Dear Gurus,

I'd like to ask for some help to hopefully make something easier. I'm having trouble thinking my way around it right now. I'm sure there's some step I'm not aware of.

One WD5000KS (caviarSE16 SATA) is having some problems. I have two other identical drives on hand, both working fine. The problem drive SMART reports only a high reallocated sector count, others OK. PCB swap didn't change behavior: upon write access, Windows reports "delayed write failure" to MFT. If connected by USB it disappears, too.

Most of the files on this drive are encrypted and only one user has privileges. I have the user's EFS key, and I can change ownership and permissions, but then I encounter the write failures and surely make things worse. Is there some trick to reading these files without changing the privileges? I'd be happy to simply copy over the encrypted files for use in the same system.

Is there some way for me to create a user on mysystem that will have the same ID, then load the EFS key for native access? Then I don't need to change the files.

Lacking an EFS solution, I would like suggestions for another approach. If I could simply copy over all physical sectors, then perhaps I could recover data in reallocated sectors.

Hi,

I suggest creating an image as soon as possible and try to recover things from that.

pepe

_________________
Adatmentés - Data recovery

An EFS solution would be best for now; minimal work by a long shot, and I can keep busy while 99% of the data is recovered.

I don't have good software to make a physical-sector copy. Is there any freeware that can copy 500GB? My budget is already blown, and I'm jobless right now! This is charity work.

if the drive is getting weak, U've got not many time to waste, U have to chose the right procedure for the first time, maybe there's no second chance, or if there is it would be a bit more costy than cloning the drive while it's in a somewhat working condition.

pepe

_________________
Adatmentés - Data recovery

Thanks for the kind response, Pepe.

What software would you suggest for the image? The drive is too big to fit on my PC as an image file, so I think I need a direct drive-to-drive copy. I have a barebones PC that can support these drives in Legacy IDE mode, so I could use older programs that only support PATA drives. It HAS to support 500GB (976773168 sectors), though.

Are you very familiar with Copyr.dma? It sees the drive as 128GB and reads the last sector as 268435455, but you can set any start or end sector you like, and it appears to work. Is that possible? On the other hand it reads fewer sectors on the bad drive, so I suppose it's reading logical sectors, which would skip the bad sector data.

Hi,

I don't know any free progs capable of cloning an 500G drive, try googling a bit.
As U said the free version of copyr.dma does not support LBA48 addressing, so it is not able to clone above the 128G barrier.


pepe

_________________
Adatmentés - Data recovery

I borrowed a bootable Media Tools Pro 5.0 CD, and my drives are on the barebones PC in two eSATA enclosures, recognized by MTPpro.

When I look at the menu, it tells me the bad disk has 976771055 sectors, while the twin has 976773168 (2113 more). I cannot set the copy range higher than end=976771054.

That tells me, based on what I used to know when 200MB was a lot, that it is reading logical sectors, and 2113 sectors are marked bad; maybe that the last 2113 sectors have been mapped to replace bad sectors. I believe I need to copy physical sectors 1:1, whether marked bad or not, in order to have an image that will give me a chance at more data recovery. Have I got that right?

Regardless I'll do this clone first and get whatever files I can. Then what?

get the image, then scan image for your files with any 3rd phase tool. and be done with it.

Are you all keen on pushing out big bucks for software?
There's a free, even open source solution out for 40 years or something: dd.
A latter spin-off, ddrescue has some switches to tell the program what to do when it runs into errors.
If it's only one users (encrypted) files I need, I'd rather recover them directly from the NTFS than from raw sectors, as I made the experience that a disk may die right after you managed to clone the first 2 gigs with Windows and Office
Any 3rd party NTFS driver will give a f*ck on M$ privileges and lets you copy the files. Though you'll have to decrypt them afterwards.

Thanks for stirring the pot, Shaun.

I am hobbying around here, trying to learn and help at the same time. My goal is recover everything, not to make a buck, so "getting the job done" only matters as far as the drive is a ticking bomb. That's why I'm asking about the missing sectors.

I guess it's only about 100kB, but it might be as many as 2000 files. I can get chkdsk information from the event log, and maybe work out what is where, and then find out what files are missing/corrupt. If it's just security descriptors, losing the encryption markers, then perhaps I can restore them to make the file decryptable. Whatever's next I'll learn and do.

If I can get a COMPLETE image, then there's plenty of software out that can find file data in areas marked as bad. if they don't get copied, then they are lost.

Anyway, I'll read up about dd and maybe learn something. I wish I could afford HDDuplicator; it sounds useful. I think I'll post my question about COPYR.DMA and LBA differences in a new thread. Searching hasn't taught me much yet.

At the point you want sectors that are in the defect lists of the disk, you'll need tools that can deal with firmware specialities of the very particular hdd, "user mode" access to lba sectors won't help here.
My experience with most customers: "we need all data, urgently, at any cost"
After first estimate: "uh, actually we only need the documents and settings of user xyz"
After second estimate, based on this: "uh, actually, we only need our tax declaration spread sheets"

LOL; correct.

Dobre

_________________
Murphy was an optimist

Datarecovery in Belgium, Holland, France and Germany
Datarecoverytools http://www.drtools.eu

Shaun, I'm not sure what you were telling me when you said "I'd rather recover them directly from the NTFS than from raw sectors". I think you were proposing a clone first and then hack at NTFS/EFS from Windows. That's what I'm working on now. However, initial behavior was that read always worked and write often sent the drive offline, so I was hoping to copy files from within Windows without changing privileges, so I was asking for suggestions.

Any ideas what sort of failure would cause that behavior?

I am worried that data recovery software might not get the encryption markers right, so then I'll end up with files that are encrypted but not marked as such. Then what? Also, software won't recognize files header that are encrypted (to find files of a certain type), will it?

I presume that Media Tools Pro will give me some kind of error report. I'll know soon: 95% and 229 errors. Then I think I'll have a chance to go in reverse, then I'll have some sector numbers to work on. What software might best help me piece together busted files, see where a bad sector was formerly used, etc?

Once you have copied the drive with MTpro ..just put the copy in the computer that the bad drive came from and read the files normally.

I have done all that appears possible with MTP. I have a list of LBA defects, plus a list of files that (previously) would not copy with a WD boot CD. Interestingly, advanced recovery settings in MTP changed absolutely nothing; not one block recovered.

At this point I need to know whether there is any better way to access those blocks. If the only answer is PC3000, then I have to quit, because I can't foot the bill. If it's internal drive components that can be swapped, then I guess I still have no chance without a clean room.

The defect list, translated into CHS, shows no solid pattern as far as I can tell*. In broad terms, there are just a few defects at 1%, 2%, 37%, and 39%, and then about 2000 defects over 95%. The high error rate in the uppermost % suggests what?
- That the armature may be having some trouble moving at one extreme, electric or mechanical cause
- That an electronics failure has worsened as the drive filled up

*There does seem to be a moving-wave pattern to the bad block locations; a pattern in the sector and head numbers that almost repeats over a very large area. That, and the curiously level rate of errors by head and by sector, make me wonder if I got something wrong. Perhaps the LBA number does not represent physical location, having been shifted by the drive electronics. I think there are 4 platters, so must be 8 heads in reality.

I have attached a zipped spreadsheet that translates to CHS and puts the results on a chart. Perhaps someone would have a look and comment?