All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 10 posts ] 
Author Message
 Post subject: Explaining Disk Check Results
PostPosted: December 31st, 2017, 17:15 
Offline

Joined: May 26th, 2017, 13:03
Posts: 18
Location: Volgograd, Russia
Hello,

There are often high-pitched and screeching noises coming from the system block, and the system often shows errors. Can someone explain what the following figures mean?


Attachments:
2.JPG
2.JPG [ 120.62 KiB | Viewed 1872 times ]
1.JPG
1.JPG [ 123.48 KiB | Viewed 1872 times ]
Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 7th, 2018, 0:32 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 166
Location: France
The 1TB is fine, the 320GB one has 11 sectors ("B" in hexadecimal) identified as bad (unreadable or readable with abnormal difficulty).
It's still a low figure (especially considering the high Power On Hours number), it can stay that way for a long time but it's recommanded that you clone it or transfer everything of value to another storage unit and use it for non-critical data from now on.


Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 7th, 2018, 11:04 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9985
Location: Portugal
And it's very important to figure out if the "high-pitched and screeching noises" are produced by the hard drive(s) or by any other component like the cooling fans of the system or power supply ....

If you transfer all data out of the 320GB drive and you confirm that the data is securly saved you can try to zero fill the drive or secure erase it in order to re-use the pending sectors or force them to go to the G-List and be swapped by spares.

On WD (modern ROYL) drives it's not recommended to run with pending sectors as if the pending list (RE-LO) grows too big there are chances for the drive to slow down considerably.... to the point of the data to get inacessible.

And of course as general rule just keep backups of all of your important data, even if S.M.A.R.T. is showing that the drive should be fine.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 7th, 2018, 18:01 
Offline

Joined: May 26th, 2017, 13:03
Posts: 18
Location: Volgograd, Russia
Thank you for the information. The age of the drive was shown in one software to be about 1,400 days. Perhaps that figure refers to the combined total amount of hours the drive has been in use. Since the drive is very old and did not load again, I have installed a newer disk.


Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 7th, 2018, 18:35 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 166
Location: France
Quote:
On WD (modern ROYL) drives it's not recommended to run with pending sectors as if the pending list (RE-LO) grows too big there are chances for the drive to slow down considerably.... to the point of the data to get inacessible.


What particular range of models does “ROYL” refer to ?
In this particular case it's still far from being a severe issue which could lead to the kind of failure that you're mentioning – although I know that it can evolve pretty fast, especially if there are repeated access attempts to files containing bad sectors. Do you know precisely how big the pending list can grow before triggering that slowdown ?
Also, I've read a few threads about that “slow issue” on WD HDDs : apparently there's a fix for that, right ? HDDSuperTool seems to be able to fix it so it doesn't even require any hardware tool. Granted, it's quite advanced stuff, only known by specialists, but precisely, someone coming here for advice should be in “good hands” so to speak, and get thorough information rather than a “do this / don't do that” kind of reply. (This relates to my own experience as well – I've exposed a particular issue in detail, trying to learn something from it, and had replies like a pavlovian “don't use Seagate hard drives they're bad”... kinda frustrating !)


Quote:
If you transfer all data out of the 320GB drive and you confirm that the data is securly saved ...


How would you proceed to verify the files' integrity in such a case ? When copying files between healthy HDDs I always do a thorough comparison with WinMerge before deleting data from the source, but if the source has bad sectors, how to ensure that the transfer was flawless, or if it was not, how to know which files could be corrupted ?
Even with so few pending sectors it may be worth doing a full clone with ddrescue or HDDSuperClone, then using the LBA of the unreadable areas (if any) to identify the affected files (can be done with ddr_utilities with the logfile from ddrescue as input). But I've had a case where trying to access bad sectors using ddrescue considerably worsened the HDD's state in a matter of hours, even though, prior to that, I had been able to successfully copy everything but the affected files... So, if I had been making a full clone first, I may have recovered much less data than by proceeding like I did. (As I mentioned above, I asked about it here, but got no relevant reply.)


Quote:
... you can try to zero fill the drive or secure erase it in order to re-use the pending sectors or force them to go to the G-List and be swapped by spares.


In this case, considering the drive's age (power on hours), I'd say that it's unlikely that those sectors have been wrongly identified as bad and are in fact perfectly fine – but yeah, it's still worth a try. Although I've had cases where a bunch of sectors were marked as bad, appearing in the Pending Sectors list, then disappeared after a complete scan (Pending Sectors back to 0), only to reappear some days later, with others added later on, while the HDD wasn't even used, just staying idle. So it's safe to say that it's no longer safe to use in a safe way.
A HDD like this could still be used to store movies or music to play on a standalone device for instance, or to share them with friends (making a CRC or MD5 check after each copy for peace of mind). Then, as Ivan Drago would have said, “if it dies, it dies...” – those files on it were expendables anyway.


Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 8th, 2018, 16:35 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9985
Location: Portugal
Very old WD drives did had a WDC MCU. Latest WD drives with WDC MCU were Arch-VI Cyl 32 and they were then replaced with Marvell MCU. The first WD drives on the market with Marvell MCU did had a slight diferent firmware than "modern" ROYL. There are just a bunch of families on the market that were Marvell based an NOT ROYL. You can identify ROYL drives by checking the modules of the firmware. Here : - http://yura.puslapiai.lt/files/wd/mhdd/wd_royl_rom.html but any recent WD drive that you will encounter will be ROYL.

Regarding the slow issue read my experiences here - http://www.hddoracle.com/viewtopic.php?f=59&t=1456 - on my example the RE-LO list did had only 33 entries if i remember correctly.

There is NO FIX for the slow issue. Once the drive starts to have problems then the drive MUST be replaced. Even ARCO / SELF-SCAN can't be considered a very reliable way to fix the drive. There is a "patch" that simply disable media scan for bad sectors and clear the re-lo list. This is to make the drive fast again in order to RECOVER THE DATA. This is NOT for drive re-use.

Here is the way i think it's easy to execute the slow fix :

http://www.hddoracle.com/viewtopic.php? ... t=60#p9874

You can read a full article here - http://www.hddoracle.com/viewtopic.php?f=86&t=848

No hardware tool required and it's NOT that advanced ... It's quite simple honestly.

And yes, don't use ANY F3 ARCH SEAGATE DRIVE !!!

- Any decent cloning / imaging tool will tell you about how many bad sectors the drive have and what files are afected by those bad sectors. Lacking decent hardware based tools and assuming you are cloning a drive with bad sectors there are other methods to check what files are afected by bad blocks. Read here for example - http://www.hddoracle.com/viewtopic.php?f=117&t=1626

Again if you have "pro" tools like PC-3000 DE when you clone a drive you can see what blocks are bad and what files belong to those blocks.

- Pending sectors migth or might not be bad sectors. Pending sectors are just sectors that can't be read properly. They are added to the pensing list because on the next try to write to those sectors one of 2 things will happen. Either the sector writes and verify ok and it's removed from pending list or the sector doesn't properly write / verify and it's added to the G-List to be swapped by a working spare. Here - http://www.hddoracle.com/viewtopic.php?f=46&t=1402

- Regarding cloning of bad drives if heads are dying it might be worth to go after the files you need first and only then attempt to clone the rest of the drive .... This is discussed here - http://www.hddoracle.com/viewtopic.php?f=30&t=1184

Hope this helps.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 8th, 2018, 17:24 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9985
Location: Portugal
- One VERY IMPORTANT consideration about the "slow issue" on WD drives and the "Pending BUG" on the Seagate ones is that on modern drives there is a BACKGROUND MEDIA SCAN meaning that you might have your drive idle doing nothing, your OS might not be requesting any data from the drive, might not be sending any command or in fact you might even get the SATA cable disconnected from the host and the drive itself while powered up might be scanning the surface for sectors that can't be properly read and be adding those sectors to the pending list. You don't even need to request to "read" or "verify" a problematic LBA, the drive might do that itself at firmware level unless you disable the correspondent "feature" by patching firmware .....

Example :

Attachment:
1.jpg
1.jpg [ 121.11 KiB | Viewed 1647 times ]

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 8th, 2018, 23:09 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 166
Location: France
Quote:
Very old WD drives did had a WDC MCU. Latest WD drives with WDC MCU were Arch-VI Cyl 32 and they were then replaced with Marvell MCU. The first WD drives on the market with Marvell MCU did had a slight diferent firmware than "modern" ROYL. There are just a bunch of families on the market that were Marvell based an NOT ROYL. You can identify ROYL drives by checking the modules of the firmware. Here : - http://yura.puslapiai.lt/files/wd/mhdd/wd_royl_rom.html but any recent WD drive that you will encounter will be ROYL.


I would guess that the O.P. (if that person is still stealthily lurking around here :) ) doesn't know what a “MCU” is, and neither do I... Maybe... “micro chip unit” ? (Just a guess, didn't search.)


Quote:
There is NO FIX for the slow issue. Once the drive starts to have problems then the drive MUST be replaced. Even ARCO / SELF-SCAN can't be considered a very reliable way to fix the drive. There is a "patch" that simply disable media scan for bad sectors and clear the re-lo list. This is to make the drive fast again in order to RECOVER THE DATA. This is NOT for drive re-use.


Alright, the term “fixed” wasn't the most appropriate, but that was kinda evident in that context : using a hard disk drive with even a few bad sectors for important data is always a bad idea, regardless of the brand, even without that specific issue on that range of WD drives, so I meant “fixed” in the sense “that particular issue can be dealt with if push comes to shove”.


Quote:
No hardware tool required and it's NOT that advanced ... It's quite simple honestly.


Most people (heck, even most general purpose computer professionals) don't know that hard drives have a firmware which can receive special commands, so even if it's relatively simple to do once you know how to do it, I would still say that this is an advanced procedure.


Quote:
Again if you have "pro" tools like PC-3000 DE when you clone a drive you can see what blocks are bad and what files belong to those blocks.


Yeah, I hope that pro tools (why do you use quotations marks here ? isn't this “professional” stuff in the strictest sense ?) can do everything that can be done in the most efficient and reliable way possible... but I currently don't have access to that kind of very expensive tools, so I do what I can do with what I can have ! :)


Quote:
Regarding cloning of bad drives if heads are dying it might be worth to go after the files you need first and only then attempt to clone the rest of the drive....


So my instincts were right (for once !) when I dealt with the 3TB one. But if everything is pretty much of the same importance, or it would be too tedious and time-consuming (a precious time when dealing with a failing HDD) to sort out what is absolutely crucial / important / useful / trivial, then it's probably best to do a full clone right away and hope for the best, like I did with the 2TB one.

What are the obvious symptoms of heads dying, as opposed to surface defects ?
For instance, here's a ddrescueview screenshot of a 1TB Hitachi HDD which was handed to me last summer. I tried to recover as much data as possible from it with software methods (ddrescue + R-Studio), and was quite succesful (luckily, it was only filled to about a quarter, so I got almost all the user data, only about 130 files were corrupted, according to ddru_ntfsfindbad, then as there were many duplicated files, which I identified with DoubleKiller, I managed to further repair more than 100 of them, the guy was very happy). Does such a pattern, with alternating stripes of good and bad areas, mean that one head was kaputt at that point ? At first I tried to copy everything, there were slowdowns but it was copying steadily ; then after about 200GB it started disconnecting, making frightening clicks, after a few power cycles it was writing again but very slowly, at which point I wondered if writing the image to a NTFS partition could be the cause as I had read in a ddrescue tutorial (I exposed the issue here) ; then I started all over again, strangely this time there were no slowdowns at the begining, but it started to have major hiccups earlier, around 160GB ; at some point I tried ddru_ntfsbitmap, which proved tremendously useful in a case like this (I should have done that at the begining), that's why large areas are non-tried beyond 250GB (those areas were marked as empty in the bitmap) ; I still had to give up after a while, as it had slowed down to a crawl and it would have taken hours to get 1MB.


Quote:
One VERY IMPORTANT consideration about the "slow issue" on WD drives and the "Pending BUG" on the Seagate ones is that on modern drives there is a BACKGROUND MEDIA SCAN meaning that you might have your drive idle doing nothing, your OS might not be requesting any data from the drive, might not be sending any command or in fact you might even get the SATA cable disconnected from the host and the drive itself while powered up might be scanning the surface for sectors that can't be properly read and be adding those sectors to the pending list. You don't even need to request to "read" or "verify" a problematic LBA, the drive might do that itself at firmware level unless you disable the correspondent "feature" by patching firmware .....


That answers a question I asked about the reallocated sector count from my ST2000DL003 which kept increasing even when letting it run idly for a few days – and that contradicts a common notion that bad sectors can only be reallocated after a failed write attempt.
Is this background scan reliable at least ? Or can it wrongly mark sectors as bad when in fact they're not ? (Meaning that the data they contained is lost.) The strange thing in this case is that surface scans with HD Sentinel still come out 100% clean...


Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 8th, 2018, 23:33 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 166
Location: France
Regarding the HDDOracle guide you linked :

Quote:
Use your firmware tool and get a copy of all modules, place them on a safe place.


What do you call “firmware tool” here ? Hardware or software ?


Quote:
This is due to a problem similar with the Seagate F3 drives, when the drive gets "stuck" trying to re-locate sectors, or more specific, adding and managing the list of sectors that are "candidates" to be relocated. [...]
This operation is somehow correspondent to turning off relocation of Seagate F3 drives


Apparently that's what happened to my ST3000DM001 (the reallocated sector count and pending sector count were increasing constantly, and quite spectacularly, were around 10000 each last time I checked). Is there a similar, software-only procedure to turn that off on Seagate F3, or can it be done with a cheap adaptator, or does it require expensive hardware tools with those models ? (I have little hope that I can recover even one of the corrupted files, but that'd be worth a try, if only for educational purposes.)


Top
 Profile  
 
 Post subject: Re: Explaining Disk Check Results
PostPosted: January 9th, 2018, 15:48 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9985
Location: Portugal
- MCU = Microcontroller unit. Chip on PCB that acts like the main processor. Sometimes might have embeded flash memory / ROM code as well. Example WD drives without external ROM chip and ROM code embeded on the MCU (you can access that code with the same VSCs that you would use to access the code on the external ROM chip if that were to exist).

- If you do a full clone of a drive that you know for sure to have "problems" and bad sectors you will want first of all to patch the firmware to disable re-location and background media scan and then you will want to set a very low time-out to skip the bad sectors fast and set reading attempts to just one and skip some amount of sectors if several bad sectors are found consecutively. Sometimes you will want to ignore one or more entire heads.

- With exception of a few models of drives (typicaly some Samsung families) the drives will write/read some MBs of data with one head and then switch to the next. There are some exceptions (mainly Samsung drives that can store GBs of data consecutively with the first head and only then switch to the next. Read here - http://www.hddoracle.com/viewtopic.php?f=59&t=650 . If one head is totaly gone then you will not get any data from that head. A surface scan will reveal lists of BAD BLOCKS when the drive attempts to read with that physical head. If you have tools like PC-3000 DE you can do a head map and image by heads. This way it's very easy to see if one or more heads are not reading any data at all. Then you have damaged heads that might be able to read some zones but will not read other zones because of media density, calibration, etc .... On cases of surface damage you will not be able to read the surface even if you change heads. This might include scratching on the platter, substract of the platter loosing magnetic properties, etc ...

- If you have one head that can't read a single sector when you copy by head map then the head is gone.

- The fact that you have a huge amount of data retrieved at the start of the drive without bad blocks doesn't reveal right away that one head is damaged. If you are having problems reading further down if might be a head issue or "something else". Again on a typical drive with a completly dead head you wouldn't get the first GBs of data without a single bad block....

- Background media scan shouldn't place sectors on G-List (re-locate them) by itself. It will place sectors on the pendning list but if you don't write to those same sectors then they shouldn't go to the G-List. Of course it will all depend on the firmware. There might be drives out there that once they find a defective sector they might atte,pt to read what they can from it to write it on a spare but i don't think that this will happen, or if it does i did never saw it. Maybe your OS is accessing the drive even if the computer is IDLE ? Think about pagination file (memory) and indexing, etc .... Also windows temprary files. If they hit a bad sector then the drive places that sector on the G-List. It will show on re-located sector count but a full scan with MHDD will not show any media damage unless you run out of spares or you get more problematic sectors. If the drive only have a bunch of damaged sectors that can be swapped by spares once the drive does that you will no longer see the bad sectors on a media scan. You need to check G-List or the S.M.A.R.T. values. If you have for example 10 pending sectors and those sectors are bad you do a zero fill or you make sure you write something to those sectors then they are added by the drive to the G-List and on the next surface scan with whatever tool you use to do logic scan the bad blocks will be gone. This is because now when you access the problematic LBA that LBA will not be pointing to the bad sectors but instead will be pointing to a good spare sector.

- Hardware firmware tools will use the same vendor specific commands that software only firmware tools. They have some advantages to have a dedicated hardware card like copy protection, handling bad drives that will no longer cause the OS/System to hang, power controll, etc .... But if you have a "decent" firmware tool like SeDiv or even WDMarvel for WD (Marvell) drives if you plug a good drive to the system (i say a good drive to be certain that it will not crash the machine) you should be able to take a backup of modules/tracks/rom, whatever SA/Firmware resources that you need the same way you would with a hardware assisted tool.

- For Seagate drives if terminal access is not locked you can try some terminal commands to disable re-location and make your recovery easier and safer.

- TTL adapor - http://www.hddoracle.com/viewtopic.php?f=46&t=192

- Connect it this way - http://www.hddoracle.com/viewtopic.php?f=6&t=193

- Try this - http://www.hddoracle.com/viewtopic.php? ... =60#p10834 or this - http://www.hddoracle.com/viewtopic.php? ... =80#p14731

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 10 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Majestic-12 [Bot] and 48 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group