Data recovery, ST500LT012-9WS142 (getting it to cooperate)

[KCn]

I have a ST500LT012-9WS142 [FW:0001SDM1] with lots of bad sectors, some reallocated, some not (presumably tens of thousands of non-reallocated). The SMART data had been showing appropriate info for this kind of situation. The data recovery (full image attempt) has grabbed some data, hit and skipped over some unreadable sectors (and read some more data, etc..). Now the drive has been going offline when it hits a bad sector (no SMART data or sectors can be read while it is like this, it is still spun up, but doesn't work again without a power cycle). This even happens when trying to re-read the first bad sector on the drive (which I was previously able to "read-fail-and-moveon"). Also none of the SMART attributes (or error log) have updated since this "go-offline-on-read-error" problem started (except for the self test log).

The drive does turn on with no trouble every time and seems to recover data fine (at low speed), for an unlimited period of time as long as you don't try to read a bad sector. Is it possible that there is a bad sector in the system area, and as soon as it tries to update SMART attributes (or error log) it throws some sort of internal exception and goes offline?

Would using a ttl cable (such as CP2102) to go to the Seagate terminal to run the command to clear the SMART data work around this issue (or least give more time before the bad sector in the SA is hit again)?

I have not accessed the terminal of a drive before. As I understand it the clear smart command is:
N1
But I think something needs to be entered before that?

[data-medics]

It's most likely media damage causing the drive to become unresponsive. Totally normal for drives with lots of bad sectors. You should try imaging it to another drive using ddrescue in Linux. Make sure to use a log file when you do so it'll keep track of which sectors were read when you need to stop and restart it to power cycle the drive.

PM me if you need help with the commands to enter.

[KCn]

It's most likely media damage causing the drive to become unresponsive. Totally normal for drives with lots of bad sectors. You should try imaging it to another drive using ddrescue in Linux. Make sure to use a log file when you do so it'll keep track of which sectors were read when you need to stop and restart it to power cycle the drive.

PM me if you need help with the commands to enter.

Already using ddrescue. It's kind of a problem to have to power cycle the drive, edit the ddrescue log (to remove the fake bad sectors created by ddrescue while it was trying to read from the offline drive), then point ddrescue at a new spot, repeat once for every remaining bad sector...

I've done a number of recoveries with ddrescue and other programs before I knew about ddrescue. I've never seen a drive go offline instantly with the read of any bad sector. It goes offline trying to read sectors that were attempted(failed) to read before (stayed working), now the drive goes offline as soon as they are attempted --- any bad sector.

[MindMergepk]

you will need to clone the drive in reverse order, in this way i hope you can read most of the good area in the drive first.

am afraid there are very limited options when it comes to software cloning, is better to take the drive to someone who has proper tools & experience.

good luck.

[KCn]

you will need to clone the drive in reverse order, in this way i hope you can read most of the good area in the drive first.

am afraid there are very limited options when it comes to software cloning, is better to take the drive to someone who has proper tools & experience.

good luck.

Already tried exactly that, got about 10% of the end of the drive and a few hundred more megabytes after some manual intervention.

Would MHDD show any useful diagnostics as to what is going on with the drive when it goes offline? Would the console via serial show any useful (or even interesting for future reference) information about what is happening (as in show status, make no changes)?

Read any readable sector (or read nothing) = drive stays online.
Read any bad sector = drive immediately goes offline and stays offline until power cycle. (drive did not start out doing this at all, now suddenly it does it every time)


Any insight or things to be learned without taking the drive anywhere?

Edit:
Also the OS had issued a sata soft and hard reset while the drive was stuck, it had no effect.

[lcoughey]

Any insight or things to be learned without taking the drive anywhere?

The more you fight with it, the less likely a pro will be able to recover your data at an affordable price...or at all.

[arztt]

Some Seagate drives go offline when their g-list (reallocated sectors) is full and when they hit a bad sector then.

On a 500GB Momentus 5400.6 i had the same problem.
Clearing the g-list with i4,1,22 command helped.

But better ask someone with the same drive first, if this will work in your case.

[data-medics]

Unless you're willing to make an investment in pro tools, I think it's time to give up DIY and take it to a data recovery shop. With the proper tools handling the soft/hard resets and power cycling it, should be able to get most the data.

Just know that if you keep trying to force the issue, it will eventually kill the drive completely.

[MindMergepk]

Unless you're willing to make an investment in pro tools, I think it's time to give up DIY and take it to a data recovery shop. With the proper tools handling the soft/hard resets and power cycling it, should be able to get most the data.

Just know that if you keep trying to force the issue, it will eventually kill the drive completely.

+1

[KCn]

Unless you're willing to make an investment in pro tools, I think it's time to give up DIY and take it to a data recovery shop. With the proper tools handling the soft/hard resets and power cycling it, should be able to get most the data.

Just know that if you keep trying to force the issue, it will eventually kill the drive completely.

Known and well understood before the recovery even started. If the drive didn't decide to glitch up when reading bad sectors now I'd already have all the (readable) data (and the drive would have had to do less work) I'm willing to try for more data as is (mitigating the offlining issue as best as is easily possible). If the drive utterly fails, oh well (lets hope not). After diminishing returns on that, Seagate console it is.

Some Seagate drives go offline when their g-list (reallocated sectors) is full and when they hit a bad sector then.

On a 500GB Momentus 5400.6 I had the same problem.
Clearing the g-list with i4,1,22 command helped.

But better ask someone with the same drive first, if this will work in your case.

I had noted and considered that. The cost for the serial adaptor is very small, so this may be worth a try (after trying a little harder at letting ddrescue get the data). Does clearing the g-list restore the original (bad) sectors to where they were, in place of the spares? Most of the reallocation occurred during recovery, long after the last write allowed to the disk.

What is the syntax leading up to "i4,1,22"?

Also does anyone have any input (assuming one chooses this path)?
Benefits of clearing via "N1"? (and syntax)
Benefits of clearing the reallocated sectors list via "i4,1,22" with this model? (syntax and anyone else's experience)


__
Note for anyone with important data on a broken drive: if the data is that important, take it somewhere for recovery.

[KCn]

I note (via multimeter) that this drive's serial interface is at 1.8 volts. Any suggestions on good ready made adaptor that runs at 1.8 volts?

[fzabkar]

I note (via multimeter) that this drive's serial interface is at 1.8 volts. Any suggestions on good ready made adaptor that runs at 1.8 volts?

I would use an adapter based on the CP2104 or PL-2303HX Rev D, but I would add my own LDO regulator modification for 1.8V, 2.0V, 2.5V and 3.3V I/O.

Otherwise you could use the CP2102, but with the Kindle mod in this thread:

viewtopic.php?f=1&t=29286

[KCn]

I note (via multimeter) that this drive's serial interface is at 1.8 volts. Any suggestions on good ready made adaptor that runs at 1.8 volts?

I would use an adapter based on the CP2104 or PL-2303HX Rev D, but I would add my own LDO regulator modification for 1.8V, 2.0V, 2.5V and 3.3V I/O.

Otherwise you could use the CP2102, but with the Kindle mod in this thread:

viewtopic.php?f=1&t=29286

Would this be suitable?
TTL-232RG-VREG1V8-WE
http://www.digikey.com/product-detail/e ... ND/2441359

[maximus]

Already using ddrescue. It's kind of a problem to have to power cycle the drive, edit the ddrescue log (to remove the fake bad sectors created by ddrescue while it was trying to read from the offline drive), then point ddrescue at a new spot, repeat once for every remaining bad sector...

I've done a number of recoveries with ddrescue and other programs before I knew about ddrescue. I've never seen a drive go offline instantly with the read of any bad sector. It goes offline trying to read sectors that were attempted(failed) to read before (stayed working), now the drive goes offline as soon as they are attempted --- any bad sector.

If you are using Linux, and you wish to try ddrescue for a bit longer, I may have some help for the fake bad sectors. You will still have to power cycle the drive, but it should (in theory) exit when it hits an error where it can’t keep reading (drive offline) and mark the bad sector. This is not really practical if there are many errors since you still have to power cycle the drive after every error.

Please see my ddrescue passthrough patch:
http://sourceforge.net/projects/ddrutil ... h%20patch/

The latest version 2.1 (for ddrescue 1.19) may be able to handle this if you use the --ata-passthrough option along with the --mark-abnormal-error option. Note that I am unable to test this as I do not have a drive that fails like that.

My patch allows options for ddrescue to use either SCSI or ATA passthrough read commands under Linux. The ATA commands are recommended for best results.

[KCn]

Already using ddrescue. It's kind of a problem to have to power cycle the drive, edit the ddrescue log (to remove the fake bad sectors created by ddrescue while it was trying to read from the offline drive), then point ddrescue at a new spot, repeat once for every remaining bad sector...

I've done a number of recoveries with ddrescue and other programs before I knew about ddrescue. I've never seen a drive go offline instantly with the read of any bad sector. It goes offline trying to read sectors that were attempted(failed) to read before (stayed working), now the drive goes offline as soon as they are attempted --- any bad sector.

If you are using Linux, and you wish to try ddrescue for a bit longer, I may have some help for the fake bad sectors. You will still have to power cycle the drive, but it should (in theory) exit when it hits an error where it can’t keep reading (drive offline) and mark the bad sector. This is not really practical if there are many errors since you still have to power cycle the drive after every error.

Please see my ddrescue passthrough patch:
http://sourceforge.net/projects/ddrutility/files/ddrescue%20patches/passthrough%20patch/

The latest version 2.1 (for ddrescue 1.19) may be able to handle this if you use the --ata-passthrough option along with the --mark-abnormal-error option. Note that I am unable to test this as I do not have a drive that fails like that.

My patch allows options for ddrescue to use either SCSI or ATA passthrough read commands under Linux. The ATA commands are recommended for best results.

I had looked at that version, but I didn't think I'd have the opportunity to talk to the author! It sounds like it is a remaining conventional recovery technique that I've not tried yet.

I had a question for you (or anyone else doing conventional recovery):
In the past I've tried to read a bad sector with a hex editor / software data recover program and it showed the windows return code for the failed read, I've seen a different error code for CRC error (found the sector but its data is wrong) and couldn't even find the sector (IDNF). I've seen error codes other than those two when the drive disappears. Obviously windows is getting this from a conventional read. Do failed (conventional) reads have return codes in linux? If so this might be a version of the patch that would get accepted into the mainstream ddrescue (although perhaps not as fancy as what you have).

In such a version it could have something like a config file, if you get error code 23 or 1117 keep going, but if you get error code 2147549183 mark the last read as (bad|unread), and if you get any other return codes (other than success of course) mark the sector as un-tried and exit (need some sort of rolling log of recent errors for diagnostics).

23=CRC error
1117=IDNF(usually)
I've seen this line up with the smart log vs return code in the past.

[maximus]

I had a question for you (or anyone else doing conventional recovery):
In the past I've tried to read a bad sector with a hex editor / software data recover program and it showed the windows return code for the failed read, I've seen a different error code for CRC error (found the sector but its data is wrong) and couldn't even find the sector (IDNF). I've seen error codes other than those two when the drive disappears. Obviously windows is getting this from a conventional read. Do failed (conventional) reads have return codes in linux? If so this might be a version of the patch that would get accepted into the mainstream ddrescue (although perhaps not as fancy as what you have).

In such a version it could have something like a config file, if you get error code 23 or 1117 keep going, but if you get error code 2147549183 mark the last read as (bad|unread), and if you get any other return codes (other than success of course) mark the sector as un-tried and exit (need some sort of rolling log of recent errors for diagnostics).

23=CRC error
1117=IDNF(usually)
I've seen this line up with the smart log vs return code in the past.

I do not know of a way for this to happen in Linux except when using my patch. Antonio (author of ddrescue) has already asked that of me. If anyone figures out a way to determine this both myself and Antonio would be very grateful!

[KCn]

I had a question for you (or anyone else doing conventional recovery):
In the past I've tried to read a bad sector with a hex editor / software data recover program and it showed the windows return code for the failed read, I've seen a different error code for CRC error (found the sector but its data is wrong) and couldn't even find the sector (IDNF). I've seen error codes other than those two when the drive disappears. Obviously windows is getting this from a conventional read. Do failed (conventional) reads have return codes in linux? If so this might be a version of the patch that would get accepted into the mainstream ddrescue (although perhaps not as fancy as what you have).

In such a version it could have something like a config file, if you get error code 23 or 1117 keep going, but if you get error code 2147549183 mark the last read as (bad|unread), and if you get any other return codes (other than success of course) mark the sector as un-tried and exit (need some sort of rolling log of recent errors for diagnostics).

23=CRC error
1117=IDNF(usually)
I've seen this line up with the smart log vs return code in the past.

I do not know of a way for this to happen in Linux except when using my patch. Antonio (author of ddrescue) has already asked that of me. If anyone figures out a way to determine this both myself and Antonio would be very grateful!

It seems that (windows) the "ReadFile" function throws an exception on a read error and info on that exception can be retrieved via the "GetLastError" function (both exported by kernel32.dll). Windows structured exception handling (SEH) deals with this. One might have to trace such an exception to see where the info is coming from.

Any heavy linux users(/coders) out there who know what the linux equivalent of the "ReadFile" function does when it encounters a read error? Throw an exception? Return a value?

A hard drive with a known (simple) bad sector or a CD full of test data with an intentional scratch may be adequate for testing.

[maximus]

It seems that (windows) the "ReadFile" function throws an exception on a read error and info on that exception can be retrieved via the "GetLastError" function (both exported by kernel32.dll). Windows structured exception handling (SEH) deals with this. One might have to trace such an exception to see where the info is coming from.

Any heavy linux users(/coders) out there who know what the linux equivalent of the "ReadFile" function does when it encounters a read error? Throw an exception? Return a value?

A hard drive with a known (simple) bad sector or a CD full of test data with an intentional scratch may be adequate for testing.

You need two separate types of errors to test this. The first is a normal read error, which can be from a drive with a real bad sector or you can make a bad sector using hdparm. The second type of error is one where the drive stops responding and will not return any more data until it is power cycled. There is a way to simulate this to a point, which is to use hdparm to lock a drive.

Using passthrough commands the difference can be seen in the sense key. The bad sector will be a medium error (03), and a locked drive will be command aborted (0B). I had someone report a drive that actually would lock up and require a power cycle would report a hardware error (04).

I only know of two variables for a normal read in Linux (programming in C), the return value of the read and errno. In both cases, the return value of a read error is -1, and the errno is 5 (input/output error). So unless someone can point out another way, I am unable to tell the difference.

[KCn]

It seems that (windows) the "ReadFile" function throws an exception on a read error and info on that exception can be retrieved via the "GetLastError" function (both exported by kernel32.dll). Windows structured exception handling (SEH) deals with this. One might have to trace such an exception to see where the info is coming from.

Any heavy linux users(/coders) out there who know what the linux equivalent of the "ReadFile" function does when it encounters a read error? Throw an exception? Return a value?

A hard drive with a known (simple) bad sector or a CD full of test data with an intentional scratch may be adequate for testing.

You need two separate types of errors to test this. The first is a normal read error, which can be from a drive with a real bad sector or you can make a bad sector using hdparm. The second type of error is one where the drive stops responding and will not return any more data until it is power cycled. There is a way to simulate this to a point, which is to use hdparm to lock a drive.

Using passthrough commands the difference can be seen in the sense key. The bad sector will be a medium error (03), and a locked drive will be command aborted (0B). I had someone report a drive that actually would lock up and require a power cycle would report a hardware error (04).

I only know of two variables for a normal read in Linux (programming in C), the return value of the read and errno. In both cases, the return value of a read error is -1, and the errno is 5 (input/output error). So unless someone can point out another way, I am unable to tell the difference.

I remember seeing something like that in dmesg, linux seems to be getting the message (as is windows) but I'm not sure how (if at all) linux is passing it to usermode. Here is something that looks like what I remember (will post a real example next time I capture one)

This is from some random person on the internet who had a familiar appearance in dmesg output (although perhaps not an exact match, different flavor of linux)

ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
ata1.00: BMDMA stat 0x25
ata1.00: failed command: READ DMA
ata1.00: cmd c8/00:08:40:05:00/00:00:00:00:00/e0 tag 0 dma 4096 in
res 51/40:06:42:05:00/00:00:00:00:00/e0 Emask 0x9 (media error)
ata1.00: status: { DRDY ERR }
ata1.00: error: { UNC }


This (next post, so as not to delay this post for moderation due to posting a link), looks like its about that (above).

[KCn]

The link for the above post (after moderation it should hopefully appear)

https://ata.wiki.kernel.org/index.php/Libata_error_messages