Hello everyone,

I'm brand new to this forum but I sincerely hope someone can help.

I have a couple of programs on my laptop that monitor my HDD using SMART. One is Acronis Drive Monitor, the other is HD Sentinel. Both are warning of impending doom with my HDD, which is a Samsung HM160HI. Power on time is a tad over 59 days. The SMART data is showing a degradation of the following parameters:

Reallocation Event Count
Current Pending Sector Count
Uncorrectable Sector Count

However, when I run chkdsk (all five stages), it reports that the volume is clean. I have also run Seagate's SeaTools for Windows and the disk surface scan included in the EaseUS Partition Master; both would have me believe that all is well.

So, I'm in a dilemma.

Some basic info about my system:

Laptop - Dell Vostro 1310
OS - Windows XP Pro SP3
CPU - Intel Core 2 Duo T5670
RAM - 2GB

Any advice greatly appreciated.

JPC

Just because surface scans don't show problems now does not mean that there isn't a problem developing... (It's not clear to me exactly which chkdsk scan you did - some only check that the filesystem metadata is readable [and consistent, of course]; I don't know what you mean by "all 5 stages".).

(a) You said that you have HD Sentinel installed. Does that mean that you have definitely seen a change in what SMART attribute values are being reported, since you've been using the disk - or have you only just installed this software, and immediately seen the warning?

(b) Please supply the current full set of SMART attribute values, including the raw values, for review. That means for each attribute I'm expecting to see numbers for: value, worst, threshold and raw.

(c) Do you have any previous sets of SMART attribute values for this disk? If so, then please supply them.

(d) As always, you should expect a disk to fail at some point, and probably at the most inconvenient time for you (!) so make sure you have backups - that's irrespective of what the SMART data says, since SMART cannot predict all types of problem.

Well said

One small note, the 5-step chkdsk is performed by winxp on chkdsk /r /f .

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Many thanks I haven't heard "chkdsk /r /f" described in that way (5 stages) before, but WinXP is not my strong point

Hi Guys,

Thanks for such a quick reply.

In response to Vulcan's questions:

(a) I am seeing a change in the SMART values being reported since installing HDD monitoring software a few days ago. Please see attached.

(b) I have attached a screenshot showing the SMART attributes as reported by Acronis Drive Monitor.

(c) Hopefully, I have dealt with this in (a).

(d) I have backups - both drive image and file backup - and they're recent.

I think the five stages to which I previously referred have been addressed.

Thanks again.

I await your comments with interest.

JPC

Guys,

Please find attached another screenshot from Acronis Drive Monitor. As it isn't possible to read the full text entry in the dialog box, I have pasted it below:

"Checking file system on C: The type of the file system is NTFS. Volume label is Internal HDD. Cleaning up minor inconsistencies on the drive. Cleaning up 7 unused index entries from index $SII of file 0x9. Cleaning up 7 unused index entries from index $SDH of file 0x9. Cleaning up 7 unused security descriptors. CHKDSK is verifying Usn Journal... Usn Journal verification completed. CHKDSK is verifying file data (stage 4 of 5)... File data verification completed. CHKDSK is verifying free space (stage 5 of 5)... Free space verification is complete. 156183929 KB total disk space. 39106416 KB in 137001 files. 45656 KB in 17582 indexes. 0 KB in bad sectors. 236609 KB in use by the system. 65536 KB occupied by the log file. 116795248 KB available on disk. 4096 bytes in each allocation unit. 39045982 total allocation units on disk. 29198812 allocation units available on disk. Internal Info: f0 78 02 00 e2 5b 02 00 fb 5a 03 00 00 00 00 00 .x...[...Z...... 30 05 00 00 04 00 00 00 f7 08 00 00 00 00 00 00 0............... 94 24 94 0d 00 00 00 00 de fd 3c 64 00 00 00 00 .$........"

Hope it means something to you guys.

JPC

Thanks for the info. Since you've asked the same question to another forum ...

http://forums.techguy.org/hardware/1054 ... y-hdd.html

... I'll keep my reply short, to avoid me wasting my time duplicating effort with the readers over there.

The items of concern that I see in "screenshot 1" are the raw values of those 3 attributes you mentioned (which are being checked by "Acronis Drive Monitor", as your "screenshot 2" shows, with the risks that this approach includes). The normalised ("cooked") values of those 3 attributes are still at 100, which is the typical "no change from nominal conditions yet" value. That suggests that the drive probably does not believe there is a problem.

Your "screenshot 3" shows an event on 20 May, which appears to have been caused by an earlier unclean shutdown. If I was in your position, I'd check the Windows event logs for any relevant errors just before the previous shutdown. You'd also need to think about anything unusual which may have happened at the time.

Before making a decision, personally I would zerofill the drive (since you have backups), specifically to see if attribute #5 increases, but of course all the attributes would then be reviewed again. I'll be interested to see what suggestions you receive on the other forum...

Hi Vulcan,

Many thanks for your comments.

I am interested in your comment "with the risks that this approach includes...". Would you please elaborate? Also, "That suggests that the drive probably does not believe there is a problem". Does that mean that Acronis is incorrectly reporting a degradation or is it the SMART data being fed back from the HDD itself? Just can't get my head around it ( ).

I've checked the system event log for 20 May and indeed there appears to have been something going on. There are four "Save Dump" entries (Event ID: 1000) for that day. It says "The computer has rebooted from a bugcheck", whatever that means. It also adds " A full dump was not saved". Unfortunately, I cannot remember what happened at the time.

I wouldn't be comfortable zerofilling the drive so I think I'll have to pass on that one.

Once again, I greatly value your feedback.

Thank you.

JPC

Hi,


The meaning of the raw attribute values themselves, are not standardised (although there are some meanings which exist "by convention"). Therefore 3rd-party software reporting problems based on raw attribute values, is at risk of flagging false negatives, or false positives.


I don't really understand why this is an "or" question. IMHO the answers are "unknown, but perhaps" and "yes, as always". In other words, both could be true, so I don't understand why it has to be an "or" between them. Perhaps my comments in the paragraph above help to explain why it's not a clear "either/or" situation.


Windows may have saved a "minidump" for each of those events, but I stopped doing Windows core dump analysis several years ago (thankfully!). IIRC there are articles on Technet and elsewhere to help you do further analysis. If those bugchecks are unrelated to the disk subsystem, then it seems unlikely to be related to your original topic (and vice versa). I can't advise further remotely with the limited info supplied.


Oh. I don't understand why you'd be uncomfortable - you said you had backups... Without doing this, you won't get a useful diagnostic result. Of course it's your disk, so it's your choice how much diagnosis you want to do. Anyway, as long as you're not going to do this, then I doubt we'll make more progress with the currently available information, so I'll wish you good luck, and keep those backups up-to-date.

P.S. I'm not sure exactly which test(s) you performed using Seatools, but one other non-destructive test you could run (always with a backup available, just in case of unforeseen events) would be a Long DST (Drive Self Test). This does more than the surface scan which you mentioned. Again, it's your choice.