Hard drive failure about to happen?

It would seem that my data drive is starting to develop bad sectors. I installed a trial version of HDTune Pro 4.60 earlier today after noticing a problem. See screenshot.

First it was just "Current Pending Sector Count" and after, then running Western Digital Digital "Data Lifeguard Diagnostic for Windows" which gave the OK ...see second screenshot.

A subsequent reboot, is showing that the problem is unfixed. It is now showing "Uncorrectable Sector Count", also. See last screenshot.

Is there anything I do can to locate the bad sectors and remove them,... there are 3 only?

 

You don't remove bad sectors. A bad sector is bad and needs to be marked as such so that it is not used to store data. It is normal for drives to have a few bad sectors, but they should be marked at the factory so they are never used. If your drive is developing more bad sectors, it is a sure sign it is time to backup all your data and start shopping for a new drive.

You can do low level formats with programs like Spinrite and that may delay the inevitable, but a drive that keeps creating bad sectors is failing.

 

Hi,

Spinrite is a good program.

When I encounter bad sectors I usually wipe my hdd then load the data again.

Some good read here:

http://www.bleepingcomputer.com/forums/topic335221.html

 

I don't know about vista/7, but in XP/2k, you had the option on install to do what was called a "full format" or a "quick format". I have read and been told that a "full format" maps out the bad areas so that they are not used, and a "quick format" did not do this. I was told for sensitive info on servers etc, to ALWAYS do a "full format".

If the drive is continuing to develop bad sectors, I would replace it. If it is not, then a reformat might be the only option. SpinRite works, I have used it. So does MHDD (I think that is the name of it) to a degree, if you can decipher how to use it.

Anyone know "for certain" if those formatting differences are how I explained? And what does vista/7 do? There is no option for a "full format" and how quickly it formats drives, it is nothing compared to XP/2k on "full format", more like "quick format", or even faster.

Sul.

 

Those are the primary differences but a full is not just for sensitive information on servers. Even on PCs you should always use full unless you know for certain the hard drive is good and has already been formatted. You cannot use quick on an unformatted drive.

Neither a full or quick will check previously marked sectors to see if still bad. And a format will not prevent a sector from going bad. And finally, a common misconception is thinking a format of any kind will delete, erase, cover up, or "wipe" any previously saved data. The data is still there and can be recovered with readily available recovery software.

 

It can be assumed then that once a sector is marked as being "bad" it is more or less permanent then? What would the best method be to check for "new" bad sectors and mark them? Is it possible (without spinrite) to do so without losing data?

Right, format only maps the bad sectors so data won't be written there, which does prevent data from being written to a bad area, so one might consider it will prevent data loss, to a degree.

Do programs that raise/lower every bit (read/write - 0/1) actually destroy data so that forensics can no longer retrieve it?

Sul.

 

The diagnostics from your drive maker probably will. But running chkdsk /r will too. Note a /f will not locate bad sectors. And you can do this from within Windows with Error Checking and both options selected. Note it will not actually recover a bad sector as the option title implies. It will check and if the sector was incorrectly marked bad, it will recover it.

A format's primary goal is to prepare the disk for data storage by laying down the tracks on a blank drive and to create the file tables. If it happens to find a bad sector in the process, it will mark that sector in the tables as bad.

Well that's a stretch. Putting a lock on the refrigerator door will keep you from putting milk in the refrigerator, but will it keep the milk from going sour?

 

Well I always heard if the Gutmann method is used for wiping drives it would stop the data from being recovered from forsenics but I think that only applied to older hard drives. I read with new hard drives (mainly SATA) just some random data with a few passes should be enough.

 

No not true. It has always been that just a few passes is enough in the vast majority of cases. In fact, just one pass will rearrange every particle preventing most recovery programs from determining what was there, thus preventing the accidental discovery of previously saved data. So in reality, if you want to give away a drive or computer, deleting everything off the disk, then filling it up with music files, then deleting everything again will likely be good enough. And as soon as the new user begins using the disk again, recovery becomes even less likely.

That said, if there is a chance a professional badguy (or well funded law enforcement agencies) with very sophisticated (and expensive) forensic recovery hardware and software is able to get a hold of your disk and there was something on it you don't want discovered, using a "wipe" program like DBAN, or my favorite, Eraser, would still be a wise precaution. But note in those cases, the drive's own read/write heads are inadequate and the drives are disassembled and the platters read individually in very sophisticated specialized equipment in an attempt to read and "residual" magnetic orientations of the particles. This is why data recovery services, should you accidentally format your drive or delete something important can cost $1000s, and why only a dedicated, well funded badguy would still be a threat. So unless you are specifically a target of bad guys, you don't have to go to extremes.

 

Thank you, Bill for your response to my post.

I have done a scan with HDD Regenerator v2011. It seems Ok. See screenshots.

Also, I have been googling and found that when there is a bad sector, it is either physical or logical.

Apparently, logical bad sector errors can be fixed. See this recent topic I found - How to Repair/Fix 'LOGICAL BAD SECTORS' of HDDs > http://www.techenclave.com/storage-solutions/how-repair-fix-logical-bad-sectors-178073.html

How does one tell the difference between physical and logical errors? Is there a program one can use to find out?

 

A physical bad sector is caused by an impurity or imperfection in the platter. It cannot be fixed. A logical bad sector is marked bad because the low level formatting at the factory could not format the sector for some reason. If another program, such as Spinrite is used, and is given time (time the factory does not want to use) and is able low level format the sector, it may be recovered. Note the factory is willing to spend just a few minutes per drive. Spinrite will spin hours or longer, if you allow.

 

I will have to disagree with you. I was able to recover data (using some recovery software) from a few text files after running a few passes on a drive before. Although it might not have been a full recovery but parts of the data in the text files were still visible and recognizable after recovery. This was on an older IDE HDD.

 

lol, using that analogy, it would be:

To keep from souring the milk, follow the map the to refers that work. But always use an updated map, because if you use an old one, some refers it said were OK are no longer working. Thus you don't spoil the milk by knowing which refers to ignore

Sul.

 

Please go back and note what I said! I said, a few passes is enough in the "vast majority of cases". I did not say all cases. And I said, a single pass is enough to prevent "accidental discovery of previously saved data". I did not say it will prevent discovery from a determined effort.

But to your claim, a few passes with what? It could not have been a true "wipe" program. And with what recovery program?

Understand that data is written to a drive by aligning the magnetic particles into what is basically a North and South, or East and West orientation representing 1s and 0s. When you write to a sector, you change the orientation of the particles in that sector. When using the drive's own head and on-board controller (which all but specialized forensic recovery equipment does) to read the sector, it will only pick up the strongest magnetic fields, representing the most recent write. In order to recover data from a sector that was overwritten, even once, you have to disassemble the drive, bypass the drive's own controller board and use a specialized "forensic" controller to read the extremely tiny residual magnetism found "under" the currently saved data in the sectors and you have to have a program that can isolate that minute information. And in extreme cases, you have to disassemble the platter stack and mount the platters into special equipment with specialized heads. So once again, this is using professional recovery services to [hopefully] recover accidently deleted/formatted drives can cost $1000 - it takes highly trained people using very specialized and expensive equipment - not something you likely have on your shelf.

Therefore, if a true "wipe" program was used, it is programmed to hit every sector and not skip a single one. And typical file recovery (not "forensic" recovery) programs use the motherboard's IDE or SATA controllers, the drive's own controller board, and the drive's own read/write heads to bypass the MFT and FAT (for older drives) to read and access data directly. Recovery programs do NOT read underlying residual magnetism. So I'm sorry, but I find it hard to believe you were able to recover any previously saved data, especially after "few" passes, IF it was wiped with a true wipe program, unless you have access to very expensive forensic recovery equipment.

 

If anyone needs a file or drive wipe program then you can still get "SafeErase 4" for free .
Register for key here.
32 Bit version download here.
64 Bit version download here.
Long explanation here...

@ "Tarnak"
I knows that some of the guys around here will come down on me like a ton of bricks for writing this , however my opinion is that if your drive is starting to fail then please exchange it with another at first opportunity.
Also , in my experience , I have run manufacturers diagnostic tool on a drive that I suspected to be failing and the tool didn't find a thing wrong with the drive , but a few months later the drive was a gonner....
When you start to get bad sectors it is in general impossible to predict the decay rate of the drive or if it will start to fail sooner rather than later.
However , if one starts to get bad sectors on a drive , I think that one might as well save one self some potential trouble and swap it with another as soon as possible...

 

I would agree. When I have a drive that is giving issues, it no longer is used to hold important data. I use them for my kids computers to game on and stuff like that until they give up, or I send them in if they can be RMA'd. But I don't personally trust any drive that has been Remanufactured. Had too many that I trusted that did not last like they should.

My motto is if it is important, it had better be on flash, optical or "newish" drives in a mirrored raid array. If it isn't on one of those, then to me it isn't safe. All depends on how critical your data is to you.

Sul.

 

Not if the advice is sound.

@Tarnak - As noted in my first thread of this post, I said, "If your drive is developing more bad sectors, it is a sure sign it is time to backup all your data and start shopping for a new drive.". So now both Fiat_Lux and Sully have recommended the same thing. If you don't replace it now, on your time, it will surely fail at the worst possible moment (Murphy's Law).

 

With hard drive prices as low as they currently are, I see no reason why you should delay any longer transferring your data to a new HDD.

According to the screenshots, you already have a 320GB drive ("F") that appears to be empty.
While you are able, move the data to it and then search for a replacement drive.

 

...or it could keep on going for a lot longer as there has been no further increase in the number of bad sectors. Also, the drive is making no unusual sounds, etc.

I could reformat the empty drive [E:,F:], and copy the all the data to this drive, and rename it H:, I guess.

However, after running HDD Regenerator, and posting the results, I then got this balloon. So, a complication or not?

Also, I have FD-ISR running several snapshots on C:, and H: (My Data) is anchored to each snapshot.

 

As I see it, the major problem you have is not enough icons in the system tray.

 

Note I said, "If your drive is developing more bad sectors..."

But to your point, you are right, this could have been a "glitch" - perhaps caused by a sudden power failure (get a good UPS with AVR) or the drive was bumped at the wrong time and perhaps it will give you years of error free service. But perhaps not. The issue then becomes how much you wish to trust this drive to protect your data. For some, the data is of little concern. For others, including me, the loss of my data is worth many times more than the cost of a whole new computer. I keep current backups but should my main drive fail, it will still amount to substantial downtime until I have everything fully restored. That lost time means lost productivity and when unscheduled, it can be very disruptive. I would much rather replace the drive at my time of choosing rather than rolling the dice, crossing my fingers, and pray all goes well. I mean when you can get a 1.5 Tb Drive for $60, why risk it?

As for that same ATA channel "issue", note it is not an error. It just means you have two HDs on the same IDE cable. You typically get better drive performance if you put a single HD per cable, putting any optical as the Slave. Since IDE (same as ATA) is phasing out, many motherboards only have 1 IDE connection so you may not have a choice. In any event, this has nothing to do with bad sectors.

 

I think I will just get a drive and enclosure which I can plug into an eSATA port of my computer, and transfer/copy the data over and then backup periodically, using Karen's Replicator or something similar.

I have a Corsair HX520W, which has been running since September 2007. See my post > Thermaltake power supply https://www.wilderssecurity.com/showpost.php?p=1647886&postcount=8

When you say that C: E: F: are on the same cable, does that mean H: is on another cable. Maybe a dumb question, but hardware and how things are connected inside the case are a mystery to me, and that is why I had my system custom built, and hopefully to last for at least 5 years before upgrading to a new system.

I like some colour in my system tray.

 

Probably. Note that only IDE cables support two devices. Each SATA drive will always be on its own cable. But partitions can cause confusion (for humans) with drive letter assignments. If you partition your hard drive into 3 partitions, you may have, for example, C:, D, and E: on the same drive.

 

Yes, wtsinnc. That's his or her problem lol I'm surprised this machine is running at all with so many real-time apps running at the same time lol

 

I had a pre-assembled pc before with a Hitachi sata hdd that was diagnosed with bad sectors by checkdisk. I used Hitachi's diagnostic software (Hitachi Drive Fitness test) and said there was nothing wrong with the drive. Third party diagnostics all said it had bad sectors (HDDTune, Spinrite, even Seatools of Seagate!)...

In Seatools i have also experienced other third party diagnostics telling me that the drive failed but yeah it passed Seatools. Don't trust your manufacturer's diagnostic. Use them but do second opinion checks.

But bear in mind, it has defects and it will eventually die so change it or RMA it.