Data Recovery from Bad Drive.

[Humanzee]

So I have a 500GB SATA drive that has lots of recorded TV and all of my imported videos on it that has apparently decided to stop working. I get a "delayed write failed" error message and a errors in the event log about "An error was detected on device \Device\Harddisk1\D during a paging operation.
"

So I wan't to get the data off the old drive and onto a new drive, however, I usually only get about 1 file moved before the I/O errors commence. Then I have to unplug it and let it cool down. If I leave it running I eventually can't even see a directory map. Are there any applications out there that I can try to do a low level copy or something? It looks like the error has to do with paging. Or is there some way to slow it way down and retry on error so that the copy can take place even if it takes a really long time. Could it have to do with heat? Should I stick it in a bag in the freezer for a while and then just try to copy files quickly.

Just looking for some help. It seems like the recovery tools I find out on the net are basically for undelete.

Thanks in advance.

[GKusnick]

I suppose it doesn't help to point out that the best strategy is to back up the data before the drive starts to fail.

With that out of the way, it sounds like your issue is heat-related. You could try adding a fan blowing directly on the drive to see if that helps. Or take the drive out of the case and run it naked on your desktop. Or get a couple of blue ice bricks, freeze them, and then sandwich the drive between them while you try to get data off. (Watch out for condensation, though.)

If time is a factor, it may be quicker to image the drive or clone the entire partition to a new drive, instead of copying files off one by one.

[Humanzee]

I downloaded a tool called irecover or something. It started doing a surface scan presumably before doing some recovery techniques to copy files to another drive. After an hour I got bored waiting for the scan to complete, and just tried movings some files. The first few dozen seem to move fine then it started giving me errors again. "Delayed write fail" Once this starts MS won't let it go, the error just repeats and repeats and the scan seemed to halt. After a reboot the machine wouldn't post so I turned it off for the night.

This morning I got back into XP but it was super slow. I ended up just turning it off again, as I didn't have time to get terminal services running so that I could check on it from work.

So, I'm not sure why this software wants to do a full surface scan, maybe that's what it is supposed to do. I don't expect to repair the disk, I just want to copy the files. It seems like when XP tries to write to the disk, the errors start to come.

I guess I need to try to make an image to the new disk, assuming any errors would this be a resumable process?

The heat thing may be a factor, and it may not be. Just a theory because it seems to work for a while after having been off for a long time. Its in a drive bay with a fan on it already.

Not sure what to try next.

[GKusnick]

Why are you trying to write to it? Your first goal should be to copy off any intact data without perturbing the state of the drive. If this your boot drive, you should move it to another machine where you can run it as a read-only secondary drive until you get what you want off it it.

If it turns out that there are some files that can't be read without errors, you can then try some more aggressive recovery techniques that may involve writing to the disk, but only after you're rescued what you can using read-only techniques. And in no case should you be booting from a damaged drive, or letting Windows use it for paging.

[pjwerdna]

I've had several discs fail with "Delayed write failures" recently...

All discs carried on working for a while after reboots etc. One disc (1 month old a 500GB SATA) then failed so badly that plugging it in now prevents any machine booting, probably because it confuses the SATA controller. All other discs will work occaisionally, but they're effectively dead after five minutes.

As far as I can tell a "Delayed write failure" means that windows cant see the disc anymore for some reason. A quick check for connected discs under device manager will show if the disc is still there or not.

I thought my issue was with the SATA controller on the motherboard as switching controllers "fixed" it. However I now suspect that it's the electronics on the drive that have failed.

Most disc recovery tools cater for failures in the recording surface. If the controller on the drive itself has failed, whch sounds likely to me, then there's no way you're going to get any of the data off with a recovery tool as it wont be able to bypass the disc's electronics.

I've not yet tried it myself, but I suspect the ice pack idea may be your best bet.

[Humanzee]

Originally Posted by GKusnick

Why are you trying to write to it?

I'm not but you can't stop windows from doing its thing. I think that it writes some record or space allocation stuff on occation. It sounds very much like what pjwerdna described. The disk has been in several machines in the last couple of days so its not the mother board controller. I guess for now I'll periodically plug it in and get as much data moved as possible.

I was asking about low level tools thinking maybe they will gain control of the disk in a way that nothing is happening system wise. I couldn't find my win98 boot disk, ill have to burn one or something.

Alternatively, I'm thinking about getting an external sata enclosure to try a more hot swappable scenario. That way I can also ziplock bag the whole drive and chill it with out worry of condensation.

[GKusnick]

Partition Magic has (or used to have) a boot disk option that lets you run your hard drives in pure read-only mode. Other imaging tools may have this as well, but PM is the one I'm most familiar with.

[Slipshod]

On a related, but tangental note... These guys look pretty damn good at data recovery. I'd say it's one of the most impressive jobs I've seen, and I witnessed a "fire-sprinkler-gone-bad-in-the-server-room" incident last year that made me REALLY glad I had given up IT a long time ago. I'm stunned they got anything off a disk from the Columbia, let alone enough to see the results of the experiment. Heck of an accomplishment.

http://blocksandfiles.com/article/5056

Cheers,
Slipshod

[m0ng00se30]

Download a copy of Trinity Rescue Disc... You best bet is to get the the drive out of Windows. Trinity lets you boot to a linux ISO.. and mount the NTFS partition and pull the files off. It doesn't seem to access the drives the same way windows does, and bad portions of the drive doesn't destroy the entire read. I've saved many important files for people using TRD.

Good Luck.. I would agree that some extra cooling probably wouldn't hurt too... if you get desperate I hear a few hours in a freezer is a good last resort, but I've never tired it. If the bios sees the HD and it actually spins up... TRD should be able to get something copied off!

GOOD LUCK!

--Mike

[CollinR]

Originally Posted by Humanzee

Its in a drive bay with a fan on it already.

I would suggest making dang sure that fan is running!

Seriously I have replaced so many hdds in those things it's not even funny.

[Paul H]

If this is an electronic failure, not a bad medium or motor, I've success with this:
First, do you have another drive of the SAME model, size and capacity?
If so, try swapping out the electronics, the PC card with one from a good Harddrive of the SAME type. IF the data has not been damaged you should be able to copy it to ANOTHER drive, not one of the units used in the PCC swap).
Good luck!

[purpleflux]

Originally Posted by Humanzee

I'm not but you can't stop windows from doing its thing. I think that it writes some record or space allocation stuff on occation.

Yeah it could be the NTFS LastAccess updating.
Check out this article on how to disable it. Though I prefer to use fsutil for that.