Hiya

I have a 500gb Hitatchi drive (2.5 external in caddy) thats fubared.

I have taken it out and placed in my spare pc.
On booting the bios recognises its pretty broken and prompts you to backup asap (CRC errors and reallocated sectors and S.M.A.R.T diagnosed a load of errors
If you try to explore through windows it says it it not formatted and needs to be but the drive is full bar 5 gb spare.

At the moment I created an image incase it all goes wrong (this took a few days)
Now I am using GetDataBack to scan the drive and recover the files but it has taken 3 days so far and only have half the data - so Im looking at a week for everything.

Is there a different way of doing this thats a little quicker?
GDB is using less than half the memory and CPU loading is at 15%....

Many thanks

Hi,

Did you do a full sector by sector image? ie you have a 500Gb file size image

You mention that your running the GDB on the drive which is failing & has so far taken 3 days. As your drive is dying this will probably kill it quicker.
You could try FTK Imager (which is free) & try to open the image file to see if it can see the file structure if so then you can copy off the files you need.
You could also try opening the image file with GDB. This will run quicker than scanning the drive as the image is on a good drive.
As your trying a DIY approach then your accepting the risks involved.

Loki

I am a bit of a newbie at this but if i use GDB to make a image or to try recovering straight from the disk is the amount of access to the drive the same?

If so then does it make a difference which way i get the data back?

Sorry for the newbie question.

Forgot to say the iso image created was 780gb

Hi,

The default setting for GDB when imaging is to create a full sector by sector image (.img or .imc unless you specify the extension yourself)

How & what software did you use to make the image?
Image size should be the size of the drive. but you mention 780Gb which is way bigger than your 500Gb
Are you sure you have imaged the correct drive?

Here's some basic instructions:

To open the image you created do the following:

start GDB & click next
Click on load more (which is in blue) next to Image files
Go to your image & select it
Click open & then next
Click next again & wait for it to hopefully show your files
If it does then copy off your files.


Loki

Im sure i used EASEUS to clone it and came out as an .iso

Im slowly running out of room to do this lol

Is it faster to create an image then recover from that. Or as i am doing recovering the files direct ? It seems either way im doing it its taking days on end. Tho if you create the image, mount that, then recover the files that was at least the drive wont destroy itself......

Easeus Data Recovery Wizard creates a .edi file so it wasnt that software. Possibly Easeus todo Backup (free software).

At the moment it I am unsure if you have a image of the faulty drive or your PC drive? & continuing as you are is unwise. Data recovery is not a one click fix & takes years to gain the knowledge & experience & equipment.

If your data is important I would suggest stopping what your doing & seek a dr pro as you could make things worse & make it more expensive to recover.

I will PM you my contact details if you would like me to give you a free evaluation.

Loki

Hiya

Yeah im 100% sure its the image of the damaged drive.
To be fair the data is not critical and would be nice if i could save it though - this is one of my learning curves but information is scarce as it seems as a very 'closed doors' sector of the IT industry.
Nobody seems to want to teach anyone.

On saying that the more people who give hints and tips the better as I can piece them together so I can make a systematic approach to these issues. We all have to start somewhere after all.....

Cheers

First off you should of cloned wth a professional imager. If you do not have one you can use ddrescue it is a software based imaging program. But on all failing drives image them first. If you do not have a HDD that is brand new zerofill it first. If you have ever written data to the HDD even once zerofill it. Reason being is if you do not do this and you try to run another software program such as GDB you can see some of the original data that was on the HDD mixed inside with your own data. Have seen this one before. Some IT shops bring me their drives after cloning and inside the clone is data from another client. Even had 3 IT shops try and use an old HDD on a clients machine to install an image to it. Results were bad and client wanted data back on the HDD and when I found their data it was mixed with another clients data and they received a little shock on this one. The HDD they used was full of porn and the client had a lot of their porn now back after the HDD was done.


Anyway clone it and then run GDB. Clone with DDrescue if you do not have professional imager

_________________
Iorana Haraharaini

@saggy,

I'm not trying to reply on behalf of loki, but I wanted to respond to some of your comments...


Even if you did select the correct drive when creating an image (in whichever Easus (?) software you chose - that question is still unanswered), any software that produces an ISO image of a disk, is unlikely to be designed for coping with failing disks. Or to put it another way, I have no confidence that you have a full & valid image of the failing disk - and since it isn't a raw sector-by-sector image (it can't be, if it's a different size than the original disk), it is useless for many subsequent data recovery processes.

As poehere has just mentioned, ddrescue is software which I also use (since I don't work in DR, although I do some as part of my engineering job) - but it can be difficult to use, unless you have plenty of Linux/Unix experience. Furthermore, any DIY recovery attempts have risks - those risks depend on what you're doing. For example, if you get the cloning step wrong (e.g. swap source & target parameters) then you can cause unrecoverable data loss. There are alternative utilites for creating a clone (search the forum for discussions about cloning software - Acronis, Ghost, CloneXXL etc. are not recommended!), but since we don't know your skill level, experience, etc. we can't choose what is the best compromise of usability, functionality, cost, etc. for you.


I politely disagree. You have been getting lots of good advice from loki. The topic of "help" has been covered here many times, along with discussions about people learning how to help themselves, unrealistic expectations about being spoonfed, etc. etc. I won't raise my blood pressure by repeating it all again.

Since you've now explained that the data isn't critical but you want to learn, then obviously you can try using different software & techniques, and see which you prefer.

Im sorry if i came accross a bit narkey with the whole teaching thing.

Yes loki has advised me as what to do and i am greatfull for that and seeing its not a critical drive i will have a play and see what suits me for basic work.

Does anyone know of any courses if things like that even exist? Just a basoc understanding of things would suit me fine. I have a read of these forums and i get a small amount that makes sence to me then it goes bam - over my head.
Or put another way how does one start to learn about data recovery?
Any advice or websites or anything is much appreciated.

Again sorry if my post comes/came accross as arrogent.

OK, no problem. I understand it can be frustrating when you want to be taught, but it's also tiring to be on the receiving end of criticism for what isn't given on the forum, rather than thanks for what is given - for free. Everyone has limits on the time they spend helping others here - also for free.


Here are some examples of recent threads on the subject - you can search for other threads on similar topics using the search facility (top right of the page), if you want to:

studying-data-recovery-t21701.html
new-member-where-begin-t21277.html
hard-disk-data-recovery-t21226.html

(3) Hitachi HTS545050B9A300
----------------------------------------------------------------------------
Model : Hitachi HTS545050B9A300
Firmware : PB4OC64G
Serial Number : 101208PBN403X7D15U3L
Disk Size : 500.1 GB (8.4/137.4/500.1)
Buffer Size : 7208 KB
Queue Depth : 32
# of Sectors : 976773168
Rotation Rate : 5400 RPM
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ATA8-ACS version 6
Transfer Mode : SATA/300
Power On Hours : 670 hours
Power On Count : 387 count
Temparature : 29 C (84 F)
Health Status : Bad
Features : S.M.A.R.T., APM, AAM, 48bit LBA, NCQ
APM Level : 4080h [ON]
AAM Level : 80FEh [OFF]

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 _55 _55 _62 00001A931A3A Read Error Rate
02 100 100 _40 000000000000 Throughput Performance
03 186 186 _33 001300000001 Spin-Up Time
04 100 100 __0 0000000001A4 Start/Stop Count
05 __1 __1 __5 000000000000 Reallocated Sectors Count
07 100 100 _67 000000000000 Seek Error Rate
08 100 100 _40 000000000000 Seek Time Performance
09 _99 _99 __0 00000000029E Power-On Hours
0A 100 100 _60 000000000000 Spin Retry Count
0C 100 100 __0 000000000183 Power Cycle Count
BF 100 100 __0 000000000000 G-Sense Error Rate
C0 _99 _99 __0 000000000115 Power-off Retract Count
C1 100 100 __0 0000000001F1 Load/Unload Cycle Count
C2 189 189 __0 003A0003001D Temperature
C4 100 100 __0 0000000001A0 Reallocation Event Count
C5 __5 __5 __0 00000000123A Current Pending Sector Count
C6 100 100 __0 000000000000 Uncorrectable Sector Count
C7 200 200 __0 000000000000 UltraDMA CRC Error Count
DF 100 100 __0 000000000000 Load/Unload Retry Count


Thats the dump from HHDScan if thats any help to anyone..........

The attribute values look like those of a sick drive IMHO, although it's possible for power problems to cause similar SMART indications to a sick drive (because if the power is out-of-spec, it can cause the drive to misbehave). If I had to guess and use my crystal ball, then it looks like one of those two options.

I notice that you say the drive was in a USB enclosure, so power problems are a possibility. However given that the drive is now reporting a SMART event (and seems to have used most or all of its spare sectors, with many more sectors marked for possible reallocation) you would need professional help to reset that state, even if this had all been caused by power problems - which would need testing to confirm/deny.

Other readers may have a different crystal ball and hence have different views .