data which any other software based imager is not even remotely close of.

If the bad sectors are really LOT (as suggested from thread title), disable the read-ahead-cache by imaging it in reverse. It will further slow it down, but with better chances of extracting the data.

 

[MobileTechie]

Nobody actually suggested running Spinrite or Hdd Regenerator on the drive until an image had already been taken, and even then only to attempt to repair/remap the bad sectors to enable a second go at cloning it. The reasoning here is that these tools will sometimes actually effect a temporary "repair" giving access to some of the sectors which had been previously unavailable to the imaging application.

This is a method I've used countless times on disks with a lot of bad sectors and hosed Windows installations to avoid a reinstall. Take an image to secure their data, check that the data is available, run a repair app on the original disk to give access to the bad sectors, clone the drive to a new drive and run chkdsk /f to tidy up filesystem errors. The result in many cases has been that they have got their Windows (and data) back working on a new drive with no need for reinstallation. I did this last week on a drive with 150+ bad sectors. The original clone would never boot. The clone from the regenerated disk works perfectly. I'm not saying these are data recovery tools but they have a place.

I don't get the scratching thing with Spinrite. Obviously the head doesn't touch the drive so what do you actually mean? Out of interest where did you get the info on HDD Regen? I've been trying to find out what it's repair function actually is for ages.

Smart data is often not a true reflection of the state of a drive. I've often looked at smart, seen 1 bad sector, run the mrfrs test tool and rechecked smart to find it now has say 50 bad sectors. So I'm not convinced it is a remotely reliable way of telling how bad the drive is. It would appear that it only knows about sectors that have had attemped failed reads and knows nothing about sectors that are bad but are yet to have been accessed.

Media Tools Pro has already been suggested. You say no other s/w tool comes close to MTP but how about the freeware ddrescue? That does a reverse clone, will skip blocks and come back to them later etc, just like MTP.

We're not DT professionals unlike you appear to be from your site so we're not going to have h/w disk imagers.

 

[Vicenarian]

Hey, thanks guys for all the help! It's greatly appreciated.
I ran a SMART test using HDDScan, and I have this:

Should I proceed to create an image (first trying clonezilla, skipping bad sectors), and then create a reverse image using DD_Rescue if that fails and/or running HD Regenerator?

 

[MobileTechie]

Hmm that's pretty bad. 2051 reallocated sectors, 45 uncorrectable sectors and evidence of shock damage. Looks like someone dropped their computer.

So do they have critical data on this thing? Are they likely to shell out for proper DR?

 

[Vicenarian]

Hmm that's pretty bad. 2051 reallocated sectors, 45 uncorrectable sectors and evidence of shock damage. Looks like someone dropped their computer.

So do they have critical data on this thing? Are they likely to shell out for proper DR?

Hey, thanks for the response MobileTechie.

I'm going to contact the client with the findings, and let him decide from there.

Just curious, how did you get the number "2051" for reallocated sectors? I converted the 60690000-0803 hex value to decimal, and I got this:

EDIT: NVM, I guess you just convert the last part, "0803", from hex to decimal to get 2051.

 

[MobileTechie]

I've found with many clients that there are two types of "critical data". The first is absolutely critical and much be saved at all costs. This type of data exists when you tell them they might lose it. Then there is the critical data after you tell them how much professional data recovery will cost. That sort of data turns out to be not quite so critical afterall....

 

[BigFrog_Computing]

Should I proceed to create an image (first trying clonezilla, skipping bad sectors), and then create a reverse image using DD_Rescue if that fails and/or running HD Regenerator?

I think trying CloneZilla first is a bad idea since the drive is failing. I'd go straight to ddrescue or dd_rescue to do block copy of the entire disk. Come to think of it, I seem to recall that CloneZilla has to mount the drive to work, and you said Ubuntu couldn't mount the drive....

I had a WD Raptor fail on me one time with somewhere around 20,000 bad sectors. In hindsight I wish I saved the SMART data for reference because it was just a massive number of bad sectors. I used the regular dd command with some switches (skip?) to insert zero's for unreadable data. Then wrote the saved image to a new disk, repaired the filesystem with another win box, slapped it back in the computer and it booted right up. No further problems.

Thankfully I did that before trying out the SpinRite license I bought just in case. After SpinRite did it's thing for half an hour the drive was totally and completely bricked. I haven't used SpinRite since and probably won't ever again.