What is best to do with a failing HD to recover data?

[przemke]

If classic hard disk is failing then what is best to do to increase chances of recovering as much important data as possible ? (and not spending large amounts of money on clean room companies etc)

Yesterday my GF's laptop went blue screen, rebooted and then the bios seen no HD, then showed some SMART warning. Then I immediately disconnected the laptop and battery. the HD is 250gb from FS laptop about 5 years old
So clearly it's time is over soon (if not already I hope).

And YES the situation is CRITICAL because it's her laptop with tons of pictures, private documents etc and I was using it when it happened so I surely will be to blame

What are actually my options assuming there may be little time when the HD is powered again?
1. I think I can connect it using USB case and try copying most important files straight to another HD (internal/external), maybe I'm lucky enough to get essential data back
2. or first make an sector-by-sector image onto a different drive using some software or linux. If successful I have best chances from then but if it ultimately fails duing making the image I may loose everything. Also with my recent experience with recovery/image software from and SD card - those programs usually stop/freeze when encounter some bad sectors/problems so creating the image may not be successful at all.
3. If it doesn't want to work at all I may try freezing it first (and preventing condensation) but I read that works in only some cases
i don't think anything else can be done ?

Please share your thoughts and experiences

[lcoughey]

If the drive detects and reads, use ddrescue in Linux to get a full sector-by-sector clone. If you are unable to do that or the drive starts to make any strange noises, STOP and seek the assistance of a professional data recovery lab BEFORE it require a physical clean room to recover the data. Yes, just because the lab has a clean room, doesn't mean that the clean room is used for every job. I can't speak for others, but we prefer to get the drive before it gets to the degraded stage that requires clean room work.

Edit:
I forgot to mention...what do expect the freezer to accomplish. I can assure you that you would be wasting your time and potentially be making things worse. So, don't do that, please.

[przemke]

Thanks for reply.
ddrescue would be OK for start but doesn't it stop/freeze when encountering problem on disk ?

I accessed it from usb and works almost fine, apart when attempting to copy one folder it hanged..made some noises and become inaccessible completely until I reconnected it. So I doubt a program or ddrescue would manage to omit that while putting stress to the dying disc? (when data can be accessed straight instead as I am doing now)
This is the problem I wanted to address.

So far much of the crucial data was copied, I am working on the rest. I am aware of the risk but I also probably can't afford now any kind of professional help

Regarding the freezer I read reports from cases when it helped a lot - to make disk work long enough to copy data - but that's to limited cases when electronics are the cause of failure or sth like that
What bad could I do to disk if there will be no condensation ?

[lcoughey]

ddrescue would apply less stress on the drive than thrashing the heads all over the place to read both fragmented MFT, over and over again, and the files you are trying to copy off. With the help of a log, ddrescue would only ever touch a single sector once. If you have to reset, you never read that sector again and pickup where you left off.

[warnerr]

if this drive was submitted to a recovery lab it would be imaged on hardware that would duplicate drive 'jumping past' bad sectors. This is a relatively inexpensive service. Next best option is using software based duplication such as Luke mentions- these are programs that can copy drives but handle errors. Third option is riskiest- put drive on working computer via usb adapter. Suggest you FIRST copy important files such as pictures to host computers storage. Don't checkdisk or run and utilities. Concentrate on important files. If you don't know where they are located on drive find help before attempting. If it isn't going well- turn it off and SEND IT TO A PRO!!!! Good luck.

[przemke]

Thanks for making things clearer.
Well I managed to copy actually everything, starting from most important stuff down to some least important movie rips, no writes, no chkdsk (that one I knew I shouldn't do after screwing recovery options on a usb stick once Only the folder that it previously hanged on makes problems and it's making some noises mostly then.
Files there were created when I was recovering pictures from seemingly faulty SD card using Recuva then the freeze and smart failure happened.
So I started wondering - maybe the bad sectors are logical and can be fixed ? and the sounds are when the HD moves head often by simply retrying to read those and thus it is normal operation?
Could it be that I replicated bad sectors from SD card to the hard drive ?

SMART from everest attached - reports warning only on 500 bad sectors (hdtune wouldn't read smart from the usb case)

Attachments

[Vulcan]

So I started wondering - maybe the bad sectors are logical and can be fixed ? and the sounds are when the HD moves head often by simply retrying to read those and thus it is normal operation?

That depends what you mean by "normal". In the event of read errors, then there will be retries - but there should not be (any significant number of) read errors in the first place!

Could it be that I replicated bad sectors from SD card to the hard drive ?

For any normal user software (e.g. OS copying of files), the answer is no.

[Edited for minor grammar error.]

Last edited by Vulcan on June 13th, 2013, 13:08, edited 1 time in total.

[przemke]

By the way I become interested: which are the most important values of HD usage indicating it's lifespan that can be seen in the SMART ?
I guess this relates to values like: power cycle, power-on time or start/stop count?

is there any range for these to be be high/low ? I also don't get the spin-up values - which column is proper her - 1650 ?

[przemke]

yeah but is Recuva a normal user software ? maybe it has bugs when writing files and could cause all the commotion ?

[Vulcan]

Re: SMART - There are lots of opinions and interpretations. Some details are not publicly documented and can vary between drive makes & families. Personally I have not found the attributes which you list, to be useful in predicting future lifespan.

I suggest you start by reading the Wikipedia article on S.M.A.R.T. - personally I don't agree with all of the opinions in that article, but it is a reasonable start for beginners and shows some of the complexity which is involved with trying to interpret the various attributes. It also explains why you have to be cautious about using the "raw values" like 1650, in your example.

There is also a good research paper by Google on how some SMART attributes have a correlation with increased chance of disk failure in the near future - but even that paper is just a guide. If you can't find that research paper by searching, perhaps someone will be kind enough to give you a link.

yeah but is Recuva a normal user software ?

Yes.

maybe it has bugs when writing files and could cause all the commotion ?

No, based on my knowledge of the (S)ATA protocol, disk drive behaviour and Windows programming, it could not cause the exact symptoms which you describe. However if you want to stay with this hypothesis, I will turn the question around: How do you suggest to prove that your hypothesis is correct?

[przemke]

Great insight for me, thank you.

I think only way I can prove my hypothesis is when the bad sectors turn out to be logical and disk works fine from then.
I'll have to use mhdd I assume and zero the whole disk? I got a replacement drive already for system and this will be bonus external storage if it indeed lives

But can the reallocated sectors reported in SMART be logical ? There's also 0 "reallocation event count" and 3 for both "raw read error" and "current pending sector" - could those 3 be the actual physical bad blocks ?
Do you know how those values/factors relate to each other ?

[przemke]

ddrescue would apply less stress on the drive than thrashing the heads all over the place to read both fragmented MFT, over and over again, and the files you are trying to copy off. With the help of a log, ddrescue would only ever touch a single sector once. If you have to reset, you never read that sector again and pickup where you left off.

Is there a good guide for windows noobs how to use ddrescue in general and how to continue imaging after reset.
Last time I wanted to use it from Ubuntu, it turned out I can't figure out which disk/partition is which and should mount or unmount certain drives (don't remember the details but all made me confused
I see many on the net but I think I don't have time to look for sufficient one...oh, btw one of them reports on an example when hard drive responded only after freezing ;P

[przemke]

Reeeeed zone! looks like the outer part of the platters ?
I think it was mostly free space. guess my "hypothesis" is much less likely haha

Attachments

[przemke]

looks like this guide:
http://www.addictivetips.com/windows-ti ... -live-usb/

refers to different tool than ddrescue ?

[laptokowiec]

It doesn't mean it's bad where its red.
Probably bad sector triggered this and windows 'disabled' the hdd.

[przemke]

It doesn't mean it's bad where its red.
Probably bad sector triggered this and windows 'disabled' the hdd.

Whooops it sound likely, what you say as before it was like disabled as soon as bad sectors were attempted to be read
anyone can confirm this ?
If it is like that then pity HDtune doesn't stop and report it can't access the disk instead of marking all as bad block

[Keatah]

red = inner tracks

[ShaneWard]

if its a laptop hard drive, more likely little movements and vibrations might have damaged one of the heads, so once it hits a section of the disk it makes a noise. Since you got most of the data off, I would cut your losses and get a new hdd, if you try and fix the old drive, you might cover the fault and it looks okay, but sooner or later, it will crap out completely.