Best Way To Recover Data From A Failing Hard Drive

So how many actually watched the video? raise your hands please? Steve explains how drive manufactures are suppose to be able to allocate bad sectors to good ones but don't always. I would highly suggest you look at the video before posting ok? Spinrite is not the same as it was along time AGO. He has improved it and at least has not abandoned it over the years like so many you know. I guess the question would be, how long does the drive last after running Spinrite? Like I said it is not cheap like your top end AV's and if you have nasties on those bad sectors which a lot of malware uses today, Bad sectors to hide, that would be recovered as well. /For someone who really needs to recover data this would be worth the price. I have never had data worthy enough of recovering. I will leave out the lol this time since some here think it is immature, although I am not that, I have 5 grand kids and two great grandkids. I don't know maybe that means I am stupid. Since my generation was never trust anybody over 21.

 

@boredog I will take a look at the video. However, I would say that SpinRite has been pretty much abandoned, considering it is 11 years since the current version was released. There has been talk of a new version, but it has only ever been talk. Maybe Steve can't find someone to write version 7 for him?

I've never heard of malware using bad sectors.

 

^^^Important step^^^

Because if bad sectors are replaced with 0's (ignored bad sector) in order to continue reading the disk, you may have files that are corrupt. Ohh, they'll indicate the same size, and the bulk of the file might be intact - except for the unreadable part the copier/imager skipped over instead of error'ing out.

A jpg might decode only half way, a video file may drop frames, a text file might have garbled text in an area, and mp3 might stop playing early or have sounds like tick and scratch marks at times.

Data recovery is only complete and successful when each file is verified intact via checksums or by the program that uses that file.

And SpinRite is pretty much a dead product, the last version is like 10 years old and is not aware of modern disks and electronics.

 

Typically when a data recovery program seems to recover something, the user gets all riled up. Posts the praises and everyone reading shakes in awe at the job well done. Then the user goes and tests the files and falls into despair when the "recovered" data is non viable.

Peeps check your files, each and every one of them!

 

@Keatah I've used HDD Regerator on many drives and the "fixed" drives have worked fine. I've also cloned a number of problamatic Windows installs from hard drives with bad sectors (often running HDD Regnerator on the drive first), and the cloned drive has worked fine and booted to Windows, even when the original drive would not boot.

Of course there can potentially be problems. But, if HDD Regenerator says it has actually repaired a bad sector, I believe it.

 

HDD regen and spinrite both trigger the firmware to re-format the failing sector. That is what they do. That works. And windows no longer gets hung-up on that sector. The drive is good to go. And will likely last a long time.

Now. It is important to know what file the repaired sector belongs to. That file WILL BE DEFECTIVE.

It may be that the repaired sector belongs to a temp or log file in windows or some other un-used area of the disk. If there is an error there, no worries. It just gets rewritten and updated by windows again as a matter of course, thus you don't really see the problem. And everyones happy, you, the computer, the customer. Everyone.

If HDD regen "rebuilds" a sector belonging to a data file, like mp3, pdf, jpg, or other static document. Watch out. HDD regen has been shown to pull data from other areas of the HDD to randomly fill in the file and make it look ok again.

Yup! The drive will no longer get hung up on that sector/file. ERROR FREE! But that file is no good. Don't take my word for it. Test it and see for yourself.

A huge disservice to you this silent data corruption is. HDD regen is the functional equivalent of performing the regular manufacturer's zero-test, but only on a few sectors and not the whole disk. You need to find out the name of the damaged file and replace it.

http://www.tomshardware.com/answers/id-2179925/spinrite-hdd-regenerator-silent-data-corruption.html
http://forum.hddguru.com/viewtopic.php?f=1&t=28780

And by the way this is only good for a couple of sectors, if you got more than, say 3 or 4, your disk likely has other issues and may rapidly degrade at any time.

 

Yup! That it sure does. It does indeed trigger the firmware to reformat the sector. And the disk no longer hangs up the system. Believe it. Take it to the bank if you must.

But I swear to you on a stack of vintage floppies. Those sectors do not contain the data they did before they got damaged. The damage is usually a formatting issue that happened during a write operation. Half the sector could be missing. Some of the magnetic domains may be weak. HDD regen spiffs them up. But the data that was there before is gone forever.

Next time it happens. Record the sector numbers on paper. Then look up what files they belong to. Don't bother trying to copy the files, you won't be able to. The disk will time out. Run HDDRegen on the faulty target sectors.

And now you can copy those repaired files. The disk works, no more delays, no more lock-ups. Everything looks great! Now for the bombshell, do a CRC or bit-by-bit comparison of the file with a backup. They won't match. I can promise you that, on that same stack of vintage floppies!

 

@Keatah Thaks for the links. I was unaware of the problems with HDD Regerator/SpinRite.

 

Let's continue the discussion, still in layman's terms, by using practical examples.

Yes. It does repair the sector. And I am not doubting you fixed unbootable disks and made data accessible again.. using this stuff..

All this works very similar to the drive mfg's zeroing test does. If it can't, then it gets remapped. All depends on the drive, the firmware, the utility.. How the whole package fits together. You know.. These utilities claim to re-read the sector several times taking an average and interpolating the missing information. That could work in some niche situations. But most "sector problems" are usually a couple 5 or 10 sectors in consecutive order. And that's too much to handle.

It is important understand why the sector went bad. If the drive loses power unexpectedly, then there you go. Reformat that sector and carry on. If the head was retracted in emergency shutdown, then ok. Reformat the sector and move on.

If the surface was damaged, forget it. If the mechatronics are out of tolerance or failing, forget it. HDDRegen, SpinRite, and DRevitalize will just wear out the disk prematurely and make recovery by a professional (which you needed from the get-go) much more difficult or impossible.

If the surface and/or head is damaged just the right way, these utilities can blindly drag it across every single track and make you a new LP! Or they'll overstress failing electronics to point where it will now cost a ton of money to get them replaced by a pro.

But mis-written sectors? Improperly written sectors due to a glitch or blast of static? No problem.. And that is what these tools are for. Making sure the sectors are readable and writable. And all it takes is one sector anywhere on the disk to make it seem like it's giving up the ghost and taking all your data to the grave.

If you are medically inclined, think of it as removing a wart on a pro model's eyelid. And eventually the body will need to do repair work and replace the skin without a scar. Well, these utilities leave a scar, a blight upon your data.

By the way, not all data types succumb equally to the fake recovery by HDDRegenerator, SpinRite, or DRevitalize. The file make have some "dead spots" or unimportant areas in it from the get go. Areas that are not important. Think padding at the end.

Another favorable situation is the "busy area" in a BMP or other non-compressed image. A couple of out-of-place pixels will never be noticed if it's a picture of people at a carnival or a party. You can put anything in there and it'll be alright. There might be a pink pixel in an orange candle in one of the 50 photos you took of the same cake. Ooops! Maybe we'll notice it with a forensic analysis and can fix it in Photoshop!

In a text file, you may lose a few lines of text, no big deal, you can read it and fill in what you think should be there.

In a video file you might see some "digital" static or a dropped frame or partly decoded frame or area.

In an audio file it may stop playing at that area, or make a tick or chirp sound. There may even be a fraction of a second silence.

Maybe it belongs to a .DLL or resource file, it could show as a corrupt graphic or non-functioning button.

In your browser, every function except one specific feature may work. A simple re-install of the browser should clear it up.

Heck, it could even be in one of those KB update archives. Never used. But if the head traverses it on its way to get to other data, BAM! Error! Error! Error! Maybe it's on the same physical track as something you need to get to. When the head settles in, that corrupt sector puts a stop to the party. Thus the file you ARE TRYING to read may not always read, sometimes yes, sometimes no. The culprit is just close by. Still needs fixing. Like a huge pothole on the way to your destination. All depends on the drive's programming and how it tracks where the head is..

Or maybe you got lucky and it's an un-used sector or maybe the repaired sector belongs to an out of date cache or temp file. Just refresh the page and you're on your way. Same thing with a window's log file. It just gets re-written, provided the sector was made writable again via the repair! It usually is. Best of all maybe the repaired sector was part of something in the recycling bin!

Now for the more serious and insidious problems.

In a JPG, it'd be deadly. Half the picture may not decode. The next pixel depends on the previous. So to speak.

In your spreadsheet, well, you'd loose formatting or get a few columns out of place. What if it mis-places a decimal point? Or a couple of numbers get scrambled? It all depends.

A .ZIP or .RAR file? Forget it, unless you put in a recovery record, you ain't gett'n'nuthin' back.

If a file header gets scrambled, a .PDF won't be recognized as a .PDF. There are tools to fix such issues.

If it's a program executable, anything can happen from a benign safe exit or BSOD, to the program overwriting other things on the disk. Maybe it would mis-compute the trajectory of a spacecraft, or cause a targeting system to out of spec. Maybe an automated tool would be imprecise or worse, do damage to itself or the workpiece. Maybe your system won't copy files over a certain size, or of a specific size anymore. Maybe the directory and $MFT are corrupted and now you can't get at some obscure file 6 months down the road. The possibilities are as numerous as there are uses for computers!

 

The key points to keep in mind when using one of those three programs:

1- If your drive has hundreds of bad sectors and count is increasing, forget it.. You've got a bad disk. You need to consider other actions.

2- Do not expect these to do miracle data recovery. Despite all the hype on their homepages, they will not. Not as a pro-level service would. These merely repair a bad sector that's clogging up the firmware. And stuck firmware makes the whole disk look bad. It can slow down your USB ports, and make the system run sluggish. The disk will also disconnect from time to time, and reconnect. This is evidenced by the USB insert/remove double bong sound.

3- When scanning a suspect disk with one of these. You should only see tiny amount of errors, maybe 3 or 4 or something small like that. Better if you see no errors! And when these programs encounter an error, they will fix it in one or two tries. Anything more and you've got a whole different problem.

4- Any file that utilizes the repaired sector is to be considered suspect. Who knows what was supposed to be there?

5- If a "weak" sector happens to be used by a $Metafile or other disk structure mechanisms, there could be more corruption. You might need to rebuild parts of the filesystem. A job for pro-level work and certainly different tools.

6- When you find a bad sector, it is important to record it with pencil and paper. Then look up what file made use of that sector and consider it corrupt. Maybe you get lucky and the sector isn't in use, or it hosts a file in the recycle bin! Some filetypes are more tolerant to internal errors. A .BMP might have a few pixels out of place or the wrong shade of color. A video file might have glitch of static or pop in the audio. Still quite usable I'd say. But the .XLS spreadsheet for spacecraft course corrections and astronomical ephemerides isn't going to be working. Neither is a compressed archive, like .zip or .rar. You need to research and examine the file and make that determination. You need to do that for each affected sector. If you've got hundreds of sectors going out, you're screwed.

Now, you can begin to get an idea of when these programs are useful.

I have personally saved several disks (but not always the data) that fell victim to power issues and improper shutdowns.

1- verify the cause of failure, an observed brownout in action or powerloss during write.
2- scan the disk for errors. write down each sector number.
3- decide to either zero the whole shebang with the mfg utility tool (destroying all data permanently), or do a surgical strike and bomb specific individual sectors with these tools (HDDRegen, SpinRite, or DRevitalize).
4- if you are going to re-do the entire disk.. Do it and you're done. Your disk is now permanently erased and ready to use fresh out of the box. All your data will be gone. If you go the format "individual and select sectors" route you need to refer to the list look up each bad sector and what file it belongs to. These files are no longer valid and will need to be repaired by hand or replaced from a backup.

ENDNOTE:
Oh one more funny thing.. People do indeed try these programs on dropped disks. Or on disks with genuine mechatronic faults. And they let them run for hours, grinding away.. wearing things out.. Overheating marginal components.. And dropped disks are a gonner as far as I'm concerned. No consumer-style mom'n'pop software is going to fix them.

 

With many newer drives, as a sector is read, it is checked for errors and signal strengths. The drive's firmware will handle this all by itself in the background. And if a sector begins getting weak the firmware will see that and reformat or reallocate, with no data loss. If the sector is damaged (remember it's all analog) too much then you need to kick the firmware in the ass a little. That's what these programs do.

The electronics today are significantly different from the SpinRite days when you had thermal expansions causing mis-alignments and head positioners based on discrete stepper motors. Today that is handled in the background. By design, the modern disk's head fine positions itself and thus track shifting isn't a problem.

One other closing comment.
An improperly formatted sector can be fixed instantly by these programs. If they get hung up at any one position for more than a few seconds then they will never ever ever fix that sector. No point in beating on your drive. It won't work. And you'll make things worse for the professional, or make it impossible..

 

@Keatah Thanks, that was very informative.

 

Hi, just a question : how to identifiy which file occupies a given sector that turns out to be defective ? I use to know a tool to to this but can't recall its name. Thanks.

 

Excuse me but 2012 is not 10 years by my scientific calculations, ONce again Look at the video ok?

In early January of 2012, Steve explained the essentials of SpinRite's operation and hard drive trouble during a question and answer podcast. The edited video below explains how SpinRite is able to recover data, repair & maintain hard disk drive (and even solid state flash drives!):


https://www.grc.com/sr/whatitdoes.htm

It still appears to me none have looked at the video!!! :-(

 

For a straightforward and easy solution, try nfi.exe from the command line.

To get filename from a logical sector number use:
nfi c X
To get filename from a physical sector number use:
nfi \device\harddisk0\dr0 X

..where X = sector number reported by your scanner! You will then get the filename and sector range belonging to that file. You'll also get the full pathname and file number. Useful if you have multiple files by the same name in different folders.

Please remain cognizant of the units/offset. If your surface verification tool reports in "logical" form, then, naturally, look it up using nfi c X.

So in essence, you scan the disk, make a list of faulty sectors, look up the filenames, and consider those files damaged. Repair/reformat the sectors, then replace the files.

 

Thanks. On my Windows 8.1 system, there is no nfi.exe anywhere.

 

You can try and see about getting it from ms.

 

nfi.exe isn't in Win10 either.

TeraByte Unlimited has findlbaf.exe

ftp://terabyteunlimited.com/

 

Thanks to you both !

 

MerleOne, I think you have IFW. Run a backup with the /logl:10 switch. The IFW log will list the LBAs of your bad sectors.

 

Thanks ! I have also downloaded the dedicated tool from IFW ftp (long time since I last used ftp...).

 

Has anyone tried this free for a short time product?

http://sharewareonsale.com/s/hard-disk-sentinel-standard-sale

Terms and Conditions

• This is a 1-computer lifetime license, for noncommercial use. Want commercial use? Then get Hard Disk Sentinel Professional with free lifetime upgrades
• No free updates; if you update the program, it may turn into a trial. Want free updates? Then get Hard Disk Sentinel Professional with free lifetime upgrades
• No free tech support. Want free tech support? Then get Hard Disk Sentinel Professional with free lifetime upgrades
• Must be downloaded and installed before this offer is over; you cannot install / reinstall later, such as if your computer crashes. Want to install / reinstall at any time? Then get Hard Disk Sentinel Professional with free lifetime upgrades
• May not be resold

Technical Details

• Developed by H.D.S. Hungary
• Version is v4.50
  • Note the latest version of Hard Disk Sentinel Professional is v4.60. Want latest version? Then get Hard Disk Sentinel Professional with free lifetime upgrades
• Download size is 14.9 MB
• Supports Windows XP, Vista, 7, 8, and 10 (32-bit and 64-bit)

Hard Disk Sentinel Professional is a hard drive and SSD health, temperature and performance monitoring program. Hard Disk Sentinel Professional has integrated backup and disk repairing functions and is designed to monitor hard drive and SSD health, predict hard drive and SSD failure, fix hard drive and SSD problems, improve hard drive and SSD performance degradations, and prevent data loss.


Sale ends in 1 day 9 hrs or until sold out

 

@boredog I have installed it on two laptops and it is excellent. I was using a slightly older version (which I also got as a giveaway - I get all my software as giveaways) and have just upgraded to this newer version.

It gives more detailed and informative information about a drive than CrystalDiskInfo (which I used to use) does.

 

Just google search nfi.exe and it will list the .zip from ms..

https://support.microsoft.com/en-us/kb/253066
http://waynes-world-it.blogspot.com/2008/03/viewing-ntfs-information-with-nfi-and.html

 

Great, thanks !