All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 60 posts ]  Go to page Previous  1, 2, 3
Author Message
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 22nd, 2018, 22:50 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
Quote:
No they wouldn't.
They would simple hook up the drive to something like PC-3000 DE or even use simple methods like open the drive with R-Studio and directly extract the data.
Yes, nobody would bother to fix the partition by hand because it's a time waste and no-one in it's right mind would even "consider" to re-use that drive even more "gamble" with that chkdsk !
You were very lucky so far and that's it.

Quote:
Thats because they are experts, and they work in data recovery. The job is recovering the data. The most trusted way would be to just extract with R-Studio, for example. Why mess with direct editing of the partitions when not necessary , and possibly making another customer wait ?

What I did was relatively painstaking because I'm relatively new to this, but knowing what I know now I could probably fix a similar issue in a fraction of the time necessary to extract the whole contents (although it's a wise safety measure, especially if there's any doubt about the drive's fitness status) and write it back (if it turns out that the drive is fine). I'm wondering what a “regular” computer repair technician – i.e. not a data recovery expert – would do in a case like this, if a client brings a drive in the exact same state and wants it “fixed”.

As for CHKDSK, I understand that this tool is often derided here, as it can mess things up pretty badly in some situations (yet many computer repair technicians foolishly swear by it as if it was some kind of HDD panacea !), and should never be used on a drive with even minor physical issues, but it still has its purpose, which is to fix small inconsistencies in an NTFS volume, that can appear randomly for a variety of reasons on a perfectly working drive, and by themselves cause trouble / data loss if they're not taken care of, meaning, if the filesystem stays in an inconsistent state.

And as for considering to re-use the drive, currently I'm more worried about the state of a WD30EZRX with 23 “pending” sectors (the one I used for the safety backup of the ST2000DM001).
Attachment:
WD30EZRX 201806230444 SMART pending.png
WD30EZRX 201806230444 SMART pending.png [ 147.95 KiB | Viewed 583 times ]


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 23rd, 2018, 8:58 
Offline

Joined: January 29th, 2012, 1:43
Posts: 415
Location: United States
Quote:
What I did was relatively painstaking because I'm relatively new to this, but knowing what I know now I could probably fix a similar issue in a fraction of the time necessary to extract the whole contents (although it's a wise safety measure, especially if there's any doubt about the drive's fitness status) and write it back (if it turns out that the drive is fine). I'm wondering what a “regular” computer repair technician – i.e. not a data recovery expert – would do in a case like this, if a client brings a drive in the exact same state and wants it “fixed”.

And what would happen if you rebuilt it, then ran CHKDISK and it wiped out half of the files in the MFT? Or if the MFT was fragmented and you only got the first part? Then it becomes a case of raw file recovery, which is now going to take much longer and the files won't be named or sorted. And if the files were fragmented, ouch! That is not the way to make a customer happy. And that is why nobody here would do it that way.

_________________
http://www.sdcomputingservice.com
Home of HDDSuperClone and HDDSuperTool


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 23rd, 2018, 10:11 
Offline

Joined: October 16th, 2013, 13:21
Posts: 688
Location: Brazil
+2TB to maximus

Mr Belot, it seems you keep thinking in terms of fixing disks. The focus people that work with recovery use is in the *data*, not the disks.

To more or less use and translate something that I explain to people here, you can avoid eating a doughnut a day, and you will save enough money to pay for another hard disk in a month or two. But no matter how much you try to save, you will not be able to get all the people that were in a party, with the same clothes, in the same positions, to take those same pictures. Can you make somebody marry again so that you can take those lost pictures ? Don´t think so.

That´s why recovering the files, even if takes a day or two longer, is the preferred action. Hard disks can easily be bought. Data cannot ( the work of months ? data from experiments that now have to be run again ? )

Sure, understanding the inner workings of filesystems is good and very useful, for the times it is necessary. It just isn´t the best option for all cases. Actually, it is the option just for some very small % of cases.

To use a somewhat related case I got myself into once : With the customer talking too much about how good technicians do not need to format computers, how someone he knows at Microsoft said they do not need to format computers, etc.
And I was naive/inexperienced/distracted, whatever, and went with his ideas that time. And after 2 o 3 hours suffering with his very hosed computer, still had to backup and reinstall windows. Had I taken the correct approach in the case, to backup and restore, after what he had described as the cause of the problem, I would have ended earlier and the service would have been profitable, with the same end results achieved. Now I chalk that as a lesson to have learnt something, but it is a true lesson anyway.

Sometimes one can cross the river in a boat, instead of building a bridge.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 23rd, 2018, 12:21 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9418
Location: Portugal
abolibibelot wrote:
(...)
And as for considering to re-use the drive, currently I'm more worried about the state of a WD30EZRX with 23 “pending” sectors (the one I used for the safety backup of the ST2000DM001).


If you don't need the data on this drive just zero fill it or run secure erase. All sectors should be written to. If the sectors are found to be bad they will be moved to G-List. If the sectors can be re-used they will be removed from RE-LO list.

If you keep on using this drive you will risk to get the "slow issue" very shortly as your re-lo list is growing ...


But of course you might want to use chkdsk on this drive as well just for the fun of it ...

:mrgreen: :mrgreen: :mrgreen:

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 24th, 2018, 4:41 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
@maximus
Quote:
And what would happen if you rebuilt it, then ran CHKDISK and it wiped out half of the files in the MFT? Or if the MFT was fragmented and you only got the first part? Then it becomes a case of raw file recovery, which is now going to take much longer and the files won't be named or sorted. And if the files were fragmented, ouch! That is not the way to make a customer happy. And that is why nobody here would do it that way.

There's the possibility of making a backup copy of all system files before proceeding with an in-place fix attempt, which I did roughly by extracting the first 5GB with WinHex – but indeed, it should be stressed (if someone reads this in the future) that this is not always enough to get the whole MFT, which can itself be fragmented, I learned it the hard way ! And it's indeed the wise thing to extract the data first in a situation like this (or make a complete clone). In this particular case, right now I'm trying to re-organize all my data in consistent and sensible way, I've had several HDD failures or pre-failures (including that WD30EZRX), I'm rather short on money, so I had a good incentive to at least try to make it work that way ; and maybe I was lucky but it did work (I took the time to do some research and carefully prepare this, so it was not just sheer luck either, although I'm willing to admit that an issue like this could have been hiding something worse).


@rogfanther
Quote:
+2TB to maximus

Mr Belot, it seems you keep thinking in terms of fixing disks. The focus people that work with recovery use is in the *data*, not the disks.

To more or less use and translate something that I explain to people here, you can avoid eating a doughnut a day, and you will save enough money to pay for another hard disk in a month or two. But no matter how much you try to save, you will not be able to get all the people that were in a party, with the same clothes, in the same positions, to take those same pictures. Can you make somebody marry again so that you can take those lost pictures ? Don´t think so.

That´s why recovering the files, even if takes a day or two longer, is the preferred action. Hard disks can easily be bought. Data cannot ( the work of months ? data from experiments that now have to be run again ? )

Sure, understanding the inner workings of filesystems is good and very useful, for the times it is necessary. It just isn´t the best option for all cases. Actually, it is the option just for some very small % of cases.

To use a somewhat related case I got myself into once : With the customer talking too much about how good technicians do not need to format computers, how someone he knows at Microsoft said they do not need to format computers, etc.
And I was naive/inexperienced/distracted, whatever, and went with his ideas that time. And after 2 o 3 hours suffering with his very hosed computer, still had to backup and reinstall windows. Had I taken the correct approach in the case, to backup and restore, after what he had described as the cause of the problem, I would have ended earlier and the service would have been profitable, with the same end results achieved. Now I chalk that as a lesson to have learnt something, but it is a true lesson anyway.

Sometimes one can cross the river in a boat, instead of building a bridge.

Alright, that's a clear enough explanation.
(“Aboli bibelot” comes from a poem by Stéphane Mallarmé, for what it's worth.)
Regarding the lost pictures, maybe there should be a new business for “life's staple moments reenactment”, where people would do just that, reenact graduation ceremonies, parties, weddings, just for the sake of re-creating lost digital files ! :) Anyway, as I've read somewhere, “nostalgia is a mental clitoris, don't abuse it”, and George Carlin made a good point about the overwhelming tendency nowadays to record and document everything, to the point that one has to wonder if people are able to actually live things and remember them anymore (and I know that first hand, being a major offender in the digital memories hoarding department !).


Quote:
If you don't need the data on this drive just zero fill it or run secure erase. All sectors should be written to. If the sectors are found to be bad they will be moved to G-List. If the sectors can be re-used they will be removed from RE-LO list.
If you keep on using this drive you will risk to get the "slow issue" very shortly as your re-lo list is growing ...

I know that these bad sectors are all located on the same ~4GB MKV file (at first there was only 1, then I copied a bunch of MKV movies to this drive, the count went back to 0, but then when I copied those files to another drive the count rose to 16, and SynchronizeIt reported CRC errors on that one file, the others copied just fine) ; then, just to verify if those sectors were truly bad, hoping that they would be cleared once again (although unlikely at this point), or to assess the level of damage and pinpoint the exact location of those bad sectors, I tried to copy that file with Roadkil Unstopable Copier, which increased the count to 23 (knowing the location of the file on the partition and the location of the bad area within the file, I determined that they were in the interval of sectors 5406621249-5406621675) ; so, for now, I just let that file on the drive in a special folder with a name saying that it contains bad sectors, lest I forget. It seems to be that this is the safest course of action if I want that drive to stay stable and keep using it for temporary / unimportant stuff. When I copied 2TB worth of files (from the ST2000DM001), the S.M.A.R.T. status didn't move. If I do a complete zero-fill / secure erase, it will try to access those sectors again, and those nearby which may be weak as well, even if the currently identified bad sectors are reallocated the heads will come flying extremely close to this area later on and most likely increase the damage, which I do not want.

Quote:
But of course you might want to use chkdsk on this drive as well just for the fun of it ...

Now I get the feeling that you're being almost sarcastic... :roll:


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 24th, 2018, 9:51 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9418
Location: Portugal
abolibibelot wrote:
(...)I know that these bad sectors are all located on the same ~4GB MKV file (at first there was only 1, then I copied a bunch of MKV movies to this drive, the count went back to 0, but then when I copied those files to another drive the count rose to 16, and SynchronizeIt reported CRC errors on that one file, the others copied just fine) ; then, just to verify if those sectors were truly bad, hoping that they would be cleared once again (although unlikely at this point), or to assess the level of damage and pinpoint the exact location of those bad sectors, I tried to copy that file with Roadkil Unstopable Copier, which increased the count to 23 (knowing the location of the file on the partition and the location of the bad area within the file, I determined that they were in the interval of sectors 5406621249-5406621675) ; so, for now, I just let that file on the drive in a special folder with a name saying that it contains bad sectors, lest I forget. It seems to be that this is the safest course of action if I want that drive to stay stable and keep using it for temporary / unimportant stuff. When I copied 2TB worth of files (from the ST2000DM001), the S.M.A.R.T. status didn't move. If I do a complete zero-fill / secure erase, it will try to access those sectors again, and those nearby which may be weak as well, even if the currently identified bad sectors are reallocated the heads will come flying extremely close to this area later on and most likely increase the damage, which I do not want.


That is why people move PBAs to the P-List or use Self-Scan.

:lol: :lol: :lol:

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 25th, 2018, 1:43 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
Quote:
That is why people move PBAs to the P-List or use Self-Scan.

What does PBA stand for ?
I don't get the sarcasm here... Most people don't do anything at all with a failing HDD until it suddenly stops functioning for good... At least I know that this one has a problem (relatively minor for now), and I'm taking it into account (I won't use that drive to store important data).
The question is : when a weak area with contiguous bad sectors starts to develop, and sectors identified as bad at a T time are reallocated (moved to G-list if I get this right, P-list being for factory-detected defects), and the drive is used regularly again, what happens later on when heads attempt to access the sectors nearby, very close to those which are no longer “active” ? Isn't there a high risk that some of them will also get identified as weak, increasing the “pending sectors” count again, and worsening the situation ? (This is what happened with a ST3000DM001 : it had 16 bad sectors, but remained stable for months, being used everyday, then I could backup all the data on it except six video files, identified with HD Sentinel and Defraggler[*], and it's only when I tried to copy those six files, which contained contiguous bad sectors, that it failed rapidly and badly...) Isn't it wiser, in that particular situation, if there's a single file containing that bad area, to just let it on the drive and not touch it anymore ?

[*] Nooo, I'm not crazy enough to have attempted a defragmentation on a HDD with bad sectors (and a Seagate at that to add insult to injury ! :)), it's just that I discovered a nice feature this program has, which can be tremendously useful in that kind of situation : after an analysis (based on the MFT so it's quick and doesn't require to scan the whole drive surface), just clicking on a “block” on its map gives a list of the files contained in that “block” (even non-fragmented files). I haven't found another tool which could provide that information so clearly (I imagine that professional tools can do that and more but I can't afford any of them right now, so I make do with what's available). So, after identifying a few bad sectors LBA with HD Sentinel, I could isolate other files contained within the same area, put them in a separate folder so as to copy them last.

Quote:
:lol: :lol: :lol:

Heeey, you're laughing ! You think I'm funny, huh, you think I'm funny ? :shock:


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 25th, 2018, 15:00 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9418
Location: Portugal
The point is there are several causes fo "bad sectors".

If you have a bad sectors because you were writting to the drive and the power was lost or if you do have a bad power supply or a bad cable, etc or if you use WRITE LONG to write junk to the ECC, etc you will have a bad sector that it can be corrected by writting over to it. The sector itself is ok but the data on it it's not.

Also you might have just some sectors that can no longer hold data. Same for defects found at factory.

If you have for example 10 defects found at factory and added to the P-List you are just skipping over them. Drive will read the next good sector even if it have one bad sector on P-List right at the side !

This doesn't mean that you can't have platter damage. This is diferent. If the platter is loosing materials that can contaminate the heads you shouldn't read near the damage but chances are that the damage will propagate at any rate as heads still have to move from one place to the other on the platter and read servo, etc so there is no guarantee that the head will not float anyway on the same track where the damage is and it will be placed above the bad sector even if there is no read/write attempt ...

PBA is a Physical Block Address.

DM drives are just like this - viewtopic.php?f=1&t=36995

With thos sort of Sea"junk" as soon as the platter is on that condition it doesn't matter if you are reading near of far the bad sector as all the platter will be gone !!!

People don't do anything at all ... they should !!!

Like backup and replace bad drives with known good ones and don't buy Seagate !!!!

But it's very good as well that people don't care and continue to use drives in bad condition ... that is how data recovery firms can make a fortune !

Assume a TRACK with 500 sectors.
5 Sectors are bad.
You write a file that is fragmented it stores itself on the 5 bad sectors + 10 sectors on that track + the rest is stored on another place.
If hat you are saying is true you are safe, correct ?

Now let's say that you do have a single sector on the same track that is part of your windows installation as is used all the time, for example explorer.

Now everytime you run your computer and your os need to load that specific file it places the heads of the drive on the track with the bad sectors and even if the head goes above the sectors that are bad withou reading them the phisical proximity to that bad spot is exactle the same as if the sector were to be read ... and you keep moving your heads above those bad sectors ... so what ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 25th, 2018, 15:02 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9418
Location: Portugal
I would say if it's a Seagate F3 arch just trash it. If it's a Seagate ST-10 just self-scan it. Those are VERY GOOD DRIVES.

For WD you can run Self-Scan, for SAMSUNG you can use BURN, etc ...

http://www.hddoracle.com/viewtopic.php?f=46&t=2014

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 6:01 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
Quote:
With thos sort of Sea"junk" as soon as the platter is on that condition it doesn't matter if you are reading near of far the bad sector as all the platter will be gone !!!

I told you about my experience (it may not be statistically significant but it's real and I've seen it) : this ST3000DM001 (apparently the most dreaded model of recent years among DR professionals) remained stable for months until I specifically tried to access those files which contained bad areas (incidentally, once I had identified them, I first tried moving them with a simple cut and paste, but this caused Windows Explorer to parse them – those were MP4 video files – so as to generate a preview, and this was enough to add a bunch of “pending” sectors, so I had to move them through command line). I haven't tried to open it, now that it's totally toast, maybe I'll do it at some point and post pictures if what I find is interesting.
Is this pattern of deep rings on the platters' surface specific to those Seagate models, or can this happen as well with other models from other brands ? Is there a known trend of operating conditions (heat, vibrations...) which induce that kind of severe failure, or can it happen even in perfect conditions ? (It must be difficult even for professonals to assess the real conditions under which a drive operated, aside from the basic informations recorded by S.M.A.R.T. self-check routines... sometimes it must be like being an emergency doctor and trying to figure out how a dude could end up with four screwdrivers up his butt, after said self-deluded dude came complaining about an unexplained “pain in the ass” !)

Quote:
People don't do anything at all ... they should !!!

To be fair, the information is rather scarce on this subject, unless one is specifically (and painstakingly) looking for it on forums and whatnot. HDDs (or even computers, at least desktop ones) don't come with an operating manual, there's no common practice of bringing those devices to a maintenance professional on a regular basis, for routine check, as it's the case for cars for instance, and even on specialized forums there's a lot of B.S. as you surely know.
I've known people who were either working or studying in some area of informatics yet who thought that HDDs were nigh indestructible... that it was perfectly safe for instance to bump the computer case while in operation... And just this Sunday, I tried to remotely help a woman who had put an anoucement on a classified ads website saying that she had mistakenly deleted one video file, an interview shot with a Canon 5D for an upcoming documentary she's working on, hadn't used the SD card since, and was hoping to find someone who could recover it for a cheap price ; I thought that it would be a quick and easy task, proposed to do it for 10€... but in the meantime she had brought the SD card to her friend who works in networking, who supposedly knew his stuff about teh computerz... the guy used Recuva... and Recuva, although a surprisingly efficient recovery software in my experience considering that it's free (I haven't tried the commercial version yet) has one big caveat : it is not fool-proof, it issues no warning when a fool attempts to do the foolish thing, extract files to the very same device and volume... and indeed he did, I saw it right away... and so all I could do was painstakingly show her with WinHex that what used to be the begining of MVI_4917.mov was now overwritten with some portion of MVI_4904.mov (Recuva has this nice feature of reporting by which other file a deleted file has been overwritten, which is lacking in prominent higher-end softwares like R-Studio) and was thus lost for good... :? Same thing happened a few months ago... at least this time I'll get the payment, but it's still frustrating ! I told her that an important thing in such an activity is to know one's limits. (She must hate her friend now...) I also installed her a duplicate remover (DoubleKiller Pro, streamlined but powerful), showed her how I use it to make sure that files from a memory card have been flawlessly copied, and actually copied in the first place (she said she was tired that evening, must have made a mouse selection which was not large enough to include that file, then deleted everything right away, realized it later on) before deleting them, but she seemed to think that it was already an overwhelmingly technical task when there are so many things already to deal with when making movies, the script, the lighting, the shooting, the editing and so on... Things get so specialized these days, and there are so many informations to absorb in any serious endeavour, that it's almost impossible for most people to get everything right from the micro-level to the macro-level, some things have to be discarded, left to chance, or handed out to specialists when things go awry.

Quote:
But it's very good as well that people don't care and continue to use drives in bad condition ... that is how data recovery firms can make a fortune !

I may have the wrong impression, but from what I read here, it doesn't seem to be that big a business, and if some cases are relatively easy to solve, thus generate a relatively high income / effort ratio, others are much more intricate and don't get paid much more, so it averages out to a price which is “about right” for mere sustainability. Perhaps the larger data recovery companies which get contracts with other large companies are more profitable, but then they're less likely (I guess) to get regular computer users as clients.

Quote:
Assume a TRACK with 500 sectors.
5 Sectors are bad.
You write a file that is fragmented it stores itself on the 5 bad sectors + 10 sectors on that track + the rest is stored on another place.
If hat you are saying is true you are safe, correct ?
Now let's say that you do have a single sector on the same track that is part of your windows installation as is used all the time, for example explorer.
Now everytime you run your computer and your os need to load that specific file it places the heads of the drive on the track with the bad sectors and even if the head goes above the sectors that are bad withou reading them the phisical proximity to that bad spot is exactle the same as if the sector were to be read ... and you keep moving your heads above those bad sectors ... so what ?

This particular drive is used to store data only. Previously it was the backup of another WD30EZRX (which is still fine), to store TV recordings, then I transfered everything to a pair of bigger drives, verified/deleted everything, then I used it to temporarily store MKV files, which were thus copied sequentially (non-fragmented), and 4GB represents a quite large area, so I think that there's a good degree of confidence for the issue to be limited to that single file, for now. I'll see how it turns out. I would have proceeded differently if it had been a general-purpose drive full of files of any size and possibly fragmented.

Quote:
I would say if it's a Seagate F3 arch just trash it. If it's a Seagate ST-10 just self-scan it. Those are VERY GOOD DRIVES.

What models / capacity does “ST-10” refer to ? My porn collection is on a ST31500541AS, I need to know, is it at risk ? 8)


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 11:14 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9418
Location: Portugal
- If you do open that DM drive just don't even think about ever using it again to store anything at all. The drive will just be "gone" as soon as you open it outside a HEPA 100 aseptic room.

- This sort of damage can happen to any drive but some drives do have poor quality and it will happen more on those specific models. Same for example on this sort of IBM drives - http://www.hddoracle.com/viewtopic.php?f=42&t=1411 .

- Data recovery is a very high profitable business if you are clever !!! Check for example eBay for people operating there. People can charge for example $300 for simple file un-deletion and those services still sell. Also if you check prices of firmware recovery on data recovery firms the price is normally at the same level of head swaps and if not it's on the same level of hardware repair and never on the cheaper level like logic recovery. Many cases you just repair one module or two and you are good to go. You can add to your $600 charge for a simple 2 or 3 minutes module fix some extra $$$ for a new drive to copy the data to and some shipping costs ... Also you can buy a bunch of drives in non-tested condition or even get those for free from people working on the IT field check those drives and sell them for $$$. If you sell those drives with a note that they are special for data recovery guys and if you include some extra info like microjogs on WD drives you can even get that price higher for each drive that you do sell. Even if you do have bad drives with damaged heads you can still sell the PCB for "data recovery" and still ask even more money for those PCBs that you would ask for the entire drive. Even if you do get just a single case of firmware damage it will get you some considerable amount of $$$. Only "problem" might be head swaps that you do need to use parts- You can outsource those. Many people do only logic data recovery and imaging like using DDI4, etc ... And outsource the clean room work to bigger firms. Even so if you do charge $300 for those logic recoveries you will get considerable amount of $$$ very fast ...

- ST-10 drives.... 7200.10 drives and "older". 7200.11 and newer are F3 ARCH. If you plug a TTL to a Seagate and if you see T> instead of F3 T> you should have a ST-10 "classic" barracuda drive. BUT .... Older drives like U type (U6 for example) are MODULE BASED and do not use the same type of arch as ST-10. ST31500541AS I think it should be F3 ... Bye-Bye porn ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 18:23 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
Quote:
- If you do open that DM drive just don't even think about ever using it again to store anything at all. The drive will just be "gone" as soon as you open it outside a HEPA 100 aseptic room.

I wonder if I'm really passing as stupid enough to do something as foolish as opening a drive to just “look inside” in the hopes of recovering data, or if those are just generic words of caution aimed at anyone who could read that thread, now or in the future... As I said, I recovered as much as possible from that drive, it is now in a very unstable state, there's nothing more I could do with my current tools. A few months ago I created a thread about it (and another Seagate on the way out), my first one here actually, shortly after working on it to the best of my abilities (and making a mistake in the process by failing to clone the whole MFT first, but managed to fix it anyhow) ; I asked if there was anything else I could do (essentially hoping to get at least some of those six corrupted files in their entirety, as I could backup all the rest in time, flawlessly it seemed), apparently not (and even a professional couldn't fix bad sectors anyway), so at this point I consider it bricked. I'm still learning, but I think that I'm past the point of doing such a foolish thing and hoping a positive outcome.


Quote:
Data recovery is a very high profitable business if you are clever !!! Check for example eBay for people operating there. People can charge for example $300 for simple file un-deletion and those services still sell.

Well, that's not being clever, that being a crook ! :)


Quote:
Also if you check prices of firmware recovery on data recovery firms the price is normally at the same level of head swaps and if not it's on the same level of hardware repair and never on the cheaper level like logic recovery.

From what I've seen the average fee for strictly firmware-related failures is about half that of hardware-related failures (like 350 / 700). I have no direct experience in either, but it seems like the actual “active” time spent on the task can be similar, or even sometimes higher for intricate firmware failures (since the cloning or extracting operations can be done asa “background tasks”, while doing something else). Swapping head stack assemblies might require more experience, but once it's acquired, the time actually spent on the task is the main factor to determine how profitable it is.


Quote:
Also you can buy a bunch of drives in non-tested condition or even get those for free from people working on the IT field check those drives and sell them for $$$.

Again, that seems more akin to crook practices than respectable business activity...


Quote:
If you sell those drives with a note that they are special for data recovery guys and if you include some extra info like microjogs on WD drives you can even get that price higher for each drive that you do sell.

What exactly are microjogs ? If it really adds a special value for special purposes and requires special skills to get those informations, it's different.


Quote:
Even if you do have bad drives with damaged heads you can still sell the PCB for "data recovery" and still ask even more money for those PCBs that you would ask for the entire drive.

Again, crook practices, unless it's a very rare model.


Quote:
Even if you do get just a single case of firmware damage it will get you some considerable amount of $$$. Only "problem" might be head swaps that you do need to use parts- You can outsource those. Many people do only logic data recovery and imaging like using DDI4, etc ... And outsource the clean room work to bigger firms. Even so if you do charge $300 for those logic recoveries you will get considerable amount of $$$ very fast ...

Your initial remark was about using the self-check feature, in order to prevent some kinds of failures. Do firmware failures fall in that category, of failures which can be predicted / prevented by self-check routines ? From what I could gather, they tend to happen quite suddenly on the contrary, in which case it's kinda moot. (But, granted, having a proper backup solution and some common sense can prevent any kind of data loss, to quote someone's signature here : “a backup a day keeps the DR away”...)
As for the “$$$ very fast” claim, are there that many cases on average, relative to the average number of data recovery technicians in an average city ? And how many are basic enough to be solved (or totally screwed up sometimes alright ! :)) by regular computer repair technicians, who usually charge much less for a “logic” failure recovery ?


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 19:04 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9418
Location: Portugal
- Are you saying that you do want to recover the 6 files on the drive that are "stored" on the sectors that now are "bad" ? It might be possible at least partially. You will get the parts of the files that are stored on the good sectors and if you do patch sysfile 93 to stop re-location, etc you can use something like PC-3000 DE and do multiple reads on those bad sectors to see if hopefully one of the reads can get some data. If not at least you will still have the rest of the file. If it's a movie you might get away with just a little bit of damage (missing frames) ...

- You don't even have to go to eBay fo find "what looks like high" prices for data recovery - viewtopic.php?f=3&t=36887 - Logical failures will generaly cost $150 – $350 and we are talking about using professional services, cheap ones. If you go for bigger firms do expect to pay $600 even for logic failure. Another interesting thing is that firmware issues normaly are more expensive than logic failure and sometimes it's just a question of fixing one or two modules and the drive is back on-line and you only have to clone. Another example - viewtopic.php?f=3&t=36904 - Flash pen drives, way smaller than usb - Logical (up to 32Gb) - $175 ; Minor (logical/quick physical fix) - $350 CAD . Just to mention the more recent posts with pricing. NOT VERY EXPENSIVE if you consider this to be work done by a professional firm. To note that by "Logical" recovery we are talking about deleted files, damaged file system, formatted drives, etc ... assuming the drive itself is 100% ok and the only problem is with the data stored at LBA level. This sort of recovery normaly is done by the use of R-Studio or similar to copy the data that can be recovered to another place.

The problem with head stack replacement is that you do need parts and often those parts will get damaged. You don't have to worry about that with firmware. With PCBs it's easier because even if you do have to buy/use a donor one it's not very often that the new PCB will get damaged and you can re-use it for the next job. Heads will last 3-4 jobs and will end up dying. Some Seagate DM will typicaly require 3 sets of heads to clone ...

The more data you can provide about a drive like pre-amp, firmware, etc the more chances are for a "professional" to get the "match" that he needs. If you list a drive as "Samsung 500 GB" and you don't add extra info like firmware, pre-amp type, etc data recovery people trying to find a particular drive for PCB/HEAD swap will not know if the drive that you are listing is compatible for what they want or not ...

You can sell PCB of your broken drives and get some $$$ out of it !!! Looks reasonable. You can even offer ROM transference/adaptation fee and you are good to go ! Just try it !

There are firmware failures that are easy to predict, like when you start to see several pending sectors on some WD drives or when you pick up a F3 ARCH drive you know that those will fail for sure ! Others like HGST/Hitachi module damage are not that easy to "predict" unless you keep on checking if you can read al modules from time to time. But .. if you can read modules to start with than you should have a backup of them already so you can fix the firmware just fine using the native modules ...

You can try to post adverts on the net, etc or run a data recovery forum and the place where you live doesn't have any meaning anymore. You can have several data recovery houses operating near you and at the same time you might be receiving work by mail from all over the world.

Also as i stated just buy a lot of drives, like for example 20 drives for $40 or $50 and then refurb those drives and sell them for $20 or $30 each ... same for PCBs if you can't "recover" the drive .... Now advertize some data recovery work, get something like R-Studio and start to charge people lololol

Of course that if you already have something like an IT business you can for example start to offer "basic" data recovery services. Just clone the drives with hddsuperclone and extrat the data with R-Studio and you will manage to get at least some cases. Even if you can't fix firmware and damaged heads you can still charge $100 or $200 for your logic recovery and pay the taxes and be on the legal size without extra worries as you do already have on IT shop open to the public, etc ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 19:31 
Offline

Joined: October 16th, 2013, 13:21
Posts: 688
Location: Brazil
There is much difference between someone doing this on the back of his garage, and that will just tell the customer that it was impossible to recover his data, and the professional business, that have to pay taxes, personnel, and will not survive with telling those kind of excuses.

As for crook business ? That would be not informing the customer about costs and the possibility of increase in the price due to unknown things that will only appear after the service starts. If you explain what needs to be explained, tell the truth, and the customer agrees, it is a correct business.

And lets not degenerate this into another of those discussions about the right to define prices and the (sometimes low) value people place in the data recovery work. This kind of thing usually ends up on unpoliteness from many sides.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 26th, 2018, 22:41 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
Quote:
Are you saying that you do want to recover the 6 files on the drive that are "stored" on the sectors that now are "bad" ? It might be possible at least partially. You will get the parts of the files that are stored on the good sectors and if you do patch sysfile 93 to stop re-location, etc you can use something like PC-3000 DE and do multiple reads on those bad sectors to see if hopefully one of the reads can get some data. If not at least you will still have the rest of the file. If it's a movie you might get away with just a little bit of damage (missing frames) ...

That's what I asked about months ago in that other thread I linked. Last time I tried to work on it, the “reallocated” count was indeed constantly rising, even when the drive was idle. What tools are necessary to patch sysfile 93 ? (Maybe you already replied that, I didn't re-read the whole thread, but there was a lot of new information to process, and the general feeling from the replies I got was quite discouraging.) I don't have PC-3000 DE and certainly couldn't afford it right now. Most I could do is try again with ddrescue or HDDSuperClone. All six files are TV recordings, which were available online for just one week. I could find one on eMule P2P network (strictly identical file, same size and checked with WinHex) ; among the others, some are severely damaged, some have only a few small bad spots (see the ddrescueview[*] screenshots in that SuperUser thread linked above), one of them has only one bad 4KB cluster : I was hoping to at least get that one 100% recovered, for OCDness' sake, but indeed, just one missing cluster is barely noticeable.
I still consider myself lucky, especially now that I know about those drives' reputation to deteriorate quickly once they start to have issues. And anyway I'm hoarding so many such TV recordings (documentaries, movies and whatnot) that I'm actually watching a very small proportion of them, so I might have never watched those ones anyway ! :) We live in crazy hectic times, it's become strictly impossible to keep up with everything, and it's getting worse on a daily basis...

[*] I had the idea of using ddrescue's own “generate” mode to generate logfiles purposefully aimed at locating the bad spots within each file, and showing them simply and clearly when opened in ddrescueview. I don't know if there's another commonly used method to do this, but that one works like a charm. Copied from the SuperUser thread :
“I had the idea to use ddrescue's “generate” mode, which creates logfiles (or mapfiles as they're called now) by parsing the output and considering that totally empty sectors are unread sectors, marked “?”, the rest being marked “+”. Since ddrescue expects an input file and an output file, but only the output file is actually parsed in that mode, I created dummy input files with this command, which copies only 1MB but extends the size to the size of the output files (just to save time and space) :
ddrescue -s 1048576 -x 883789824 201707222358.mp4 201707222358copy.mp4
Then I ran the “generate” command :
ddrescue -G 201707222358copy.mp4 201707222358.mp4 201707222358-generate.log
And then I opened those files with ddrescueview [...].”


Quote:
You don't even have to go to eBay fo find "what looks like high" prices for data recovery - viewtopic.php?f=3&t=36887

Very interesting thread. I've found these statements to be relevant to what I wrote earlier :
“The money I make on donors is what pays for my time spent wiping, testing and keeping inventory on thousands of drives.”
“One possibility is to apply a "no result - no fee" or a "no result - small administrative fee" policy and take more margins on you work in order to cover the risk of an unsuccessful recovery.”
“For a short while, I contemplated sharing that risk, i.e., if the recovery is successful, they pay the full cost of the donor and I keep the donor, but if not, I absorb half the donor's cost and also keep the donor. Given the high cost of donors, I've decided that's just not feasible for a small-time DR shop like mine. If they don't want to pay for the donor no matter the recovery outcome, I'll just wish them best of success with whatever they decide to do.”
And the whole last post is about the idea of balancing out the price asked for each client with the risk of unrecoverable failure which costs time and sometimes parts with little to no reward. So just looking at the “profit” generated for re-selling drives, or to perform an easy task, is not enough to get a broader picture of how profitable the whole venture is.


Quote:
Another example - viewtopic.php?f=3&t=36904 - Flash pen drives, way smaller than usb - Logical (up to 32Gb) - $175 ; Minor (logical/quick physical fix) - $350 CAD.

Indeed that seems quite high, even in Canadian Dollars. But the first post says that increasing the price results in having less clients, all else being equal. And there is competition, so after some time the prices tend to average out, at least in populated areas where such services are relatively easy to find. Also, large capacity flash memory based devices are relatively new, the knowledge and tools required to deal with them are still rare, and as the last post says it's still a small part of the DR business — all those factors contribute to explain why the fees are higher in proportion of the device's capacity (which by the way must be weakly correlated with the amount of “active” work required for the whole task).


Quote:
This sort of recovery normaly is done by the use of R-Studio or similar to copy the data that can be recovered to another place.

And how do you explain that people are willing to pay such a high fee to get it done by a professional, if they have the possibility of doing it themselves by paying about half that price for an advanced software which they can keep for later use ? Or even using a free software, since something like Recuva (free version) is enough to get back deleted files in most situations (although it's not fool-proof as I said and can cause disasters by itself). On the other hand, I know for a fact that many people renounce paying for a professional recovery, even for important personal files, and prefer to either bring the device to 10 friends / relatives / colleagues who claim to be “good with computers”, or hastily read forums on teh Internetz and attempt some do-it-yourself method, then another, and so on... or directly open the drive hoping that it can be fixed like a car engine, y'know, tightening some bolt, putting some grease... at which point even a professional recovery becomes nigh impossible.


Quote:
The problem with head stack replacement is that you do need parts and often those parts will get damaged. You don't have to worry about that with firmware. With PCBs it's easier because even if you do have to buy/use a donor one it's not very often that the new PCB will get damaged and you can re-use it for the next job. Heads will last 3-4 jobs and will end up dying. Some Seagate DM will typicaly require 3 sets of heads to clone ...

Yes, I understand that this basically what you do, i.e. firmware fixing / PCB replacing, and I get why it's generally less tricky. But with the fees you ask, and the average amount of cases you get in a year, do you consider this activity “highly profitable”, “profitable”, or merely “sustainable” ?


Quote:
The more data you can provide about a drive like pre-amp, firmware, etc the more chances are for a "professional" to get the "match" that he needs. If you list a drive as "Samsung 500 GB" and you don't add extra info like firmware, pre-amp type, etc data recovery people trying to find a particular drive for PCB/HEAD swap will not know if the drive that you are listing is compatible for what they want or not ...

Alright, but that's still a large amount of work, as quoted above, and it requires large investments at the begining to deal with enough drives in order to present a complete enough catalog for professional to choose units according to their constantly changing needs. So I don't see this as a quick and easy way to get rich by exploiting people's ignorance and carelessness (even if those two things can be found in spades !).


Quote:
You can sell PCB of your broken drives and get some $$$ out of it !!! Looks reasonable. You can even offer ROM transference/adaptation fee and you are good to go ! Just try it !

I've seen people looking for PCBs on classified ads websites, but usually they expect to pay about 10€ for one. (And besides I suspect that most of them expect this to be the cure when their drive's actual failure is completely unrelated with the PCB. Sometimes I answer to such an anouncement just to ask them basic questions about their drive's symptoms, and imply that replacing the PCB might not be any useful.)


Quote:
There are firmware failures that are easy to predict, like when you start to see several pending sectors on some WD drives

Like, how many pending sectors should be raising alarms, and on which particular models ?


Quote:
or when you pick up a F3 ARCH drive you know that those will fail for sure !

Well, again, that's a bit exaggerated, since some of these drives work fine for years, and misrepresenting the global situation, since drives from all brands and models do fail no matter what, even when used in the best possible conditions. I now know that they are generally reputed as having an inferior design or being made with inferior materials, I will certainly check the ones I have regularly, just like I regularly check all my HDDs, I will take it into account when deciding which type of data goes to which drive (I have drives from almost every current manufacturer, except Toshiba — I've had one in the past, purchased new, which failed after just a few months, and the customer service was non-existant, I had to ask the seller for a refund, and was kinda lucky I could get it at all because said online seller disappeared shortly thereafter : that alone is a good reason to avoid that brand altogether), but I see no reason to just dump drives which are still operating perfectly, or re-sell them to people who most likely won't know anything about it (and I sure will have a hard time selling them if I say in the anouncement : “I'm selling all my Seagate hard disk drives because the overwhelming consensus among professionals on HDDGuru is that they are utter and complete crap, good luck with those P.O.J.” !).


Quote:
Also as i stated just buy a lot of drives, like for example 20 drives for $40 or $50 and then refurb those drives and sell them for $20 or $30 each ... same for PCBs if you can't "recover" the drive .... Now advertize some data recovery work, get something like R-Studio and start to charge people lololol

Well, those are tempting ideas, I'll think about it ! :) But advertising is definitely not my strong point, and it seems to be a crucial part in such a venture...


Quote:
Of course that if you already have something like an IT business you can for example start to offer "basic" data recovery services. Just clone the drives with hddsuperclone and extrat the data with R-Studio and you will manage to get at least some cases.

I already did that a few times, but so far it's been excruciatingly painstaking tasks for the money I asked. Last summer, I found a guy who had a 1TB HGST drive which had failed all of a sudden, he said that it was clicking, which sounded bad, I didn't think that I could do anything, but he was adamant that he would not pay the high fee of a “true” professional recovery (here are the prices list of the only data recovery company in the whole region where I live if you're interested), so he gave me “carte blanche” for the 50€ service fee I proposed ; and to my surprise, when insisting a few times, unplugging and plugging it again, the drive would stabilize, I could run ddrescue and start imaging it, albeit very slowly (after reading a ddrescue guide in french mentioning that writing to a NTFS partition was not recommanded and could by itself cause slowdowns for large volumes, I asked about it on SuperUser, proceeded to create an Ext4 partition and resume the cloning, saw only empty data in the preview but didn't know yet that it was perfectly normal, started all over again, surprisingly there were no skipped area at all in the first 150GB or so, as opposed to the first attempt, but then it slowed down to a crawl way before it did on the first attempt). It started to become more unstable, and I gave up after about four days (and I could barely do something else as it was very hot, I tried to keep the drive cool with a laptop computer cooler and cold packs...), it had recovered about 250GB, but by luck the client had only about 200GB worth of data on it, and when I analyzed the output with ddru_ntfsfindbad from ddr_utilities, I found out that only about 130 files in personal folders (i.e. excluding system and programs files) were partially or totally corrupted. So I extracted all the files with R-Studio, and then, by my own initiative, and without charging anything more for it (well, I thought of it as practice, and a compensation for my rookie mistakes, without which I may have been able to get a slightly higher recovery ratio !), noticing that there were many duplicated files on the drive, I set about fixing as much of the damaged files manually, by first detecting them with DoubleKiller (scanning the whole recovery for files with the same size, disabling the CRC analysis), then opening the two or three instances in WinHex, and seeing it the corrupted area(s) from one instance could be copied-pasted from another, and the other way around : in most cases, indeed, either one instance was complete, or two instances were damaged the corrupted sectors were in different spots, so I could rebuild the original complete file. At the end of this quite daunting task, there remained about 20 corrupted files, among which six low quality DVDrip movies, a bunch of unimportant Web pages elements, so only a handful of personal videos were partially or completely unreadable (I also repaired a few MP4 files with a missing index using Grau Video Repair). And then as the dude was dumb enough that he didn't find the recovery, although I had made a complete report with detailed explanations taking into account his very basic knowledge level (he expected to find his personal folder or Windows' “desktop” right away, just like when turning on his computer, not nested deep in the directory tree), I spend an extra hour showing him through remote assistance where his files were, and trying to show him a few tools and tricks to backup them and organize them, which he probably forgot right away... :roll:


Quote:
Even if you can't fix firmware and damaged heads you can still charge $100 or $200 for your logic recovery and pay the taxes and be on the legal size without extra worries as you do already have on IT shop open to the public, etc ...

I currently don't have a legitimate business to begin with, which is indeed making things more complicated... But in my area, I've seen data recovery fees by computer repair shops or freelance technicians (for logical recovery obviously) closer to 50€ than 100-200€.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 27th, 2018, 0:03 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
Quote:
There is much difference between someone doing this on the back of his garage, and that will just tell the customer that it was impossible to recover his data, and the professional business, that have to pay taxes, personnel, and will not survive with telling those kind of excuses.

As for crook business ? That would be not informing the customer about costs and the possibility of increase in the price due to unknown things that will only appear after the service starts. If you explain what needs to be explained, tell the truth, and the customer agrees, it is a correct business.

And lets not degenerate this into another of those discussions about the right to define prices and the (sometimes low) value people place in the data recovery work. This kind of thing usually ends up on unpoliteness from many sides.

Well, if you read carefully what I wrote, I just tried to get a more nuanced perspective, in reply to “Spildit”'s statements about the supposed high profitability of the data recovery business (based on the fact that many computer users are ignorant and careless). I spoke about “crook practices” for very specific examples — of someone abusing clients' ignorance to sell an easy service at a very high price (“$300 for simple file un-deletion” : this is clearly abuse), or selling refurbished drives for the same amount as new ones (although I may have misunderstood that part, maybe it meant : purchasing non-tested drives in bulk for a cheap per-unit price, then thoroughly testing them, then, and only then, if they pass all the tests, re-selling them at a “fair” price, i.e. significantly cheaper than brand new ones, but still at a higher price than they got purchased so as to make it profitable — but in that case, I don't think that this can be highly profitable, as it takes a lot of time to thoroughly test a drive, and most likely many of them on average don't pass the tests and get discarded as defective, or re-sold for parts for a much cheaper price). I never implied that data recovery in general was a crook business, on the contrary, my point is that, despite the common perception that the fees are very high (regular users often compare them with the price of the device itself, and don't understand why such a service is about 10 times more expensive on average), I get the feeling, especially since I read this forum, that it is not the right career choice for someone who just wants to make big bucks quickly and effortlessly, it seems to require a lot of dedication, and an ability to cope with a good amount of frustration on a regular basis.

What I don't understand is how HDD's manufacturers can get away with not providing aftermarket parts for at least their current lineups of models with all the relevant data readily available to find the proper match, or schematics, or informations to deal with firmware failure (which from what I understand have to be retro-engineered by the conceptors of dedicated software tools, hence their staggering price tag), all of which would make those tasks considerably easier, less time-consuming, and thus cheaper for the clients. Things like this are considered standard practice in the vast majority of manufacturing activities, even when it comes to computers, despite the strong competition and the inherent industrial secrecy in the development of CPUs for instance, detailed schematics of their inner architecture get released officially, so why is it different for storage devices, which are more prone to fail than most electronic equipments, and can cause much greater damage when they do fail ?


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 27th, 2018, 8:07 
Offline

Joined: October 16th, 2013, 13:21
Posts: 688
Location: Brazil
What we may call easy ( recover deleted files ) may not be easy to other people. We had an example a couple threads before : I think it was you who told about a customer that used Recuva but recovered the files to the same disk. And many other things can go or be done wrong. So, if one don´t want to learn how to do it, he needs to pay the price of someone that does. Simple as that.

Same thing as a 7200.12 disk. If someone reads just one page in the internet, and goes using the old 7200.11 commands on it, then do not complain when things get much worse and he now has to pay a lot do deal with a partial accessbility problem.

You described a lot of procedures as "crook business". Maybe you understood them at the wrong way, as you stated. Most are just normal practices, the same as a doctor charges a lot of money just to recommend some medicine.

HDD manufactures could supply parts, and people would complain about price and demand support. Then manufacturers would supply support, and charge for it, and people would still complain. So, no way for it.

And good luck finding internal schematics of anything newer then a P4 ( even older ) . Can you get a schematic of an Intel chipset with SATA controller, complete with programming guide ? Don´t think so.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 27th, 2018, 15:26 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9418
Location: Portugal
This is a big post now and we are no longer talking about recovering the RAW NTFS partition !

So i will try to short the answer now.

- To patch sysfile 93 you can use F3 ARCH firmware tools or get the file by hyperterminal and patch it with hex editor. Also you can use congen commands with terminal.

- Just re-download those videos or run some video fix software when you do extract the files from the drive using some logic data recovery software.

- If it's just 6 file you can donwload them again and you are done. If not use r-studio, copy the files out and try to fix them with some video editing software.

- Those guys that do need drives for head stack replacement most likely have a business related to data recovery and they are doing a considerable amount of head swaps so they will not buy drives and re-sell them, they will just buy drives and keep them for later use on head swaps. They will not make a living in selling drives. The goal is to get drives to have for future use and not sell them. So there is no money gain from selling drives just money invested in buying drives in hope that they will be of use in the future.

- Doing logic data recovery on the flash cards and pens are more or less like doing the same on normal hard drives with the advantage that they are smaller and faster to access. So you can use the same tools like R-STUDIO and recover the deleted data. Now physical problems are another matter ...

- Majority of people will try to get the data first and only when they see that they can't and they panick out thinking they will not see the data again than they will consider the use of a professional service.

- “highly profitable”, “profitable”, or merely “sustainable” ? Depends of the person doing the recoveries ? Depends of if you do have an open shop or not ? Also if you do know what you are doing or not ? And also if you are a scam artist or not ? If you can "lure" clients even with "fake" capabilities (that you don't have) maybe you can make fortunes. I don't know ...

- People do panick when their data are gone. If you sell some PCBs on ebay for example people will eventualy buy them thinking that a new PCB will make the drive work again and get their data back. After all they will rather pay you $30 or $40 for a PCB that most likely will not work rather then pay $600 for a full data recovery service.

- For me i wouldn't trust a drive if it started to report pending sectors unless the cause of those sectors were to be obviouse and not drive related, like for example if you do mess up with write long ATA command by yourself.

- If the seller of the Toshiba drive "disapeared" the problem is with the seller not with the brand ...

- The way you fixed the 1 TB HGST makes me think that you are a very lucky guy ! Your procedure is full of problems ... If you are cloning with ddrescue or hddsupertool or whatever and you do your homework you wouldn't be letting your OS to access the drive (mount) and because of that it shouldn't matter what partition the drive does have as you are working at LBA level only. You should NEVER write to a drive that you are attempting to recover from.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 27th, 2018, 15:35 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9418
Location: Portugal
- As for buying and re-selling drives i was thinking among the lines of buying 20 or 30 drives for $20 under "untested" "removed from working computer" sort of listing and just secure erase, check S.M.A.R.T. and re-sell those for $20 each. If drives are bad re-sell the PCB for $20 each. That sort of thing ... Of course "testing" doesn't have to be necessarly very time consuming. Just get a bunch of cheap PSUs, plug the drives there and just use secure erase on them at the same time. The ones that can't be re-sold can still serve as PCB donnor.

- Even if you do buy things like PC-3000 you still need knowledge to opeare it.

- Data Recovery can be used to get $$$ fast and without problems as well even more on some countries where people will buy chinese translated tools and will do some operations charging like big firms and destroying many drivs on the process.

- There are people on some countries that can buy or download firmware tools and fix one or two drives and charge $1000. Even if they destroy all the other drives and get clients angry they can get away with it and they will still make $2000 from the 2 drives they did manage to recover.

- It's not that hard to make a firmware tool as long as you can figure out the Vendor Specific Commands to use. Because this info is very rare to find on the net people don't have the commands to work with the drives and have to buy the existing expensive tools. There are still cheap alternatives like SeDiv but those do have problems as well. At any rate is better than nothing.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Weird logical issue (“RAW” NTFS partition)
PostPosted: June 28th, 2018, 18:06 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
@rogfanther
Quote:
What we may call easy (recover deleted files) may not be easy to other people. We had an example a couple threads before : I think it was you who told about a customer that used Recuva but recovered the files to the same disk. And many other things can go or be done wrong. So, if one don´t want to learn how to do it, he needs to pay the price of someone that does. Simple as that.

Of course, but don't you agree that $300 is exaggerated for that particular kind of task ? Unless someone is wealthy and willing to pay a premium to get it done by a major corporation with a stellar reputation, which is akin to some rich dude inviting over Jim Carrey to tell jokes at his wedding party to make sure that nobody's bored... or Iggy Pop, on the contrary, to be the “chairman of the bored” !)
On the other hand, I'd be interesting in knowing the average pricing for the kind of task I performed when manually repairing about 100 files out of an already very satisfying recovery (100% of the owner's personal pictures were already recovered for instance) — because that was another story, definitely painstaking and time-consuming ! Is this usually charged on a per-file basis, or according to the actual time spent on it, or added as a global service for a fixed fee ? Is what I did a standard practice (identifying possible duplicates so as to repair damaged files), or is it done by completely different methods ?


@Spildit
Quote:
To patch sysfile 93 you can use F3 ARCH firmware tools or get the file by hyperterminal and patch it with hex editor. Also you can use congen commands with terminal.

Alright, if I need to search more thoroughly on that issue I have enough key words... :)
(I've already tried to read several related threads but without practicing it's a bit like reading a phone book...)


Quote:
If it's just 6 file you can donwload them again and you are done. If not use r-studio, copy the files out and try to fix them with some video editing software.

If you saw the SuperUser thread, I went the painstaking way of :
– getting and saving the list of sectors for each of these files (using three methods : with HD Sentinel, Recuva, nfi.exe) ; some of those files were highly fragmented, probably because they were downloaded simultaneously (8000-12000 fragments) (at this point I had no idea that this would prove very useful later on, I was merely trying to gather as much information as possible before proceeding with an actual recovery attempt, and more specifically to determine the interval of sectors I would have to extract if proceeding with ddrescue to encompass all six files in their entirety) ;
– making a partial clone with ddrescue, large enough to include all six files (based on the information gathered in the first step), plus, IIRC, 10GB at the begining (I could have done a full clone right from the begining, but judging retrospectively from the way the drive deteriorated once I tried to access those bad areas insistently, I think that I had the right intuition and did the right thing, since those bad areas were around the 2TB mark on a 3TB drive, and a significant chunk of the MFT was located right at the end, the overall recovery success might have been vastly inferior and I might have had way more than just 6 corrupted files, so from that experience I would say that cloning is not always the best option when dealing with a failing drive, especially for a home user with no access to advanced hardware-assisted software tools) ;
– since the 10GB chunk at the begining didn't contain the whole MFT I was kinda SOL with the regular methods of extraction, hence why I created that thread, got no relevant input, but managed to use ddrescue itself, and edit the list of sectors (using Calc from LibreOffice) to create custom command files, so as to re-generate the whole files, fragment by fragment, but in an automated way... (And that wasn't just luck, it took some thinking and effort to fix my fuck-up !)
At that point the drive had become too unstable, and without the complete MFT, neither R-Studio (even – IIRC – with a .scn scan information file made prior to the drive's severe deterioration) nor WinHex (with – for sure – a volume snapshot made before when the whole drive was still accessible) could extract those files. So I had to improvise...
“We're into plan B. You still breathing? We gotta make the best of it. Improvise. Adapt to the environment. Darwin. Shit happens. I Ching. Whatever. We got to roll with it.”
(Collateral)
My other option would have been to directly copy those six files on Windows (when the drive was still stable enough i.e. before the partial cloning attempt) with Roadkil Unstoppable Copier (which is designed to skip bad sectors but on a per-file basis). I don't know if it would have resulted in a better or worse recovery rate, but it sure would have been less tedious than this !


Quote:
If the seller of the Toshiba drive "disapeared" the problem is with the seller not with the brand ...

Western Digital and Seagate provide a direct RMA service, no need to deal with the seller, so no such worry. (WD even proposes an “advanced RMA” service, meaning that you get a replacement drive and then have a one month delay to return the defective one, which is tremendously appreciable as it allows to make a proper cloning or transfer of the whole contents even when there's no extra budget currently available to purchase a replacement unit. Surprisingly enough, I still haven't had to deal with Seagate's RMA service : my Seagate drives which failed did so past the warranty period ; some of them have been purchased used / second hand market, including the one this thread was initially about, which for what it's worth was used in an orthodontic practice.) Whereas, in Europe, for retail 3.5" internal HDDs, Toshiba doesn't provide any direct RMA at all. (Probably because they have a very small market share ; from what I read, Toshiba began to produce 3.5" units at WD's request, just so that the two giants could be compliant with anti-trust laws. From Western Digital Wikipedia article : “In March 2012, Western Digital completed the acquisition of Hitachi Global Storage Technologies and became the largest traditional hard drive manufacturer in the world. To address the requirements of regulatory agencies, in May 2012 WDC divested assets to manufacture and sell 3.5-inch hard drives for the desktop and consumer electronics markets to Toshiba.”)


Quote:
The way you fixed the 1 TB HGST makes me think that you are a very lucky guy ! Your procedure is full of problems ... If you are cloning with ddrescue or hddsupertool or whatever and you do your homework you wouldn't be letting your OS to access the drive (mount) and because of that it shouldn't matter what partition the drive does have as you are working at LBA level only. You should NEVER write to a drive that you are attempting to recover from.

How do you figure from what I wrote that I tried mounting it before the cloning part was over ? ddrescue does have a preview option, which shows the bytes being copied at any moment, if that's what you're alluding to, that's where I saw at some point that only 00s were copied – I just didn't know yet that this was normal since a large portion was actually empty, and it was a mistake to stop it ; but the strange thing is that, whereas there were many slowdowns and skipped areas at the first attempt, it copied flawlessly and at a constantly high rate (around 50MB/s) the second time around, although it became unstable earlier. I still made mistakes and was still kinda lucky, but not for the reasons you seem to think.
What I should have done right from the begining (I learned about it halfway through) is using ddru_ntfsbitmap from ddr_utilities to 1) first get the whole MFT ; 2) generate a mapfile to restrict the cloning process to actually allocated areas (less than 25% as it turned out — I couldn't know it at that point unless the owner had told me, but he was probably too clueless to even know about that) ; 3) run the cloning process with ddrescue and that mapfile loaded with the “-m” switch ; 4) optionally, run a pass without the mapfile, to try to get the unallocated data which may still contain useful remnant of files.
As a matter of fact, when doing the repair procedure at the end, there was one set of instances of the same video file for which one was partially corrupted, and the other was totally empty/blank : I figured that the empty one was probably on the unallocated space, because it had been deleted, and skipped by ddrescue because at that point I was using ddru_ntfsbitmap's mapfile. So, using the first sector LBA information found in R-Studio and making some calculations, I figured out where exactly on the image file that second instance was located, and made a custom ddrescue command to extract just the end of the file which was corrupted on the first instance, a mere 20MB... and it worked perfectly on the first attempt : the copy was quick and flawless as this happened to be a good area of the drive (or an area read by a good head ?), and the patch matched perfectly (I purposefully extracted a few extra sectors to make sure that they were duly identical), the file could be repaired completely and was playable to the end. I'm rarely proud of myself, but in that moment I was ! :)
Oh, and I created an image file with ddrescue, I didn't make a direct clone, that's why the destination partition was relevant. At first I wrote that image – on a Knoppix live system – to a NTFS partition, so as to be able to access it easily on Windows in order to do the extraction with R-Studio. Then I read on this french guide that writing an image file with ddrescue to a NTFS partition had been reported to cause significant slowdowns. Translated quote :
“Avoid using a NTFS partition to store a disk image of important size (more than a few GB). Several persons have reported that the recovery slows down progressively, to such an extent that it's impossible to finish the recovery.”
Then, since the copying rate had gone down to about 600KB/s, I asked on SuperUser if at this point it was worth the trouble to stop the process, create an Ext4 partition, transfer the image and resume the process. At someone's suggestion I created another thread dealing more specifically with the possible impact on performance of writing sparse files to a NTFS volume on a Linux system. The replies I got in both threads were inconclusive, but I still went through with it, with the results described above.
(Sorry, many words again, but apparently I was misunderstood, despite my best efforts to be clear and thorough and write in as good english as possible ! :) Still, I think that this is an interesting issue, which may deserve its own thread...)
(I shall add that this seems to be a general problem on this forum : even when some issue or method is exposed clearly, especially by non-professionals, whose knowledge and skills are naturally disparate, inhomogeneous, the first few replies – and they can be the only ones if the OP doesn't insist and/or doesn't understand that he or she was misunderstood – are often based on assumptions or prejudices, which may be related with very common mistakes or misconceptions that professionals encounter regularly, but it doesn't mean that each and every rookie will repeat them cluelessly. Sometimes I read a first post which explains an issue or asks a question quite clearly, I can understand what that person did or means, even though I may not be confident enough to provide a perfectly accurate reply, yet the first member who replies does it based on what the “average dude” would have said or done in a similar context, not on what was actually stated.)
Just to illustrate, the final recovery image looked like this in ddrescueview (is it consistent with one failing head ? model was HDS721010CLA332) :
Attachment:
ddrescueview Hitachi1TB2 201709100503 mod - grid size 4px.png
ddrescueview Hitachi1TB2 201709100503 mod - grid size 4px.png [ 25.16 KiB | Viewed 231 times ]



Quote:
As for buying and re-selling drives i was thinking among the lines of buying 20 or 30 drives for $20 under "untested" "removed from working computer" sort of listing and just secure erase, check S.M.A.R.T. and re-sell those for $20 each. If drives are bad re-sell the PCB for $20 each. That sort of thing ... Of course "testing" doesn't have to be necessarly very time consuming. Just get a bunch of cheap PSUs, plug the drives there and just use secure erase on them at the same time. The ones that can't be re-sold can still serve as PCB donnor.

Alright... In that context it seems fair (depending on the drives' capacity of course).
Time-consuming : again, depends on each drive's capacity, relatively quick for a sub-500GB unit, but can require the best part of a day for the largest capacities currently available. But yeah, with such a custom setup it doesn't have to hamper a whole computer. Still, is just a PSU enough to run that command ? I understand that this function is embedded within the firmware, but how do you issue the command itself ?


Quote:
- Data Recovery can be used to get $$$ fast and without problems as well even more on some countries where people will buy chinese translated tools and will do some operations charging like big firms and destroying many drivs on the process.
- There are people on some countries that can buy or download firmware tools and fix one or two drives and charge $1000. Even if they destroy all the other drives and get clients angry they can get away with it and they will still make $2000 from the 2 drives they did manage to recover.

Yeah, but I think that almost every pro member here will agree that these are unfair and unethical practices... and they damage the reputation of the whole data recovery activity.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 60 posts ]  Go to page Previous  1, 2, 3

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Bing [Bot] and 29 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group