Will SpinRite become relevant again?

Discussion in 'backup, imaging & disk mgmt' started by Keatah, Jun 3, 2013.

  1. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    943
    I've found SpinRite to be in the same category as HDD Regenerator and Drevitalize.

    I use these programs when I know for a fact that a disk has been powered down incorrectly, and has a partly (or incorrectly) written sector due to sagging voltage levels. IMHO, It is in this situation where these programs shine.

    I would never trust data from the "recovered" sector, however, and make note of the file residing there for future reference.

    These programs are good for the layperson in that they can stop firmware hangups that occur due to ONE SINGLE bad sector. Again, this is where they shine!

    Did that make sense?
     
  2. claykin

    claykin Registered Member

    Joined:
    Sep 30, 2007
    Posts:
    132
    I'm not following.

    Spinrite has no ability to fix bad data on "a partly (or incorrectly) written sector due to sagging voltage levels". A sector contains the header, data and ECC code. If any of the data is "incorrectly written" it will be moved off and still be incorrectly written (unreadable).

    Where Spinrite shines is on disks that have damaged sectors. Spinrite hammers away at those sectors and reads and moves whatever it can. Note, sectors are rarely 100% full as they are in 512byte or 4Kb chunks so even when Spinrite cannot read a complete sector there's still a decent chance at least that it got all the relevant data.

    And, I have used Spinrite on last leg harddisks MANY times and made them readable again to the point where I was able to copy off user data. Certainly better than spending $$$$ on data recovery services.

    Feel free to use it however you wish, but I've used Spinrite on many disks with great success and very few non successes. And not just me, I know others in corporate IT who have used it countless times with great success.

    While HDD Regenerator is OK, its never worked as well as Spinrite for me.

    My 2 cents.
     
  3. roger_m

    roger_m Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    6,707
    I'm not saying it's not a good program.

    The story seems very believable to me. However I am looking forward to the new release, and it really doesn't bother me who actually will be doing the coding.
     
    Last edited: Sep 23, 2013
  4. roger_m

    roger_m Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    6,707
    I've never heard of Drevitalize before and am going to take a look at it tonight.
     
  5. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    943

    That's just it! Spinrite and competitors will not fix the mis-written data. What they do fix is the mis-written signal on the disk itself. OR they trigger the firmware to do it.

    I've "fixed" many disks with spinrite and co where power was knowingly interrupted. A sector was not fully written. And in subsequent reads, the firmware would encounter the faulty sector and throw the disk off-line.

    Using spinrite (and competitor's products all the same) either re-wrote the sector or triggered the firmware to do so. And all was well again. I've kept an informal log of all this activity, and all the fixed disks are still in service today.

    It is important to remember that HDD data is 100% analog in nature and the waveform looks like a sine wave. Not the square wave you're accustomed to seeing representing digital data.

    Understand that when a disk loses power, not all drives stop writing at the end of a sector and wrap things up nicely. Some may stop writing midway through a "bit-transition" leaving a weak signal in a sector. A weak signal that the firmware has no idea what to do with. That's the hangup I'm talking about. It is here, at this point, I say again, that these 3 programs do their magic.

    Sorry we're home from a vodka party and maybe tomorrow I can explain things more concisely.
     
  6. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    943
    Just clarify for me, what do you consider to be a damaged sector, how did it get that way, and what does the magnetic signal look like as it is being read back?

    Be aware that a sector can not ever be considered full or empty. It just is. 512 bytes, all of those 512 byte are read by the drive and presented to the file system. It is up to the OS whether 38 or 67 or 91 or how many bytes are used and considered valid.

    For simplicity sake let's say I make a text file that says. "Apple II computers rock!" Ok, this is going to fit in one sector. It will consume 24 bytes of that sector. 24 bytes will be stored. 512-24=488, and these 488 remaining bytes will be written as null or "." or zeros.

    That is how the file system sees it.

    The disk heads and platter see it quite differently. The data is encoded in a way to ensure that there are no long consecutive hi's or lo's and that there is always a transistion to follow. Too many hi or lo signals in series can cause readback trouble, so the signal is encoded. Not encrypted, but merely encoded.

    There's never such thing as half-a-sector being written or filled.
    I'm pooped! here some great reading for all to enjoy!

    https://www.grc.com/sranalysis.htm
    http://hddscan.com/doc/HDD_Tracks_and_Zones.html
    http://hddscan.com/doc/HDD_from_inside.html
    http://www.tomshardware.com/reviews/hard-drive-magnetic-storage-hdd,3005-5.html
    http://www.guzik.com/solutions_chapter9.asp

    Hopefully these links will help illustrate in some small fashion that mechanical disk drives are multidisciplinary devices of extraordinary complexity. They do a lot of work for each and every bit they save & recall. Amazing stuff!
     
    Last edited: Sep 24, 2013
  7. claykin

    claykin Registered Member

    Joined:
    Sep 30, 2007
    Posts:
    132
    physical platter damage is one possibility.

    As I said in my last post, your 24 bytes can be successfully copied off a damaged sector while all, some or none of the remaining 488 bytes are copied. A sector with filled zero's is much the same (conceptually) as an unfilled sector.
     
  8. claykin

    claykin Registered Member

    Joined:
    Sep 30, 2007
    Posts:
    132
    Depending on the number of correctable/uncorrectable sectors on a given disk, along with analysis of the SMART data, and finally my ear listening for tell tale mechanical problems, I then decide whether the disk is safe to leave in service. More often than not, I use a replacement. Disks are cheap and people want to avoid downtime. Telling them later you left the old fixed disk in use is a recipe for an upset customer.

    Your mileage may vary.
     
  9. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    943
    I get a little hesitant when spinrite wants to fly the head over the same area for anything more than a fraction of a second. You could be causing head damage or be setting up a near-term head crash. Maybe just wasting time. Many variables here.

    In many of the cases where I used these utilities, they either worked right away, or not at all. In the not at all situation I switch to other methods and avoid beating on the disk.
     
  10. NGRhodes

    NGRhodes Registered Member

    Joined:
    Jun 23, 2003
    Posts:
    2,359
    Location:
    .
    The fact that works on flash drives and HDDs which are very different at a hardware level proves that Spinrite is only using standard ATA commands (never looked if spinrite works with SCSI).
    Its a trivial program (wrapped up in lots of peusdo-scientific marketing claims) that reads and writes data sometimes multiple times, marks bad sectors good in the hope the hardware error correction of the drive will fix/recover things.

    Any tool that tries to mark bad sectors good is only useful for last ditch recovery attempts. How do you know which sectors were marked bad at manufacture (and will never contain useful data) and which have already been remapped to spares ?

    Various claims of Gibson's including spinrite claims have all been debunked thoroughly in the past.

    His claim of a WMF backdoor debunked http://web.archive.org/web/20070223...chive/2006/01/18/inside-the-wmf-backdoor.aspx

    And here is someone from a drive manufacturer debunking Steve Gibson:
    http://groups.google.com/forum/?hl=en#!original/comp.dcom.xdsl/Vm2xVSu6prk/jpfCIyPj7poJ

    IMHO he is a spreader of FUD.

    Cheers, Nick
     
  11. roger_m

    roger_m Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    6,707
    When fixing SSDs it is run at a scan only level, and the actual drive itself makes the fixes when it sees the sector is bad.

    This is not exactly the case - it will reread a bad sector many time in an attempt to read all of the data, and will only stop when it has been able to read all of the sector's data, or failing that if it has tried many times. From memory I think it may be 1,000 tries to read a bad sector, but this can be reduced with a command line argument. HDD Regenerator tries less times to read bad data which is why it is faster. As SpinRite is scanning a bad sector it actually shows you how it going with recovering the data.

    True, but SpinRite does work and can be helpful in some cases. For example I've had drives where Windows has severe problems due to hard drive errors, and after running SpinRite on the drive, Windows has run fine.

    Obviously at this point it is best to clone the drive to a brand new one, and ditch the old one.

    No argument from me there, and the link I posted earlier in this thread provides good examples of this.
     
  12. claykin

    claykin Registered Member

    Joined:
    Sep 30, 2007
    Posts:
    132
  13. NGRhodes

    NGRhodes Registered Member

    Joined:
    Jun 23, 2003
    Posts:
    2,359
    Location:
    .
  14. count011

    count011 Registered Member

    Joined:
    Nov 7, 2013
    Posts:
    1
    As a follow up to this random thread. I've read through this thread and looked through the referenced threads and articles. I would by no means call myself an Steve Gibson fan, to the extent that I listen to SN, and I find him a seemingly likable man.

    Besides the fact that a lot of this stuff is ancient history, and a lot of people thought a lot of things about certain technology that turned out to be wrong...
    Some of the hearsay that is being cited is seems pretty ridiculous. I don't know if I believe that Steve was part of McAfee's grand orchestra anymore than I believe that our government exists for the people.

    Concerning this particular product mentioned in the subject of this thread and it's coding: Spinrite works, in it's current incarnation. I don't believe it does magic. It purportedly works even better in it's current builds and revisions going forward. That sounds great. At least not everyone in the consumer tech world has abandoned the PC...
    I also think it's highly illogical to look at GRC.com and listen to SecurityNow and watch @SGGRC and so on and so forth, and to make the leap that the person doing all of this just putting up a front. With all the time I've spent passively listening to Steve Gibson's mundane affairs, I can't imagine someone less insincere. He's legit. Maybe just a legit goofball, computer geek. Maybe that's the greatest trick of them all... Maybe he really spends several hours a day just trying to appear as nerdy as possible and make that modest living and continue his enthusiasm for computer systems, all so he can hide the fact that he can't program? Those Wicked Letters were of significant amusement in so much as they supposedly "Proved" that Steve was a con artist, while simultaneously revealing how much background and depth he was able to conjure up for a silly email exchange(considering he can't program even a single language!). Subsequently ripping "Mike" a new hole and dancing on his face.

    Through Security Now podcasts alone, I've stayed abreast or ahead of a lot of security and technical topics. He and the previously mentioned Mark Russinovich have talked together and don't seem to share the perceived gap in respect of eachother's works that people on the internet have uncovered.

    I for one, don't give a **** if all this primo computer network and security **** is from the tooth fairy. I, however, will say thank you when it's shoved under my pillow for free from someone who manages to stay relevant in the conversation at large.
     
  15. deltazulu

    deltazulu Registered Member

    Joined:
    Nov 27, 2013
    Posts:
    2
    Location:
    Netherlands
    I stumbled upon this thread while searching for an alternative to Spinrite because I am running into the current limitations of version 6.0 (like many of you do). I learned a lot while reading almost the entire thread, so thanks everyone.

    As a result I checked out HDD regenerator today. However it doesn'n seem to compete with Spinrite because it does not seem to write every sector of the hdd like Spinrite does. As a result it is much much faster. It will discover bad sectors while trying to read the entire hdd and also trying to recover the data from it. However it will not discover weak sectors by vigorously writing to and reading from it. Spinrite is really thorough in that aspect.

    So for hdd's that I cannot test with Spinrite, I will use HDD regenerator and after that still use some other software that writes and reads every sector (without destroying the data). (Any suggestions? I presume that most surface scan software only read, not write, am I right? Including chkdsk? HD Tune?)

    I am curious to hear from you guys (and girls) whether you endorse or debunk my supposition and conclusions. All in the name of flawless harddrives and accompanying happy family and friends of course... :D
     
  16. roger_m

    roger_m Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    6,707
    HDD Regenerator can be significantly faster working on damaged hard drives than SpinRite because SpinRite by default tries a lot more times to read damaged data.
     
  17. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    943
    -http://www.piotrkn22.republika.pl/drev/index.html-

    I know that Drevitalize can do an in-depth read-write test, it is destructive. Drevitalize is very much similar to HDDregenerator. The differences are in the user interface mostly.

    It's amusing to note that the website claims it can operate on disks physically damaged by a drop! Thus encouraging noobs to grind the disk even more. No doubt. Anyone who knows anything about disks will understand when a disk is dropped, a head-crash usually happens. Game over unless you get pro-level service.

    Look, these types of utilities (HDDregenerator, SpinRite, Drevitalize) can only operate on sectors that are weak or invalid due to uneven magnetic surface density. Sectors improperly written due to power failure are also candidates for repair by these utilities. Using a spray paint analogy - areas that are too thin or too thick or slightly off color - thus appearing mottled and faded. Areas where the spray gun didn't spray sufficient paint. These utilities go over and even out the spots, guessing what color (data) should be there based on the surrounding magnetic fields.

    Sometimes these utilities work because the firmware in modern HDD still gets "hung-up" when encountering weak sectors (uneven paint). Much like a damaged roadway. Repair the roadway and continue on. Except that new material is slightly different than the original texture. The new material (re-written) data bits are not likely to be the same as what was originally there. It's just that firmware doesn't lock-up anymore. It doesn't care what's there as long as it's in the right format. Understand that one file may be damaged beyond usability, but the lock-up-free disk can now be used again. Got that?

    I strongly suggest that any files that have repaired sectors in them be verified. This means recording what sectors were bad, then looking to see what files made use of those sectors. Then verifying those files. If it's .BMP image, a single pixel might be the wrong shade of green. If it's a compressed and encrypted archive forget it. If it's a .jpeg you'll see the classic banding artifact. A text file might have a single spelling error. An executable won't work correctly. A movie file may not decode at all, or it may have a tiny spec of dust in one single frame. An .mp3 file may have a tiny 'tick' or squeak in it. Excel files may have a misplaced decimal! It all depends exactly what has changed and where.

    Dynastat, Regneration, Refreshing, ReWriting, all that, all that is guesswork as to what the original data was. When it fails it may put in all zeros or ones with nary a care. Thus messing up the file original contents. As long as the potholes are filled in, as long as there is pigment in the paint, the firmware says ok! But is it original? Hell no!

    One more thing, a slow sector can be caused by your system being busy with something else. A genuine weak sector usually manifests as a slow or unreadable sector because the firmware is taking too much time to run CRC and ECC and all that. Or it can't read it at all and times out. Depends on the details and functionality in the specific firmware revision.

    On another note. I once saw someone running DiskFresh from Puran, this reads and writes sectors. Mainly for refeshing. I wouldn't presume it's a serious tool for testing and it looks high-level. But it is non-destructive. They were using it in the background while doing other work. I know little else about it.
     
    Last edited by a moderator: Nov 27, 2013
  18. deltazulu

    deltazulu Registered Member

    Joined:
    Nov 27, 2013
    Posts:
    2
    Location:
    Netherlands
    As stated in my previous post, most surcace scan software only reads the hdd as far as I know. What I like about Spinrite: from level 3 and up it also WRITES every sector. It is just a more thorough test and I cannot find any alternative program that will do that.

    So I encountered also diskfresh today. I don't think that data really needs to be refreshed in modern disks. I never had any indication that data is really fading after a long time, despite stories about magnetic flux etc). Not even after many years of unuse (without power). However, I want a tool that not only reads but also writes every sector. As an alternative to Spinrite because Spinrite causes too much problems on modern hw and large disks (overflow error).

    So from now on I use some regular surcace scanner like HDD regenerator or HD tune or even dskchk. And after that I use diskfresh to make sure every sector is also written. In this way I think I can be sure that every weak / damaged sector is relocated.

    That is, until Spinrite comes up with a new version (which I doubt) or a good alternative arises.

    By the way, I absolutely agree that all these tools are useless and even counter productive on very sick or even "dying" disks! These tools are useful however to recover bad sectors due to power failures, mild mechanic shocks and so on, as explained by many others on this thread. And I also use these tools to thoroughly test any unknown hdd that I want to use in my refurbishing activities (in which case the data recovery capabilties are irrelevant).
     
  19. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    943
    Maybe with less glamour and less frivolous options than SpinRite. But they do it.

    Alternatively you can Zero Out the disk with mfg. tool then do an extended read or read/write test. You may also stuff it with files, then read them all back by copying to another HDD. I suppose that’s the poorman’s method of refreshing. In the process the firmware will decide what is weak and what should be re-allocated or re-written.

    Actually in modern drives, the firmware makes the final determination if something is weak or not. Spinrite, Drevitalize, HDDregenerator - they do not have access to information about the strength of the incoming signal from the platter/head junction.

    In a modern disk the 3 utilities simply pay attention to HOW LONG the firmware takes to read something. If the firmware is busting ass trying to read a weak sector it takes longer. The 3 utilities can force a time-out situation sooner rather than later, and ask for re-write. The firmware will try to re-write, if that fails, it will probably re-allocate from a spare pool.

    Spinrite and likenesses act as an instigator to get the firmware all riled up and paying attention. Something that would happen piecemeal on its own if you did standard everyday usage read/write activities.

    These utilities absolutely shine in all colors of the spectrum when a sector is mis-written due to power outages, improper disconnect, brownouts, or when the dog trips on the cables and kills power while you are writing a file. Yep, these mis-written sectors can cause a system lockup (due to sloppy error handling on the part of the OS and disk firmware)

    Firmware (because the drive mfg is lazy and didn’t do a good job) doesn’t always know how to handle that. And it stupidly keeps trying over and over and over again. It thinks there is a glitch, and that a simple re-read is all that’s necessary. Or it generates an internal error and keeps resetting itself - and in the meantime asks your OS to wait, wait, wait, wait..!

    By the way, invoking the Secure Erase built into every disk since around the beginning of 2000 or so will do the same thing, just destructively. You then have to rebuild or restore your prior data.

    I have said this before, but I like to mention it every chance I get. I have:
    A 200MB WD Caviar from 1992
    Several 120GB WD JB series disks last written to in 2003
    A 10MB Xebec disk for an Apple II from 1985 last written to in 1989
    I checked them sometime this past year. All disks are still retaining good data.
    1TB WD USB disk from 3 or 4 years ago, and I know certain files have not been refreshed on it - they pass MD5 test just fine.

    I have others, but not mentionable because enough time has not elapsed.
     
  20. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    943
    A practical field report about SpinRite.

    Yesterday I used SpinRite to fix a kid's computer. The computer was running slow and would occasionally freeze up. I did the requisite exam for mal-ware and found nothing.

    This computer had never really been optimized during the past 3 years, and so I'd figure I'd run UltimateDefrag on it. You know, putting all the video and picture and itunes music files out of the way and at the back of the disk. And then putting the Windows and ProgramFiles at the front. Thus minimizing head movements from chasing files all over the place

    Well, lo and behold! Around the 2GB mark there was a file, some obscure Windows file that was probably never be accessed during the normal course of operation. UltimateDefrag got stuck on it. And would freeze up consistently at that point. It took UD over 3 minutes to respond to the [X] box. Eventually it seemed to exit safely to the desktop. Remember, the whole system was sluggish and switching between applications was nearly impossible.

    I ran Crystal Disk to quickly read the S.M.A.R.T. data. The result was one Pending Sector. I ran SpinRite in read-only mode to see exactly where it the hang-up was. And then using the interactive disk map in UD I computed the exact location. Everything matched up! I now had a specific suspect sector # and a filename.

    I tried SpinRite in a level 2 mode. It returned a red , as unrecoverable. I cranked it up further to level 4. Here it appeared to force the disk to do a Reallocation operation or a re-write of the affected sector. I didn't care which. And it recovered the offending file.

    Well. I verified S.M.A.R.T. again in Crystal Disk and there was now one Reallocated Sector Count, and 0 Pending. Good. The disk's firmware apparently remapped the faulty sector.

    I re-ran UD without incident. And the system was not freezing up anymore.

    Great! SpinRite had saved the day! And the disk drive! But not all was peachy-keen as you will soon see.

    I had the fortune of having access to another identical laptop with the same software and same OS on it. I copied the file from the damaged system, the file that was using the damaged sector. And I also copied the same-named file from the good system. I ran both of them through a file-comparison program. The MD5 did not match up. Yet the files had the same sizes and names and timestamps. I checked other files of the same extension to be sure. They matched. And besides, they were read-only files. Both files should have been the same, but were not.

    So I copied the good file from the "lucky-to-have" reference system over to the just-repaired system.

    It was then that I considered the system fully repaired and ready to roll. I left it running a surface scan for the next hour. It passed. Ideally it would have been read/write/read, but available time permitted a read-only scan. Now the firmware would not get hung-up on a single sector and the disk responded quickly instead of timing out when the head randomly crossed over the magnetically corrupted area.

    So what if it's a haphazard job! It's a disposable computer. And the kid was happy to have it back. Cost $0.00

    The moral of this story is that when you run any sort of disk repair utility, especially a sector-level tool, you need to confirm that the files hosted by any "slow" or "defective" sectors are in good working order.

    SpinRite, while it saved the disk, did not save the data. This was after DynaStat was doing its gig. It is vitally important that you make written note of the damaged sectors (and files occupying those sectors) and do a CRC/MD5 against known good files. Chances are there will some flipped bits or blank replacement bytes inserted by SpinRite - thus rendering the repaired disk's data in that spot useless.

    If this file was a .JPG it would have been un-decodable. If this file was a movie it might have had a brief glitch in a frame or "tick" in the audio. You'd probably never notice it. Assuming it was an Excel, Word, or compressed .ZIP archive, you'd be SOL!

    What is disturbing to me is that SpinRite says the data is recovered when in fact it is not. It is interpolated and filled in with guesswork. Guesswork derived from how old-school disks behave. Don't get me wrong here. It's great the disk was made operational again. But not great that the user is fooled into thinking the data is intact. There needs to be a clear and concise warning sign that explains to the user in no uncertain terms that the filled-in & interpolated data generated by the recovery routine is not going to be accurate. It may have been accurate on old-school (8086-era) disks, but not modern ones.

    I had to manually compute what file and where it was in order to compile a list of files to verify by hand later on. The least a program could do is tell you what filenames it is working with and save them to a text file.

    I've ran into this situation many times before. Save disk, but not the data. It also needs to be noted that DRevitalize and HDD Regenerator operate under the same principle as SpinRite. Differently? Sure. But none of the three programs can pull data out of the air like magic...something to keep in mind when using programs of this nature.

    A full-blown forensic exam probably could have reconstructed the file correctly, but in this case it would not have been cost-effective.

    It is also important to pay attention to detail, a bit of key information was obtained a few months ago when it was commented the system was running slow and froze up. And since it's a kid's computer, expect it to be banged around. But that was not the case, the kids seemed to take care of it pretty good. But today's kids being of the smartphone generation; they have no patience for software updates and installers and expect instant on/off behavior. Thus the kid had probably held down the power button to force-kill the power and avoid a lengthy shutdown, especially during a Windows update! For the damaged file was part of an update.

    A head crash would not have damaged only one sector. Instead we'd be seeing a series of defects which would probably getting worse with time. Quickly.

    So there you have it. A real-life example of what SpinRite, HDD Regenerator, and DRevitalize can practically do.
     
  21. Keatah

    Keatah Registered Member

    Joined:
    Jan 13, 2011
    Posts:
    943
    A practical field report about SpinRite.

    Yesterday I used SpinRite to fix a kid's computer. The computer was running slow and would occasionally freeze up. I did the requisite exam for mal-ware and found nothing.

    This computer had never really been optimized during the past 3 years, and so I'd figure I'd run UltimateDefrag on it. You know, putting all the video and picture and itunes music files out of the way and at the back of the disk. And then putting the Windows and ProgramFiles at the front. Thus minimizing head movements from chasing files all over the place

    Well, lo and behold! Around the 2GB mark there was a file, some obscure Windows file that was probably never be accessed during the normal course of operation. UltimateDefrag got stuck on it. And would freeze up consistently at that point. It took UD over 3 minutes to respond to the [X] box. Eventually it seemed to exit safely to the desktop. Remember, the whole system was sluggish and switching between applications was nearly impossible.

    I ran Crystal Disk to quickly read the S.M.A.R.T. data. The result was one Pending Sector. I ran SpinRite in read-only mode to see exactly where it the hang-up was. And then using the interactive disk map in UD I computed the exact location. Everything matched up! I now had a specific suspect sector # and a filename.

    I tried SpinRite in a level 2 mode. It returned a red , as unrecoverable. I cranked it up further to level 4. Here it appeared to force the disk to do a Reallocation operation or a re-write of the affected sector. I didn't care which. And it recovered the offending file.

    Well. I verified S.M.A.R.T. again in Crystal Disk and there was now one Reallocated Sector Count, and 0 Pending. Good. The disk's firmware apparently remapped the faulty sector.

    I re-ran UD without incident. And the system was not freezing up anymore.

    Great! SpinRite had saved the day! And the disk drive! But not all was peachy-keen as you will soon see.

    I had the fortune of having access to another identical laptop with the same software and same OS on it. I copied the file from the damaged system, the file that was using the damaged sector. And I also copied the same-named file from the good system. I ran both of them through a file-comparison program. The MD5 did not match up. Yet the files had the same sizes and names and timestamps. I checked other files of the same extension to be sure. They matched. And besides, they were read-only files. Both files should have been the same, but were not.

    So I copied the good file from the "lucky-to-have" reference system over to the just-repaired system.

    It was then that I considered the system fully repaired and ready to roll. I left it running a surface scan for the next hour. It passed. Ideally it would have been read/write/read, but available time permitted a read-only scan. Now the firmware would not get hung-up on a single sector and the disk responded quickly instead of timing out when the head randomly crossed over the magnetically corrupted area.

    So what if it's a haphazard job! It's a disposable computer. And the kid was happy to have it back. Cost $0.00

    The moral of this story is that when you run any sort of disk repair utility, especially a sector-level tool, you need to confirm that the files hosted by any "slow" or "defective" sectors are in good working order.

    SpinRite, while it saved the disk, did not save the data. This was after DynaStat was doing its gig. It is vitally important that you make written note of the damaged sectors (and files occupying those sectors) and do a CRC/MD5 against known good files. Chances are there will some flipped bits or blank replacement bytes inserted by SpinRite - thus rendering the repaired disk's data in that spot useless.

    If this file was a .JPG it would have been un-decodable. If this file was a movie it might have had a brief glitch in a frame or "tick" in the audio. You'd probably never notice it. Assuming it was an Excel, Word, or compressed .ZIP archive, you'd be SOL!

    What is disturbing to me is that SpinRite says the data is recovered when in fact it is not. It is interpolated and filled in with guesswork. Guesswork derived from how old-school disks behave. Don't get me wrong here. It's great the disk was made operational again. But not great that the user is fooled into thinking the data is intact. There needs to be a clear and concise warning sign that explains to the user in no uncertain terms that the filled-in & interpolated data generated by the recovery routine is not going to be accurate. It may have been accurate on old-school (8086-era) disks, but not modern ones.

    I had to manually compute what file and where it was in order to compile a list of files to verify by hand later on. The least a program could do is tell you what filenames it is working with and save them to a text file.

    I've ran into this situation many times before. Save disk, but not the data. It also needs to be noted that DRevitalize and HDD Regenerator operate under the same principle as SpinRite. Differently? Sure. But none of the three programs can pull data out of the air like magic...something to keep in mind when using programs of this nature.

    A full-blown forensic exam probably could have reconstructed the file correctly, but in this case it would not have been cost-effective.

    It is also important to pay attention to detail, a bit of key information was obtained a few months ago when it was commented the system was running slow and froze up. And since it's a kid's computer, expect it to be banged around. But that was not the case, the kids seemed to take care of it pretty good. But today's kids being of the smartphone generation; they have no patience for software updates and installers and expect instant on/off behavior. Thus the kid had probably held down the power button to force-kill the power and avoid a lengthy shutdown, especially during a Windows update! For the damaged file was part of an update.

    A head crash would not have damaged only one sector. Instead we'd be seeing a series of defects which would probably getting worse with time. Quickly.

    So there you have it. A real-life example of what SpinRite, HDD Regenerator, and DRevitalize can actually do. They restore your disk to a usable state, one in which they don’t timeout due to bad sectors. But they don't actually fix the data accurately. At least not the times I've used it.
     
  22. theFATangel

    theFATangel Registered Member

    Joined:
    Dec 25, 2013
    Posts:
    1
    Location:
    USA
    SpinRite is relevant, somewhat, just avoid it for data recovery...

    In my limited experience with data recovery (hobbyist NOT professional), the following represents my workflow:

    1. Connect failing drive to my Mac OS X machine and immediately unmount the problematic drive using Disk Utility.

    2. Run DDRescue (can be run on Windows and UNIX variants as well as OSX and installed using Cygwin (Windows), MacPorts (OS X) or your favorite UNIX variant equivalent if you're not comfortable compiling the source) via Terminal on the problematic drive using the -n or --no-split switch (no splitting of problem sectors) to copy all EASILY readable data off the problematic drive onto another drive as quickly as possible, MINIMIZING demands upon the failing drive. I also specify writing a log file for use in 3. below.

    3. Upon completion of 2. above, I run DDRescue again using the -r n or --retries=n switch (specifying the number of retries DDRescue makes on the difficult to read sectors encountered during the initial --no-split pass and noted in the log file created in 2. above). If a drive is making dying sounds or has a significant sector error size, I use a lower number of retries on the trouble sectors, otherwise, I usually use up to 10 retries (which can take a painfully long time).

    4. If there are still errors reading sectors after 3. above, I then use Spinrite (on a PC) to "refresh" the drive prior to a final attempt at recovery using DDRescue with the -r -1 or --retries=-1 switch to continuously retry the bad sectors until the are recovered or I interrupt the program.

    If a drive doesn't mount in part 1. above, there is nothing to do that wouldn't cost a ridiculous amount of money to retrieve the lost data (having a professional company rebuild the drive in a clean room).

    If a drive doesn't die during 2. above, I've almost always recovered nearly all data off the drive and often, that which hasn't been recovered is not of consequence.

    If there are still significant trouble sectors at this point, 3. above has varying degrees of success depending on the problems with the drive. It can kill a failing drive up to and including recovering nearly all data on the trouble sectors uncovered in 2. above.

    On the rarest of occasions I have been able to get to 4. above with an operational drive that still has trouble sectors and actually recover more data from these after running Spinrite and then DDRescue again.

    What I'm driving at here is that Spinrite, in my personal toolbox, is a tourniquet (last ditch effort) in the case of data recovery. DDRescue takes what I consider to be the logically correct approach to data recovery, tread lightly and grab as much as you can while there's still time. More often than not, you'll get nearly everything back and that which you cannot retrieve is rarely data of any consequence (often operating system files that no one misses and are replaced when reinstalling the replacement OS).

    I do use Spinrite as much as possible on brand new drives and to "recondition" and "tune up" my older hard drives regularly (yearly). If a new drive survives a Spinrite level 5 scan and turns up no trouble sectors, I am quite confident of it's robustness and readiness to house my most important data. I have found that in the ballpark of half the new drives I've purchased yield errors on a Spinrite level 5 scan. These immediately get returned and swapped for a hopefully healthier sibling. I find it amazing how many questionable drives people are housing their valuable data on.

    The summary here is that, for me, DDRescue is probably the best option out there for data recovery, it's cross-platform and it's free, GNU free. Spinrite on the other hand is a crucible, a tough-as-nails field tester. Can it recover data? I'm sure it can, but why use a firehose to get a sip of water when a garden hose is safer and easier. That being said the command-line interface of DDRescue is probably what turns most folks off, but I posit that inspite of this, it is remarkably easy to use and yields incredible results for data recovery. Spinrite is fantastic for putting a drive through the paces to see if it's worth it's salt. Unfortunately, the "Division Overflow Error" has left Spinrite "collecting dust" in my toolbox because most drives I work with now are greater than 500GB.

    If what I've written here helps even one person recover their precious data using DDRescue when they might have killed that chance using Spinrite, then my time spent writing this post was worth it.
     
  23. Blueshoes

    Blueshoes Registered Member

    Joined:
    Feb 13, 2010
    Posts:
    226
    I have been reading comments here about Steve Gibson on Spinrite and if he can really code. Really? You are going to go there? Really?

    Spinrite 6.1 would of been done by now, but Steve gets distracted very easily on different projects.

    The one that he is working on NOW and has pulled him off finalizing Spinrite 6.1 is he has invented a new login authentication protocol that is suppose to be revolutionary simple, open source, secure, fully documented, vetted, and will be ready to implement. He's been busy!


    http://en.wikipedia.org/wiki/SQRL

    http://sqrl.pl/index.html#home

    https://www.grc.com/sqrl/sqrl.htm

    .
     
  24. claykin

    claykin Registered Member

    Joined:
    Sep 30, 2007
    Posts:
    132
    +1

    The haters need something to talk about.
     
  25. NGRhodes

    NGRhodes Registered Member

    Joined:
    Jun 23, 2003
    Posts:
    2,359
    Location:
    .
    He's not invented it, just an implementation of an existing idea.
    Google and others have tested QR code authentication and have proposed open draft protocols too (a quick search can confirm).

    QR codes are nothing magical - just a method of enoding data an offers no advantage of using say your Facebook app on your phone to generate a numeric code.

    Might be less susceptible to brute force, but is far more open to being exploited by malware as pushes more reliance on the OS being secure.
    Also Still does not solve man in the middle attacks either - not sure what the actual advantage over using 2 factor ?

    edit: Note I am not saying what he has proposed is bad - just no advantages other what has already been tested.
     
    Last edited: Jan 17, 2014
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.