March 17th, 2018, 13:46
March 17th, 2018, 14:42
March 17th, 2018, 16:39
March 17th, 2018, 17:20
The drive is perfect. The Error Log is for factory use only. You shouldn't open it.
The error log indicates that there could very well be a bad sector on the drive. You will know for sure when the ddrescue imaging completes. If it completes without errors, then the drive is okay.
At first I thought the sector reported bad in the log was at about 2.85GB, but then realized that the high order registers are not present, so it is most likely a higher LBA. You will know when the imaging is complete.
You can check this link as well :
http://www.hddoracle.com/viewtopic.php?f=117&t=1393
Error 2678 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 41 d0 e0 21 55 40 Error: UNC at LBA = 0x005521e0 = 5579232
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
60 08 d0 e0 21 55 40 00 00:34:22.681 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:22.673 READ LOG EXT
60 08 c8 e0 21 55 40 00 00:34:18.884 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:18.873 READ LOG EXT
60 08 c0 e0 21 55 40 00 00:34:15.087 READ FPDMA QUEUED
Error 2677 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 41 c8 e0 21 55 40 Error: UNC at LBA = 0x005521e0 = 5579232
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
60 08 c8 e0 21 55 40 00 00:34:18.884 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:18.873 READ LOG EXT
60 08 c0 e0 21 55 40 00 00:34:15.087 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:15.073 READ LOG EXT
60 08 b8 e0 21 55 40 00 00:34:11.290 READ FPDMA QUEUED
Error 2676 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 41 c0 e0 21 55 40 Error: UNC at LBA = 0x005521e0 = 5579232
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
60 08 c0 e0 21 55 40 00 00:34:15.087 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:15.073 READ LOG EXT
60 08 b8 e0 21 55 40 00 00:34:11.290 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:11.284 READ LOG EXT
60 78 b0 e0 21 55 40 00 00:34:07.493 READ FPDMA QUEUED
Error 2675 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 41 b8 e0 21 55 40 Error: UNC at LBA = 0x005521e0 = 5579232
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
60 08 b8 e0 21 55 40 00 00:34:11.290 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:11.284 READ LOG EXT
60 78 b0 e0 21 55 40 00 00:34:07.493 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:07.484 READ LOG EXT
60 08 a8 e0 21 55 40 00 00:34:03.695 READ FPDMA QUEUED
Error 2674 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
When the command that caused the error occurred, the device was active or idle.
After command completion occurred, registers were:
ER ST SC SN CL CH DH
-- -- -- -- -- -- --
40 41 b0 e0 21 55 40 Error: UNC at LBA = 0x005521e0 = 5579232
Commands leading to the command that caused the error were:
CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name
-- -- -- -- -- -- -- -- ---------------- --------------------
60 78 b0 e0 21 55 40 00 00:34:07.493 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:07.484 READ LOG EXT
60 08 a8 e0 21 55 40 00 00:34:03.695 READ FPDMA QUEUED
2f 00 01 10 00 00 28 00 00:34:03.683 READ LOG EXT
60 08 a0 e0 21 55 40 00 00:33:59.898 READ FPDMA QUEUED
March 17th, 2018, 17:52
March 17th, 2018, 17:58
It completed with no error indeed. What are “high order registers” ?
And so, what could be the cause of those errors ? Could it be consistent with a software / system related issue ?
smartctl --log=xerror /dev/sdc
Apparently this drive (and the whole computer I assume) has been used very moderately (232 hours, 319 start/stop counts), so how can it have such high values in shock/vibration related fields ?
March 17th, 2018, 18:08
maximus wrote:The error log indicates that there could very well be a bad sector on the drive.
March 17th, 2018, 21:43
The SMART error log is a user log, not a factory log. The factory log is something else.
Did the Reallocated Sector Count or Current Pending Sector Count change after the cloning?
The Head Retract Cycle Count of 3342394 is best expressed in hex:
3342394 = 0x0033003A -> 0x0033 0x003A -> 51, 58
It may be a coincidence, but these values appear to be related to the Free Fall Protection count (51).
High order registers are another way of referring to 48 bit LBA access. It appears that GSmartControl used the read log command, the read log extended command would have the extended high order registers. You could use smartctl to read the extended log.
The fact that there were no errors when imaging, and no pending or reallocated sectors in smart, would indicate the possibility that there was a bad sector, it was rewritten (perhaps during the reformatting), and there were no issues so it is good again. So with the information provided, it would seem that the drive is healthy.
When looking up how the drive may produce the G-Sense Error Rate provided a possible answer that could be very simple. It could be a count of how many times the drive experience a level of g force that caused it to abort a write. This is a safety feature and could only take a very small bump to trigger it. Values are vendor specific (and also likely drive specific), so unless you can find the exact meaning of the value for that drive, I would not read too much into it.
March 18th, 2018, 11:14
March 18th, 2018, 20:39
March 18th, 2018, 20:41
March 18th, 2018, 21:45
Could just look visually in hex space and see if data looks encrypted.
Or search for simple/common keywords in RAW space with Winhex. If you get hits, then it is not encrypted.
March 18th, 2018, 21:52
March 18th, 2018, 22:43
March 19th, 2018, 9:09
abolibibelot wrote:This is almost certainly a “home computer”. So how could I identify a Bitlocker or TrueCrypt encryption?
abolibibelot wrote:Someone asked me to recover data from a laptop computer HDD (Toshiba MQ01ABF050, 500GB) which, supposedly, has only been reformated by mistake. But it was reformated by the owner's father because the computer was acting up for an unknown reason : failed to boot, got stuck with an error message or a blue screen or whatever, I don't know the details.
abolibibelot wrote:And at which level is the encryption dealt with, with either of those systems ?
March 19th, 2018, 10:18
March 19th, 2018, 11:35
abolibibelot wrote:Well, am I to understand that most pros here deal mostly with hardware / firmware failures, and that this particular issue is beyond the scope of this forum ? Nobody ever encountered something similar ?
abolibibelot wrote:Or is there something inherently wrong with the kind of advice I'm requesting?"
abolibibelot wrote: @labtech: Sorry, I hadn't seen your follow-up reply. Reading it right now.
March 19th, 2018, 11:50
- Ask the customer or computer owner/actual user.
- Think how they may have encrypted it without them realizing they actually did and ask if they recall anything like that happening.
- Did they save any encryption keys? What about their Microsoft account?
- Look for Bitlocker or Truecrypt signatures.
- Try to replicate the problem with a test drive.
Not sure I understand your question.
Needlees to say, not sure what else I can suggest without more concrete information.
March 19th, 2018, 12:01
abolibibelot wrote:what would you do ?
March 19th, 2018, 12:13
We encounter strange recovery cases all the time. All kinds, hardware, software and logical related (e.g. formatting, which is a very common screw up)
All technicians are tired of wasting time on scenarios where the end customer isn't cooperative and, on a brief analysis, the files seem likely unrecoverable. Hence, why the lack of replies likely.
No, not necessarily. The problem lies in the fact that we are expecting to come up with a solution before understanding the problem fully. We are just speculating so far based on limited information. To come up with a solution, we first need to fully understand all the details relevant [aka the problem].
Powered by phpBB © phpBB Group.