Hello,

Well, the worst has happened – my hard drive crashed. I had an older computer, an ASUS N73 laptop; it worked fine, but was starting to show signs of age. About half of my data was transferred to another drive a month ago, but unfortunately, the other half is still on this drive, including some scientific data in mechanical engineering prepared for research papers. Well, a good lesson to act sooner next time.

The situation is that a few days ago the laptop refused to boot (see attached Fig.), so I took the PC apart and removed the drive (WD6400BEVT – see attached Fig.). I bought a USB 3 to SATA cable and connected the drive to a new PC. It's partially working: the drive spins, the LED on the ARGUS cable lights up, and it somehow detects the old damaged drive (with partitions). However, it behaves erratically—it detects and freezes, detects and freezes. Partition I: occasionally opens. But my main data is likely on partition H: (when I click on it, File Explorer freezes for a while and becomes unresponsive).

I tried the Disk Drill app, but it doesn't detect the drives, nor can I even open the app. I also tried Windows File Recovery – also without success. Then I browsed the forums and tried GetDataBack Pro. I had a bit more luck there; the app detected all drives, and I scanned the (damaged) 596 GB drive, but it doesn't look very promising – see pictures (maybe I'm wrong, and I'd be very glad if anyone can make sense of these data).

That's as far as I've gotten, and I'm stuck on what to do next. I would appreciate any advice from the experts on this forum. Should I try another software, or is it worth switching to Linux and trying something there?

Connect the drive to an external computer, boot Linux in Live mode, and try to create a binary image of the drive, for example using ddrescue

If the data is that valuable I recommend taking it to a pro. All the scans you are doing could be causing surface damage making the recovery even harder.

Install the problematic hard drive back into the laptop, buy or find another working drive and install it in the external USB case that you are currently using. Create a bootable USB flash drive with opensuperclone and make a complete copy of the problematic hard drive, and then work only with this copy. By bothering this hard drive with scans, you risk that it will fail in the middle of the process, at which point data recovery will end.

And then download dmde or r-studio, getdataback is mediocre software.

Thank you for the constructive suggestions and opinions. I will try making a disk clone.

I followed your advice and installed open-super-clone-live_24.08.02_amd64 on a USB using Rufus.

I booted OpenSuperClone on this problematic laptop (first without the damaged drive) - see Fig 1. Then I turned off the PC and tried booting the laptop with the problematic drive installed - see Fig 2. And it detects both partitions.

So I don't make any mistakes, I'd like to ask if this is the right way, under:
- Choose Source Drive (should I look for the partitions of the damaged WD6400BEVT disk here?)
- Choose Destination - Image file (should I look for a healthy USB disk with enough capacity here, approx. 700GB?)

I suppose the next steps (after Fig 1) would be clicking the 1.) Connect button and then the 2.) Start button.

There are also buttons like SMART, Analyze, Clone Mode... should I leave everything at default, or should I adjust anything specific and important?

If I manage to create an image file of the disk, I would then try DMDE and R-Studio.

No additional settings are needed, the process is very simple:

File - New project. Save this file to the partition where you are going to create a hard disk image. If there are no partitions visible in the window, open this partition on the desktop, it will be mounted and appear. Don't mix up the partitions so you don't accidentally put anything on a damaged drive.

Drives - select source drive. Something like “dev/sda0 WDC WD6400BEVT” will appear there.

Drives - select destination - image file. Name the file something like image.bin
And save it to the partition where you will copy the hard drive.

"Connect" button.

"Start" button.

The process has begun. The window has a "current status" field. There will first be "phase 1", and then "phase 2", "phase 3", "phase 4", then "trimming" and "scraping". The process is very slow and depends on how damaged the disk is. But judging by the fact that it survived scanning by data recovery utilities, after about the same time the "copying completed using current settings" window will appear. Now you have a complete image of the hard disk (excluding a certain number of sectors that are damaged and can no longer be read).

If the desired files are damaged, you can try to re-read the unreadable sectors, which is why the project file is needed.


Yes, you need a larger drive than the drive you are copying; if you go by the free space displayed in Windows, it must be at least 600 gigabytes, otherwise the image will not fit.

Here is a guide:

https://ww.reddit.com/r/datarecoverysoftware/wiki/hddsuperclone_guide/

_________________
A backup a day keeps DR away.

I prepared the equipment and procedure, and I was quite optimistic that it might actually work out...

...but an error notification appeared – attached as Fig. The process started, but after about 10 minutes, an error message popped up.

The process stopped. Then I tried again, and the second time the scanning took longer, about 20 minutes, after which the same error notification appeared.

Otherwise, I connected the healthy disk to USB 2 (this one works, it is probably connected to the motherboard and doesn't need drivers; the laptop also has a USB 3 port, but it's inactive, probably needing a driver).

As can be seen from the attached image, the laptop also has another empty slot for an additional disk. An option is to buy another disk.

I don't know where the problem is, or if the USB 2 connection is the bottleneck causing it to run slowly and stop the process, but I doubt it.

If you have any more ideas, if I should adjust anything else, or if there's a different strategy, I would appreciate any further suggestions. My optimism that anything will succeed has definitely decreased, though. Otherwise, the disk seems responsive, it spins, and I can even open one partition with a simple click on it, but the important stuff is on the other partition.

So it's time to click other buttons. The first candidate is the SMART button. It will display a window with some text, the most interesting of which is a warning.

If it warns about a large number of reallocated and pending sectors, the program has already suggested the correct source of the problem - the so-called "slow response." This is a well-known problem with Western Digital hard drives, where a large number of problematic sectors causes the hard drive to respond slowly to computer requests. This is also the reason why partitions open very slowly. This can be "fixed", but data recovery becomes a much riskier proposition, unfortunately, since the hard drive is already in really bad shape.

Let's start with this and then figure out the next step.

To avoid putting it off, I'll write down all the possible options now.

---

Option one is suitable for extracting a small amount of data from a hard drive, say up to a hundred or so megabytes. Often, even less. Typically, documents in PDF, Word, Excel, crypto certificates for signing bank documents, and so on. As you've noticed, the program has several buttons labeled "virtual mode". OpenSuperClone also comes with DMDE pre-installed. These buttons create a virtual hard drive in the system, which you can open in DMDE. Depending on the selected mode, you can open the desired partition and search for the files you need. At the same time, the data requested by DMDE is copied to the image. These virtual modes are also useful when you don't want to push your luck and copy the entire drive, but simply try to quickly copy what you need. If you need to copy gigabytes of files or extract folders with tons of files inside, you can do this using virtual mode. There's an option that returns zero bytes instead of requesting data from the problematic hard drive. This is especially helpful in this case, as well as when the hard drive is nearing the end of its life and is reading at a rate of 2 kilobytes per hour.

This option has one drawback: it has no timeouts or skipping of unreadable data (in some modes). The program will try to read data until the hard drive returns an error. If the hard drive head is damaged, or the surface underneath is damaged, this will quickly destroy it and the hard drive will start clicking, ending the data recovery project.

---

Option two, more easily described as "no step back". Let's say the drive simply has a dirty head, while the platters themselves are fine. This symptom looks like this: "The drive can easily read data written long ago, but either writes it extremely slowly, or writes it just as quickly, but can't read data it wrote a second ago." Then it stops reading even data that hasn't been rewritten before.

Or the laptop was handled a little rough and hit a few times, which caused a few scratches on the disk platters, but nothing more.

The hard drive marks sectors it can't read as pending reallocation. It immediately relocates sectors it can't write data to. If you look at the data displayed in the SMART window, you'll see, in addition to the expected warnings, there's one parameter you'd really want to see at or near zero on WD HDDs: the write error rate.

This indicates that one or more heads are already damaged and unable to write data correctly.

But since the heads are still somewhat capable of reading, you can take a drastic approach and clear the list of sectors waiting to be moved, and forcing the hard drive to not add anything to this list if it encounters an unreadable sector. OpenSuperClone also has this functionality.

There's only one drawback: it's extremely risky. The advantage of OpenSuperClone is that its script automatically skips any unreadable sectors as quickly as possible during the first stage of copying, so as not to destroy dying heads. You can manually set the step size, in case a head is struggling to read, to quickly copy what's still copyable. But either way, it's incredibly risky.

---

Option three - with additional actions and maximum care for the data.

This method is the exact opposite of the previous one in terms of solving the problem with slow response. First, you'll need to copy and save the first sector of the hard drive (sector 0 for the computer), or the first four sectors (which are sectors 0 through 3 for the computer) if the drive uses the GPT partitioning type. Then, erase these sectors. This is necessary so that when connecting the hard drive to a Windows computer, the system doesn't try to search for and mount partitions, causing freezes. We'll need Windows because the utility that allows you to work with the hard drive firmware is only available for Windows. Also, USB-SATA cables and external hard drive bays are sometimes suitable for such tasks, but sometimes they don't work. So, the ability to fit two hard drives into your laptop could prove incredibly useful after all this time. You'll need to find any hard drive and install 32-bit Windows 7 on it.

Next, you'll need to make a backup copy of the firmware using this specific utility and upload it to the forum. The free demo version of this program will do this, and you won't be able to damage the hard drive using it.

Why do this? The firmware contains lists of problematic and relocated sectors. There's also another file that converts the logical sectors the computer accesses into physical sectors accessed by the hard drive itself. Inside your hard drive are two disks and four heads. The hard drive constantly switches between them when it's doing something with the data. It reads, say, 100 megabytes, then switches to the next head, and so on, in a circle. But to the operating system, it looks like it's reading one continuous file. If the drive does have head problems (all failures will be on only one head), you'll receive a specially prepared project file and a domain file.

As you may have noticed, OpenSuperClone creates two files: one with the project file, named as you named it, and the other with the .domain extension.

The project file stores the current progress, and the domain file is a really cool feature of OpenSuperClone. It lists the sectors that need to be copied. If you run the copy as is, all the disk sectors will be added, but using this specially prepared file, you can copy the disk without attempting to touch the data that the damaged head needs to read. Then you can freely take greater risks and read the remaining necessary data.

OpenSuperClone uses its script to guess how much data is allocated to each head, and by manually creating a domain file, we can set precise boundaries for what should be read and what should not be read. This significantly speeds up the copying process and greatly reduces the risk of losing data mid-process.

This option also has a drawback: the actions described above are the highest skill in using opensuperclone; 99% of its users have never done anything like this. Copying a disk with precise bypass of the problematic head is something a data recovery lab does, not home users. If the hard drive does suffer from head issues, and you manage to complete this process, you can add professional data recovery experience to your portfolio. I'm not kidding.

One more thing: I haven't tried this with WD hard drives; we'll likely need help from other forum members with access to professional equipment. The main issue is creating a domain file from the hard drive's system files.

---

Option 4: A data recovery lab. If your data is truly valuable and you need it quickly, but you don't want to take any risks. Choosing the right lab is a separate topic, but you'll get the best results, and your risks will be handled by professionals who know exactly what to do with hard drives.

The downside is obvious - it costs money, and it's expensive.

Thanks, ora, for the in-depth comments.

I am not an electronics engineer myself, I am a mechanical engineer (with a PhD). Regarding PC equipment, I can install Windows myself, replace some RAM, remove a fan in a PC or laptop and clean it, etc.

As I said, all the most important data about about ten scientific articles is on a separate WD Elements drive. On this broken drive, I have the results of two experimental tests on some new ballistic protection, which were recorded with a high-speed camera. The data is good, enough for one or two scientific articles, but if it cannot be recovered, we will survive, it won't be the end of the world.

I am sending the image of the SMART analysis. Option 3 seems interesting, but also demanding. We will decide together. Another suitable, compatible SATA drive that fits into the empty slot can be bought; someone nearby is selling a used 640GB one for 18 EUR.

You should take it to a data recovery shop. At this point it may be largely in the realm of logical recovery.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service

Option 3 might not be an option at all, since I don't have any ready-made utilities and don't have the expertise to examine the binary data in the hard drive's system files. It's possible that AI tools could be used, but I'd rather take a bucket to a scrap yard and collect some damaged hard drives than experiment with yours.

And the virtual mode option isn't very convenient because you have to constantly juggle these buttons, and you simply need experience with this feature to use it correctly.

---

Judging by the SMART data, the drive isn't in such bad shape yet, which means it's time to click the other buttons.

These buttons are called "Analyze" and "Extended Analyze". The first one is needed for a quick assessment of the hard drive's condition, and the second one is for a more thorough check of the drive, which is supposedly fine. On a healthy hard drive, these tests take less than 2 and less than 5 minutes, respectively. But on yours, they'll likely take a little longer. You need the first button. This function is relatively safe because it also uses timers, and during testing, the program won't meticulously attempt to read anything, thereby destroying a severely damaged hard drive (but all data requested from the hard drive during the test will also be written to the image! Not a single byte will be wasted). After the test, a results window will appear, as shown in the image below.

In your case, the result will likely look something like good 0% bad 0% slow 100%, or something like that. Below, the program will try to guess what's wrong with the hard drive if it's failing. The problem is partial access (in other words, scratches on the surface of the plates), damaged heads, or something that in our case you don’t even have to guess. For these WD HDDs, even 2 or 9 sectors in the pending relocation list are enough for the hard drive to start freezing.

A quick solution to this annoying problem looks like this:

There's something called the Super Tool on the desktop. It's an interactive command line script, or rather an AI chatbot, but without any intelligence whatsoever. The script is controlled using the keyboard.

The path to what you're looking for looks like this: ATA Passthrough - select your hard drive - VSC (Vendor Specific Commands).

In this treasure chest, we need the patch mod 02 option and possibly patch mod 32 (if patching just module 02 didn't help).

Before patching anything, you can select other options in this same menu to see what they do, for example, reading all modules and reading the ROM located on the hard drive control board. When reading the ROM, the script will ask you to name the dump file; enter "rom.bin" there. This is a bit of an unnecessary step, but when tinkering with the hard drive firmware, and other things for that matter, it's always best to have a complete backup just in case something goes horribly wrong. The script saves the files to the "Home" folder on your desktop. A bunch of small files will appear there; copy them to the new hard drive just in case.

You can play with this script and its capabilities without installing any hard drives in your laptop. The script explains what its functions do and warns you if you're about to do something dangerous or potentially harmful.

Returning to the hard drive slow response problem, the patch application process is described in the same menu: the first option reads the system file and fixes it, the second option writes the fixed file back to the hard drive.

While writing a file, the hard drive may make a VERY SCARY sound of a sudden stop and a very rough spin-up, which you will never hear during normal operation. You haven't broken anything; this is normal. To apply the changes, the firmware receives a command from the computer to immediately reboot, and during this time, the spinning disks and the heads hovering above them are left uncontrolled. A microchip that moves the hard drive's moving parts, bringing it to an emergency stop, takes care of them. After a split second, the firmware will take control again and it will want to start the hard drive, which is where these sounds come from.

To be extra sure the patch has been applied, you can wait a minute or more until the drive's inactivity timer expires, its motor stops, and the hard drive stops vibrating. Then simply remove it from the laptop and reinsert it, while the laptop is running and the system is booted. Nothing bad will happen. Or you can turn off the laptop and turn it back on if the previous method seems barbaric.

After applying the patch, return to the OpenSuperClone window and click the "Analyze" button again. If the process goes much faster and the program reports that the drive is 100% healthy or close to it in the analysis results window, you can additionally click the Extended Analysis button. If the results are still good, you can return to the very beginning and continue cloning the hard drive. The easiest way is to leave the computer on overnight and let it do its job, but usually when recovering data, the computer is monitored, watching how it copies, and if any freezes begin, or clicking or scratching sounds are heard from the hard drive, then the process is immediately stopped to prevent damage.

---

If tinkering with the firmware seems too risky, there's another option, already suggested in the error message: adjusting the settings. Judging by the photos, the drive responds to requests after about 5 seconds. You can set the timeout to 6 or 8 seconds, or even longer, and continue copying. By default, the timeout is set to 1 second (1000 ms), after which the program determines that data is being read slowly from that section and attempts to bypass it by skipping a few megabytes. If, after several jumps, data is still reading slowly, the program increases the skip step, and continues this process until it finds a well-readable section, or increases the skip step to an extremely high value and resets it, returning the error you saw.

The slow response problem has a specific behavior pattern: for the first few hundred or thousand requests after startup or after being idle, the hard drive responds with a significant delay. But if the requests continue, the hard drive exits this slow mode and, after a while, begins transferring data at full speed, sometimes freezing for a split second. This works for both continuous data access operations and random access operations. The main thing is that the computer doesn't stop the flow of requests; then the hard drive doesn't have time to think about other things. You've already noticed this when the hard drive freezes and then starts working for a while.

But judging by the fact that you've already tried running the copy process before, and it took a very long time, copying practically nothing, this most likely won't help. Still, you can try again. Again, this method carries the risk of damaging the hard drive; problematic hard drives tend to be powered on as little as possible and copy data from it as quickly as possible before it fails completely.