Hitatchi drive clone

[saggy]

Hiya

Again I have a bad drive. Hitatchi 2.5 500gb SATA
Symtoms are that BIOS reports it is bad, no windows OS will load while it is slaved. If used as a usb drive, windows will say it needs to be formatted. If i connect it via usb and run GDB or R-Studio I can see all the files-once its stopped locking up the system.

If I use linux, depending which distro I use, I can see the files also. dd_rescue for cloning is painfully slow and was 1% after 4 days. (

Media tools pro for cloning reports read sector errors, I/O errors after sector 35 and every part it scans after that results in a error (got to 9000 errors and counting). I tried doing it in reverse and it results in the same error but straight away .

The data on this drive is not critical, and again this is me trying to learn on a dummy drive really......

Any suggestions appreciated

[pclab]

You probably have alot of bad sectors.

If you don't have other tools, the best is really ddrescue.

[saggy]

ddrescue or dd_rescue? or i think there is a GUI ddrescue too lol

[loki]

Hi,

Agreed yes most likely lots of bad sectors.

As this is for learning you have seen software cloning is going to take ages & possibly kill the drive in the process. Saying that it is always best to clone the drive if you can first.
This is where a hardware imager is best but as you dont have one your options are limited.

You could try the following at your own risk?

You say the PC locks up when seeing the drive? You could try downloading Winhex & then running that.
Press F9 & select your drive. If you scroll down abit to you see line 00000001F0 you will see that at the end of that line it will say 55AA, Change that to 55BB & save & close down winhex. This will stop windows trying to mount the partition when connecting the drive.
Unplugh the drive & then reconnect it. It will probably ask you to initialise the disk but dont do it.

Make sure you have Runtimes Disk Explorer for ntfs installed
Run GBD & click next on the first screen.
Select the drive & then click on the explorer icon (this will open up Runtime Disk Explorer software)
Double click on the NTFS partition
Then click on Goto
Then click on Root directory
Hopefully you should see your folder & file structure
If you click the blue text that starts with x it will open that folder via the mft.
Hopefully you will be able to save the files or folders?

Hope this helps & makes sense?
To set the drive back again use winhex & change the 55BB back to 55AA.


Loki

[saggy]

Press F9 & select your drive

This is the damaged drive? or the drive with my os on?
If its the damaged drive then I cant run winhex as I cant boot to windows with it attached.

[loki]

Press F9 & select your drive

This is the damaged drive? or the drive with my os on?
If its the damaged drive then I cant run winhex as I cant boot to windows with it attached.

You said "If i connect it via usb and run GDB or R-Studio I can see all the files-once its stopped locking up the system" So you must have a running OS? or did you use a boot cd like linux?

Yes F9 & select the faulty drive.

[SquaL]

saggy, when you switched to reverse clone, was that without rebooting the computer? If not then you could give that a try. Restart, choose reverse clone and see if you get different result. You may also try starting at different positions and see if you skip errors.

[saggy]

loki - blonde moment

Squal - yes that was with a reboot between

[loki]

No worries we all have them

[saggy]

What is the difference between recovering direct from GDB and Disk explorer?

I have used GDB before but never Disk explorer. The latter seems a lot more "hardcore" and probably beyond my limited knowledge, at the moment anyways........ Rome was never built in a day

[loki]

What you will be doing is using GDB to read & parse the MFT to Disk Explorer. The MFT holds info on file names, file / folder structure & start sectors for the files etc - in basic terms think of it as a contents list or index in a book.
Then you can copy off the files directly which will be quicker than imaging the whole drive first & then running software to recover the data.

Your drive has bad sectors on the platters which could be where the OS is stored or where some of your data is stored or most likely both. By trying what I suggested you will be going directly to your data & copying it off & bypassing the rest.

Loki

[saggy]

Hiya

Good results so far - though the program is freezing every 2-3% saying not responding - then jumping back to life - then freezing.

Im currently under Windows 7 - would it be better using it under Win XP? I like my old OS tbf - pure and simple - just like its owner

[loki]

If its working well done
Looks like you do have some bad sectors where your data is.


Loki

[saggy]

loki, Thank you very much for your help and patience.

Does that Hex editing work for just hard drives or all media? My brother came to me with a Sandisk USB stick with it freezing the system up and saying it needed formatting. So he just formatted it and everything was fine after that.

Does not unmounting these USB devices properly a cause the same kind of issues? Im sure we have all pulled them out in the past.
Slightly O.T so sorry to the mods in advance

[loki]

Yes you can change the 55AA to 55BB on use pen drives also.
Win7 allows you to remove without using the safely remove hardware wizward but in XP you should use it.

[saggy]

Well I think I spoke too soon

Disk explorer looks to have throw its toys out the pram and reported some I/O errors and appears to be frozen.

Parp

[saggy]

Well Im not sure what happened but the drive just vanished off the system.
Restarting the system and running the software and its back again

[loki]

Thats normal, when a drive reads a bad sector it can hang the drive & require a power reboot to get the drive working again.
Software images cant control power but hardware imagers like the ddi can & can continue from where it last was.

You'll just have to keep repowering the drive & work out what you have already copied.

Loki

[saggy]

So if you know which the bad sectors are you could scan around them? so easy lol

[SquaL]

saggy, did you by chance have "last read retry" (may not be correct name, going off memory) check box unchecked when you were using media tools?