Hi guys,
now please don't make fun of Nothwind for being good-hearted. It's really great that there are such people out there.

My HD-recovery has picked up speed overnight and if it stays like that, it will complete at a "semi-professional" speed:



Now it's 550 GB, with no skips or retries and it estimates two days for completion. Fingers crossed that it stays like that. So it's about time to look at the undelete-programs which Northwind recommended. The clone will be kind of precious and easy-to-ruin too. Any tipps on how and how not to do the terabytes of undeleting?

Hi all,
this is just an update on how it's going. HDDSuperclone is still in Phase one, but it's now 83% done. With a total rate of 6,3 MB/s, it is relatively close to the 7,8 MB/s which I saw when I tested HDDSuperclone by cloning part of a healthy drive. This is more than 3 times faster than what I got with HDD Raw Copy.

Yesterday it started to skip some sectors for the first time and overnight, the number of skips increased from 16 to 581. In the last 12 hours, it made only 2 more skips. So there is some bad zone, but most of the data is in a relatively good condition. It now pays off that HDDSuperclone does not try forever to read the bad data and instead picks all the low-hanging fruit first.



In the end, I guess, it will try to squeeze out as much valid data as possible from the bad sectors, until I tell it to stop at some point. And according to Murphy's law, the remaining unreadable sectors will be in heavily used, worn-out areas, - such as MFT, volume bitmap... we'll see.

Due to deletions by chkdsk, I'll not be done when the cloning is finished. This HD had one big GPT partition, NTFS-formatted and used by Windows 7. Of the undelete-programs which Northwind suggested, I tested DMDE and ReclaiMe so far. (On an old USB-Stick with some deleted files.) Reclaime has a nicer interface and seems to find some more files in raw mode. But judging from the preview, these files are often unusable. (Remains of stuff that has been partially overwritten?) I would be glad to get some more suggestions for undelete programs. I heard about Recuva too. What do you think of that one?

Mayday! The laptop on which this runs has become unresponsive overnight.

The Ubuntu screensaver which turns the screen off does not turn it back on when I touch the touchpad. So I can not see any messages. There is no more flickering drive lamps.

I could switch it off and back on, but what happens to HDDSuperclone's logfiles in that case?

So far, I did nothing. Please advise what to do next.

George-S,
Turn off and watch.
The disk must have died.
It’s a bad idea to copy a disk with problems without techno-utilities.

OK, I pressed the power button. Ubuntu reports a "Problem with a system program" on every boot, but HDDSuperclone seems to work OK.

The good news is that HDDSuperclone could work with the file which it had left behind. So it froze this morning around 6 o'clock (timestamp of the file) in Phase 2, meaning Phase 1 has completed:



All settings were still there. So I connected source and target again and restarted. Relative to the previous screenshot, it jumped forward quite a bit and it is still reading some data:



Going slow now, because it is at the hard-to-read stuff. It is great that the files were not corrupted and HDDSuperclone still knows where it was. I thought that all might be lost. The program seems to have been built with power outages and the like in mind. But if it hangs, it will freeze the whole Linux, at least mine. I saw that already, when the cluster size was too high.

Guess at some point it will be time to stop and see what usable data can be extracted from the clone.

You should let it finish phase 2 before you try to access data. Phases 1 and 2 are the money passes, they get the most good data first. After that it is digging for data. It is up to you to determine how long to let it dig in the following phases.

And yes, HDDSuperClone is designed to deal with unexpected crashes or power outages.

As for the program crashing with a cluster size above 2048, that is odd. The program uses the value at /sys/block/DEVICE/queue/max_sectors_kb to determine the maximum cluster size for passthough. The value would be 1280 in your case, which leads to a cluster size of 2560. In my testing with the latest x64 live CD it works without issue at that value, so I don’t know what is happening in your case. But you did a very good job of using reasonable logic to come up with your value that works. And you were correct to restart back from the last known position where everything was working, because if there is some sort of buffer issue, it could have resulted in corrupt data even on the good reads. I wanted to reply sooner about this, but I was very busy this past week.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone

Thanks for the comments, maximus!

I don't know enough about computers to help figure out what caused the crashes. I just had the gut feeling that some even power of two might be the maximum for either the drive or the computer and so it was.

HDDSuperclone is now in the "scraping-phase". Working on the remaining 0,05% of data (~1,4 GB) at a speed of ~500 B/sec, which leads to an estimated 30 days (!) of recovery time and returning a roughly 3:1 ratio of bad sectors to data read.

In other words: It's really time to stop and see what I got. So I stopped it and wanted to go to Mode --> Fill Mark in order to fill the bad sectors and the unscraped sectors with that default fill-pattern, so that files containing these sectors could be identified. But Mode is greyed out.

So how do I do that without screwing everything up in the last moment? I guess: (1) Save the project. (2) Disconnect. (3) If it still is not acessible: Close and reopen the program, then open the same project, connecting only the target. (4) Go to Mode --> Fill Mark and proceed.

I thought I better ask first. Some feedback or correction would be nice. In the meantime, it's scraping a little more.

Best regards
Georg

You must choose to stop and disconnect to be able to switch modes. The program cannot switch modes while in the "connected" state. You can physically disconnect the source after you choose to disconnect if you wish. There should not be a need to close and reopen the program, but you can do that if you wish also, it will auto save.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone

Roger maximus, I just did that. It automatically sets the source to nul-device if you select Mode--> Fill Mark, so you can really turn the old HD off and save it for later, if it should be needed anymore.

So what is your favourite choice as a data recovery program? (As you might have read, a lot of files has been deleted by chkdsk.)

I don't have a favorite program for logical recovery (such as recovering deleted files). So my answer would be the same as what northwind posted here previously.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone

OK, it was worth asking.

The clone does not look good. When HDDSuperclone had finished, I saved everything, closed it and tried to mount the clone. On eSATA, I got this error message:



The one thing I will sure not do is let chkdsk loose on the clone, as that message recommends. Guess I best keep it under Linux, because Windows might do something without asking.

On USB, Linux will not even notice that a USB-device has been attached. I tried it on both the laptop (USB 2.0) and a desktop running an up-to-date Ubuntu 18.04 (USB 3.0).

The only interface which still lets me see that there is a disk at all is eSATA on the laptop. That is something, for a moment I was afraid that I had bricked the new 4TB-HD. Guess the only way to go from here is to start DMDE or something and see if it can work with that clone.

Update: Since Reclaime is Windows only and DMDE with GUI is available only for 64-bit Linux, I chose UFS-Explorer Standard. (The laptop is 32-bit and only it can work with the clone.)

UFS-Explorer seems to be a good choice. The installation is pretty simple. Unpack it, put it in your home folder and from the terminal, run sudo ./ufs-explorer-std.install. Run it directly, or find it in Gnome's "System Tools" menu. Follow it's recommendations. For a damaged file system, that is: Select entire disk for scanning. You will be walked through a "wizard". Uncheck all file systems which can not bet there. (Apple, ReiserFS...) I also decided not to recover "by known content" in this run. This would (also) produce files with incorrect size, name or content.

It found that the NTFS root folder is damaged. After a few minutes, I interrupted it to see what we have. And look: Dozens of directories which seemed to have gone for good. Cool!

It estimates 11 hours for completion. More tomorrow.

UFS Explorer / R-Explorer is currently the most powerful tool IMHO.
Especially their "pro" versions.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Unfortunately, UFS-Explorer crashed twice. First, the laptop was unresponsive in the morning. I had to power it off. And no, UFS-Explorer is not built with power outages in mind. Plus, the Ubuntu 14 seemed to have been damaged. It is instable now. (Fortunately, I make an Acronis-Backup of the HD, before I test new programs. So it can be repaired easily.)

I thought that the old 32-bit Linux might be the problem. So I connected the clone to a SATA port in my PC, installed UFS-Explorer in Ubuntu MATE 18.04 (x64) and repeated the scan. It went to 97% completion without a problem. While working on another PC, I heard some intense HD-noise. "Done, wrapping up", I thought. When I had some time, I looked after it. The whole Linux was frozen. Gnome system monitor was frozen too. The mouse would hardly move. Normal shutdown was impossible, I had to press the power button again.

So is there any way to access a progress file? Or is everything gone?

And would it be an option to stop at ~97%, save that state and rescue what it got so far?

There must be something on the clone which drives it mad. Or it is simply too many files in too many levels of subdirectories. (It's hundred thousands of files, according to the count of the virus scanner.)

Any suggestions would be welcome.

The destination drive is OK? maybe you imaged the patient to a bad drive too, that causes the system to crash and the noises you hear.

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

The destination drive is new. I bought it in an electronics store, not at Amazon, so that UPS or the like has non chance to damage it. Formatted it in Windows and checked SMART with Hdtune: all OK. So it should be in good condition.

Unfortunately, I am busy this week. Maybe I turn to customer service of UFS Explorer, if nobody here has a good idea. (I bought it, after the first test looked so good.)

It's strange, if the drive is OK to make your system crash.
Have you ruled out PC or OS problems?

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner

I did not trust the old Ubuntu 14.04 (32-bit) on the laptop, so I repeated it on a PC with up-to-date Ubuntu MATE 18.04 (64-bit). This is a system which I use daily, keep up-to-date and restore via Acronis, if a bad update breaks it. I never had an issue with that one, running all sorts of programs. Highly unlikely, that this one has an issue. More unlikely, that both have the same issue. But both fail in the same way: Crash with system freeze, late in the process.

More likely, the software does not take something it comes across during a late stage of recovery. I saw that with HDDSuperclone too: If the program is root and does something close to the hardware, the OS crashes with it, if this goes seriously wrong.

Update: I just tried to click About--->Support Information in UFS-Explorer. Nothing happens, but this appears in the parent shell:



Well... no comment.

+1 without any doubt the best tool

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk