HDD partially working after drop. Best recovery strategy?

[tom760]

I hope some experts can advise me on how to proceed with trying to save critical files on this HDD. It's out of my Dad's laptop, is 200GB, has 2 platters, and 4 heads. I'm trying to be proceed with caution and at this point only know that after it was dropped, the laptop wouldn't boot and the HDD is having issues causing sectors to be relocated. On a possitive note, at least I could browse some of the filesystem.

Incase interested, here is the HDD info page:
http://sdd.toshiba.com/main.aspx?Path=S ... ifications

For recovery operations I hooked it up to my desktop via a SATA cable. I haven't tried much yet and for now just unplugged the drive and set it aside until I get input.

So far what I did: attempted to copy dad's user dir but quickly saw the transfer speed indicating disk issues so I aborted. I installed S.M.A.R.T. monitoring software. It let me dump various HDD info counters. Unsure if some of them were incremented recently, I did a quick copy start/stop again and redumped the counters. Comparing them I did see the disk was having issues and relocating sectors. At least not many, but I suspect it very possible that could just be a side effect of the HDD being busy attempting to read and construct the requested data. At the end of this message I pasted the counter dump (which will be more meaningful to some other people on here than to me)

During the brief 2nd copy I put my ear close to the HDD and heard a bad sound. It wasn't always present (maybe only when the head would move or something), but when heard I think it sounded like a brushing or scraping. It was quiet enough that the CPU fan would drown out the sound unless I put my ear close. What this is an indication of, I'm not sure, but I wondered if maybe one or more of the heads are messed up. If so, I don't know how likely it is the head(s) would read any data off the associated platter side.

The S.M.A.R.T. tool did mention both online and offline hard drive test operations that could be performed. Maybe I would have been fine running them, but worried it could be dangerous and potentially worsen the hardware before I'm able to recover data.

Knowledgable and confident advice on how to proceed would be much appreciated.

Some questions I've had in mind:

1) Should I run some of the S.M.A.R.T. diagnostic tests? If so, which ones.
2) Does the HDD drop, sector relocation starting, and bad sound point to one or two most likely types of failures?
3) Should I be worried about HDD access (copy attempts or S.M.A.R.T. tests) causing or worsening problem(s)?
4) If it's likely one of the heads isn't working but the others are, would any good potential solutions exist that could be done w/out a cleanroom or special equipment?
5) With head issues what should I expect with reading that surfaces data? No access? Partial access? Partial or full access but at slow speed?


Details from the S.M.A.R.T. monitoring tool:

(most recent print out)

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x000b 100 100 050 Pre-fail Always - 0
2 Throughput_Performance 0x0005 100 100 050 Pre-fail Offline - 0
3 Spin_Up_Time 0x0027 100 100 001 Pre-fail Always - 1109
4 Start_Stop_Count 0x0032 100 100 000 Old_age Always - 2421
5 Reallocated_Sector_Ct 0x0033 100 100 050 Pre-fail Always - 28
7 Seek_Error_Rate 0x000b 100 100 050 Pre-fail Always - 0
8 Seek_Time_Performance 0x0005 100 100 050 Pre-fail Offline - 0
9 Power_On_Hours 0x0032 087 087 000 Old_age Always - 5291
10 Spin_Retry_Count 0x0033 148 100 030 Pre-fail Always - 0
12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 2414
192 Power-Off_Retract_Count 0x0032 100 100 000 Old_age Always - 54
193 Load_Cycle_Count 0x0032 094 094 000 Old_age Always - 62300
194 Temperature_Celsius 0x0022 100 100 000 Old_age Always - 38 (Lifetime Min/Max 15/61)
196 Reallocated_Event_Count 0x0032 100 100 000 Old_age Always - 15
197 Current_Pending_Sector 0x0032 100 100 000 Old_age Always - 94
198 Offline_Uncorrectable 0x0030 100 100 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x0032 200 200 000 Old_age Always - 7
220 Disk_Shift 0x0002 100 100 000 Old_age Always - 128
222 Loaded_Hours 0x0032 090 090 000 Old_age Always - 4262
223 Load_Retry_Count 0x0032 100 100 000 Old_age Always - 0
224 Load_Friction 0x0022 100 100 000 Old_age Always - 0
226 Load-in_Time 0x0026 100 100 000 Old_age Always - 313
240 Head_Flying_Hours 0x0001 100 100 001 Pre-fail Offline - 0


(differing counters from prior to quick copy start/stop)

ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
5 Reallocated_Sector_Ct 0x0033 100 100 050 Pre-fail Always - 26 (28 in above listing)
9 Power_On_Hours 0x0032 087 087 000 Old_age Always - 5290
193 Load_Cycle_Count 0x0032 094 094 000 Old_age Always - 62295 (62300 in above listing)
196 Reallocated_Event_Count 0x0032 100 100 000 Old_age Always - 13 (15 in above more recent listing)
197 Current_Pending_Sector 0x0032 100 100 000 Old_age Always - 81 (94 in above more recent listing)
226 Load-in_Time 0x0026 100 100 000 Old_age Always - 327 (313 in above more recent listing)


Lastly I have one more question to post. I spent a long time searching google without finding an answer:

How can I find out how a HDD maps logical C,H,S addresses to a physical head (assuming block not relocated)? I found info on LBA to C,H,S conversion, but this doesn't seem very useful since the logical head count isn't real. This laptop disk has 4 pysical heads and 16 logical, which seems like would have a clean mapping. Looking at my larger desktop drive, it has 8 pysical heads and 63 logical, which seems like an awkward mapping.


Thanks for reading. Hopefully this disks data recovery goes well. If so the overall experience will be good since I had wanted to learn about HDD's.

[pepe]

Hi,

LBA->CHS mapping won't help you.
LBA->PCHS mapping is another question, that could be useful in some cases, when the damage can be bound to a specific head or surface.

In your case the best thing U can do is to image the drive to a good one till it is in working condition and try logically recover from the image.
Here I suggest a dos based imager, as windows drivers have high retry count settings and drive might be ruined by reread attempts.
However the best results can be achieved by a smart imager (Deepspar, Data extractor UDMA...), but their cost is high, so it should be much cheaper to take the drive to a pro to do the job.
As far as I remember ThatDellGuy is from California, but there are several members (drccsc, Jono-ats and so on) from the USA.

regards,
pepe

[thatdellguy]

Correct.

[tom760]

pepe,

Thanks the for reply and info. I'll have to lookup those tools (Deepspar, Data extractor UDMA...) to see what they do. I'm thinking I have a reasonable shot of being able to do it with my setup. Seperate from data recovery I had planned to learn about hard drives, ATA, etc. My main desktop runs Linux which I could use the basic dd command to make a disk image, but like you said with Windows, it may default to bad settings such as to many failure retry's. I should have thought about the OS doing it and not assumed the disk was (though maybe they both are, not sure).

The LBA -> PCHS mapping would be interesting. I'm not sure how much it varies per drive. I figured it probably goes somewhat like the LBA -> CHS where after a track worth of data is written, the next contiguous chunk goes on the same track on the following head (unless one finishing is the last head). If one head out of 4 just doesn't work at all, I figured I might have a shot my Dad's 2008 tax files might fit in a single track. The forget, but think what I read so far may have said the mapping isn't standardized at all, but even if that's true, maybe the large majority use one strategy. Even better would be if there was an interface to read the information from the drive controller.

This stuff is actually pretty interesting. Recently I was pleasently surprised my desktop HD was faster than I guessed with throughput. I didn't realize or think about how the innermost and outermost physical tracks might have different performance characteristics.

[N.C.]

tom760,

This is really good you want to dig deep and learn some things, but please keep this in mind, your drive's hours (or minutes) are allready counted up.
If your data is important, please find some pro near you, and if the data is in your hand, you can try to repeat again the process....

If the head is crashed by the scratch what you have done with the drop, the crashed head will destroly the surface in 1 second, and will render your drive unrecoverable.

btw: head switching:
The head switching is not a constant!
It is a variable, based on the zones, and generally different in brands as well.
The sample is different too. (eg: H0,H1,H2,H0,H1,H2... or H0,H1,H2,H2,H1,H0,H0,H1.... or there are mode combination)
Additionally, the defect remapping is calculated in.
So, almost each switching can be different.

Additionally, not all the hdd can do the LBA-PCHS conversion by ATA port, and you need special SW/HW complex to do that conversion.
(eg: read out the SA, interpret the zone allocation, interpret the P and G list, the defective cylinder list, and counting the location by yourself.)

Additionally, depending on the model/Brand, not all the HDD can survive one head dieing!
Some starts to clicking and you can't bring into file again without deep modification in the SA/ROM.

Regards,
Janos

[tom760]

Thanks, I appreciate your feedback. I wasn't sure and wondered about it maybe being dangerous even attempting to copy things off because of it possibly making the disk worse. As it's my Dad's HD and data, I'll have to ask him what he wants me to do. He'll probably want me to research prices for professional service.

I haven't looked into reading the SA before and given the fact (just learned this) it isn't a standard format between drives, it will probably take more time than I should spend to learn about.

I'm not clear on understanding "not all the hdd can do the LBA-PCHS conversion by ATA port". From this I'm wondering if you're saying some drives support PCHS addressing from driver code? I read at least some Maxtor drives may support UBA, but I didn't get the impression it was on other brand drives, plus it sounded like it's still logical where bad blocks get relocated.

Since after the drop my Dad tried booting a few times, and then I attempted several brief file/folder copies, would that mean no head totally died since I was able to browse the filesystem? Since it didn't die, can I assume it very likely attempting sector reads again wont harm the disk? I've been reading about the filesystem structure and was thinking about trying to get the data by reading the minimal number of blocks using my own code. It's kind of a pain, but I had actually been procrastinating trying to learn this and recover data off a disk image I saved after I accidentally erased the first 100MB of my disk.

[harddrivespecialist]

thatdellguy, is very well know member of this community and has super reasonable pricing.

[tom760]

thatdellguy, is very well know member of this community and has super reasonable pricing.

Ok. I'm not sure his location or pricing, but I'll send him a message and ask.

[tom760]

I called a local data recovery place and got some pricing info. For them to open the drive and do recovery / repair, prices start at $900. My Dad said he can't afford / justify that though.

The company did say they offer a free drive diagnostic evaluation. It doesn't require opening the drive. I asked if the diagnostic could potentially harm the drive and was told no. Is that correct (or at least extremely unlikely to dmg it)?

I wasn't sure how to interpret some of what N.C. said, but it sounded like maybe just doing drive access requests presents a chance of further causing severe damage. I would imagine any diagnostics they run are going to at least be issuing read accesses to disk. The only thing I can think of that might get around that is if they first only read the S.M.A.R.T. type counters and log, but maybe even that is stored on disk and requires read accesses.

I'll probably just wind up seeing what I can recover myself since my Dad is on a budget. I am just starting offering general PC help services for work though and it's still of interest to understand this area better.

Thanks,

Tom