[REQUEST] Ensuring OS integrity after cloning from a failing HDD - Data Recovery

[Romaniac]

Hi all,

A note before reading the main query: The main question isn't about simply recovering data, saving that data, etc. It's about saving the OS and having the user continue as if nothing happened (after all other precautions to preserve data have been taken, etc.).

I have cloned barely failing drives to some badly/severe failing drives (hundreds or over 1K reallocated sectors, non-booting, etc). and had success in fixing Windows and getting them to boot and continue to work.
I cannot recall having one come back; However, this does not mean it didn't happen. Perhaps those people went to someone else if something did fail though. I find this unlikely for multiple reasons, but must keep it as a possibility. Cloning can save people a ton of time and money; there are dozens of benefits.

If the drive has reallocated sectors, I'm guessing it matters which data happened to be there and was moved, or where we have OS system files damage, etc.
But let's assume there's an HDD that boots but it clearly has sluggishness, or maybe it may not boot every single time, etc.
So, if a drive like this is cloned (probably HDD to SSD), and chkdsk, dism scan and/ore restore health, and sfc are successful, is this system good to go? Or not? Sometimes I use BCs Windows Repair AIO tool for good measure. Then do any outstanding windows updates.
Should anything else be done? How else can OS integrity be checked?

What are your SOPs / policies on cloning failing drives?


Thank You!

 

[Larry Sabo]

If the drive has reallocated sectors, I'm guessing it matters which data happened to be there and was moved,

My understanding is that the data that was in a sector that gets reallocated is not recoverable and is not simply moved to a sector in the spares area. The data in the reallocated sector is data that was written after the sector was reallocated. If a sector is flagged for reallocation but is successfully read on a subsequent attempt, the pending reallocation flag is cleared. However, I could be wrong.

I would think an upgrade-install would replace any missing or corrupted Windows files and re-installing programs should restore healthy program files (although that is not always an option when the installation media or license is not available). Personally, I try very hard not to repair such badly damaged systems because they can no longer be trusted.

 

[Diggs]

If there are any issues with a drive or I suspect it is failing the very first thing I do is make a sector copy using ddrescue in Linux. Being that ddrescue reads both forwards and then backwards through the drive twice I feel I have the best copy that I can do. On that copy I will run chkdsk (if the dirty bit is tripped) and DISM and feel pretty confident of a solid drive before imaging.

 

[YeOldeStonecat]

If it completes a clone, it's very likely to be "good to go". I can't begin to count how many thousands we've done with this...a barely running or even not fully booting up failing spinner...we get it cloned to SSD...and the SSD runs great. These are full time clients of ours (businesses)...so if it resulted in an unstable system we would know about it straight away. Because we'd get calls of it not working!

If it doesn't complete the clone, it's not going to work...fresh pave time!

Once it clones, we might do a checkdisk if it was really suspect to not work, else..we'll just got right to blowing out temp files, running Microsoft updates, OEM driver updates...and done. We've really neve found DISM worth the time....nor other 3rd party "repair tools".

 

[HFultzjr]

If there are any issues with a drive or I suspect it is failing the very first thing I do is make a sector copy using ddrescue in Linux. Being that ddrescue reads both forwards and then backwards through the drive twice I feel I have the best copy that I can do. On that copy I will run chkdsk (if the dirty bit is tripped) and DISM and feel pretty confident of a solid drive before imaging.

Sounds good. Do you ddrescue to an .img or do you go disk to disk.
What about partitions? All?
Thanks for your input.

 

[Diggs]

Sounds good. Do you ddrescue to an .img or do you go disk to disk.
What about partitions? All?
Thanks for your input.

Ddrescue is always disk-to-disk and although you can clone from smaller to larger it cannot downsize. Ddrescue knows nothing about partitions. It is sector copy only. Most copy programs fail when they cannot read a drive sector or skip to the next sector where ddrescue will come back later and read that same sector backwards from the end to the front usually recovering more data from the bad sector. It's the only program I know that does this.

@YeOldeStonecat - I've had too many clone jobs run for an hour(s) and then fail when a bad sector is tried near the end of the drive. This is the reason I image first (and restore to the SSD from image) and if the image creation fails then it's ddrescue time followed by imaging.

 

[britechguy]

If it completes a clone, it's very likely to be "good to go".

I agree, though I have not done anywhere near to "thousands." Clone utilities, any that I've used, are not tinker-toy software but are very sophisticated in how they handle drives with tons of reallocated sectors.

For those who want to go the extra step of using ddrescue you'll get no argument from me. Anyone can and should do what makes them comfortable. But I have no evidence that this step is necessary based on my own experiences. The cloners have handled things perfectly.

Were I dealing with a Windows 10 system, if I wanted to be anal retentive, I'd do a repair install on the cloned disk for good measure.

 

[YeOldeStonecat]

I'm onsite right now at an insurance client, their "fax server" acting up for their Applied systems.
Little Optiplex ....popped the hood, and as expected...the dread, guaranteed to die soon, only taking 2nd place after the old Quantum Bigfoot drives for "worst reliability ever" award...the WD Blue spinner!

Using one of our Startech "Drive Goblins"....a hardware drive duplicator. This is our preferred cloning method....works REALLY well, and fast. And I like being able to easily, quickly, clone while onsite. It's pretty good at seeming to determine early on if the clone will work or not...it's darned good at hammering through some pretty stubborn drives that may have not allowed a clone to complete via other software methods. We like to spend the least time "doing it"...combined with "get the best results"..so these Goblins have paid for themselves many times over.

In 2 weeks my client is moving to the new Applied Saas offering.."Epic"...and I'll upgrade this workstation to W10 for the updated Fax software (it's been on 7 for the prior fax version).

 

[Diggs]

Oooo! A Blue!!! Heh. I see a lot of failing ones still.

I carried around my cloning hardware in my car for 5 years and never used it. I do all cloning at home. Takes way too long at the client (using USB 3). Does the StarTech cloner really speed things up that much? Also for the fact I see so many failing drives in the residential sector. I'd say 30% of what I get will not clone or image "as-is".

 

[YeOldeStonecat]

Oooo! A Blue!!! Heh. I see a lot of failing ones still.

I carried around my cloning hardware in my car for 5 years and never used it. I do all cloning at home. Takes way too long at the client (using USB 3). Does the StarTech cloner really speed things up that much? Also for the fact I see so many failing drives in the residential sector. I'd say 30% of what I get will not clone or image "as-is".

Our "other" method of cloning, would be to use a Dell Precision we have on our service bench, connect the SATA drives direct to the mobo...and boot from an Acronis CD. So we're on native SATA ports on the mobo which are 6 Gb/s ports.

The Goblin models we have are about 15 GB/minute if I recall.

BUT...we're usually pulling from old spinner drives...which are of course the bottle neck. Typically doing an older spinner, so it's long from running at its best. Right now the drives pictured above...are about 55% complete. As you can see I was 3 minutes 37 seconds into the clone when I snapped the picture. I'm at 33 minutes now....the old WD Blue was definitely on her death bed. The Goblin isn't pulling as fast as it could....old slow source drive is the bottleneck.

I will say, we have found the Goblin to be faster at cloning, on average, than doing the old school method on our bench rig. I believe the hardware in it just allows the sector by sector cloning to be done a little faster.

Also just setting up...quick and easy to connect the Goblin...power up, push a button quickly to get the clone going. Shaves off a few minutes versus doing the old school way, booting from CD, wading through the Acronis menu, etc.

I've tried most of the other cloning software, and have found Acronis to be a combo of quickest and most successful of the software approaches. Tried the heralded DD Rescue..and perhaps it does hammer through REALLY failed drives better than Acronis or others....but since we have 99.9% biz clients, and we're in touch with most of 'em, I guess we don't have many drives that have jumped off the cliff as much as people who do lots of residential. Where those residential users may have HDDs that are REALLY REALLY shot..taking hours to boot up. Our biz clients wouldn't let drives get that far gone.

Sometimes we find the Goblin can clone failed drives that Acronis cannot.
And other times, we've found Acronis can clone failed drives that the Goblin cannot.

Nice to have 2x options, but we picked up a couple of the Goblins so that we can first try to do clones onsite. Right now the client I'm at is a good client I've had for about 25 years, he's almost an hour away from me, and he's on a "silver" MSP plan. I happened to be about 15 minutes away while at another client. So for me, makes sense to go onsite and get the clone done, else I'd have to make 3x more trips (back to my office...and then clone..and then drop it off, and return back to my office).

 

[YeOldeStonecat]

1 hour 13 minutes total. Little longer than usual...but...drive had been acting up (hence the call to me)..and it was WD Blue.

 

[Romaniac]

Hello all. Good discussion, and thank you.

To add some details:

For a failing drive, I use ddrescue and usually drive to drive, though I also go to images. ddrescue is the tool that has been able to image some really bad drives and then boot; even if the original drive wasn't booting anymore. Sometimes some windows repair is needed.

And this goes back to the original inquiry: how good do we feel about cloned failed drives IF system boots, and the chkdsk, DISM scan-health/check-health and sfc processes are successful?

I know we have a few data recovery folks in here; I'd love if some of them could reply. Maybe @lcoughey has some words. Anyone else?

 

[glennd]

And this goes back to the original inquiry: how good do we feel about cloned failed drives IF system boots, and the chkdsk, DISM scan-health/check-health and sfc processes are successful?

I'd usually be fine with that. But I would sit with the customer and run through the applications to make sure that everything is working for them as it used to. Open the browser and go to some bookmarks, open the email and make sure it sends/receives, whatever else they do on it.

 

[Sky-Knight]

This is one of the things I love about Windows 10, clone off the bad disk, onto the new disk. Strange things happening? Install the most recent feature update off my USB key... boom system online. This process replaces the entire OS. Anything else can be fixed if needed remotely.

Any units that aren't going to work typically just don't boot after the clone.

 

[NJW]

Ddrescue is always disk-to-disk

Everything's a file – you can use ddrescue to write an image file. Advantage: you can use existing storage without overwriting disk formatting; you can compress the image (according to the docs, but I've never tried that).

Also, ddrescue can image and clone without mounting the failing drive and resume an interrupted process without losing previous work.

 

[HFultzjr]

1 hour 13 minutes total. Little longer than usual...but...drive had been acting up (hence the call to me)..and it was WD Blue.

Would you be so kinds as to share more info on this Goblin?
Thank you.

 

[YeOldeStonecat]

Would you be so kinds as to share more info on this Goblin?
Thank you.

HDD Duplicators - Hard Drive Cloning/Copying | StarTech.com

Our standalone, eSATA, and USB Drive Duplicators provide comprehensive hard drive copying, saving time by providing immediate access to drive contents without having to mount the drive in a computer chassis or install into an enclosure

www.startech.com

Of the list of models in the above site, the one we bought a couple of is the SATDUP11IMG
The one above it in the page, doesn't store images, but it's almost twice a fast...may end up buying that one too.

 

[britechguy]

This is one of the things I love about Windows 10, clone off the bad disk, onto the new disk. Strange things happening? Install the most recent feature update off my USB key... boom system online. This process replaces the entire OS. Anything else can be fixed if needed remotely.

Any units that aren't going to work typically just don't boot after the clone.

The only thing I'll add is that if, for some bizarre reason, one would not want to install the most recent feature update, you can use the USB install media for the same version that happens to be running on that system already to get precisely the same result while retaining the current version. Or if you have the ISO, you don't even need USB media, just copy it on, mount it as a virtual DVD, and run setup.exe, choosing to keep files and apps.

One of the very best things about Windows 10 is the number of ways you can get a "wonky system" back to working completely correctly again without the need for a nuke and pave in a very great many instances. I use the repair install option far, far more frequently than a nuke and pave, which is the last option when all else has failed.

 

[Sky-Knight]

@britechguy Yeah, I N&P machines these days only to ensure malware removal not due to windows eating itself.

When Win10 launched I HATED the feature updates, and I still do because of their semi-annual nature. I wish they were annual releases instead.

But regardless of the scheduling, having Windows reinstall itself every six months has tremendous technical value, and it prevents so many problems.

 

[lcoughey]

For technicians, I'm a big fan of the Startech SATDUP11. I have one here, along with its big brother the SATASASDUPE11 which also copies SAS drives. Some features I like:

1. Ability to set to clone only used sectors of each partition
2. Ability to tweak how the unit handles bad blocks. (ie, skip sectors, stop on a certain number of errors)
3. Fast data transfer speeds
4. The ability to use it to write 0x00 to two drives simultaneously
5. The ability to send a secure erase command to a drive
6. Portable
7. Clearly marked source and destination ports
8. Cheap

The drawbacks of most cloning software used by most technicians is that there isn't much way to identify which files are affected by bad sectors. If you want to get into that, that is where you need to invest some $$$ and buy a RapidSpar.

Personally, I'm of the mentality that unless the drive cloned 100% without error, it is always better to start with a fresh install and restore the data from backup.