Hate stupid drive imaging software that can't skip errors...

[CZroe]

There must be some technical reason why drive imaging software typically throws it's hands up when encountering an unreadable sector, but it is really annoying, especially considering the likelihood in many cloning scenarios (failing HDD to new HDD).

For example, recently I was working on a PC that wasn't booting for a friend's father and after I got it booting I determined that the problem was a failing HDD. Obviously, it was working well enough to boot and a lot of the files could be salvaged, so I made an image of it with Macrium Reflect and found that the main partition in the image was corrupt (couldn't even mount as a file system; partition listed as "RAW"). Not entirely unexpected, but strange that I never got an error. The original HDD is still mountable and bootable, so it was not further corruption at the source. Even so, I tried CloneZilla to clone drive-to-drive and it bombed out at the first unreadable sector. Not cool. It should continue cloning and let me deal with the corrupted file/file system later. Why doesn't it? What free software does? The least it could do is go ahead and create the partition table, partitions, and boot sectors so that I can manually copy all the files that will copy (the recovery partition cloned just fine).

 

[jwilliams4200]

ddrescue

 

[Gillbot]

chkdsk /r?

 

[Burner27]

chkdsk /r?

+1

 

[2is]

I use Acronis True Image and it allows me the option to skip unreadable sectors

 

[VirtualLarry]

Norton Ghost 2003 build 789 will skip bad sectors while cloning with the "-FRO" switch, I believe.

 

[CZroe]

ddrescue

Thanks. Going to run it from Ultimate Boot CD. Any way to skip the image step and copy the files from one to another?

chkdsk /r?

I hope you're not serious.

That's what I would do AFTER cloning to a good drive.

Doing that on a failing HDD with unreadable sectors that can't be read/fixed/reallocated without having a working backup is not smart. You want to use/access/change it as little as possible until you get everything backed up. If I were talking about a simple file system corruption he wouldn't need a new drive and the drive imaging software would not have failed on a bad sector.

 

[CZroe]

Thanks. I have old retail boxed copies of Ghost and some OEM versions of Acronis. Not about to spend money on this guy's computer, but I'll see if those work for me.

 

[C1]

This is a misunderstanding that I have preached about in these forums. Mainly, good imaging software is very fussy about the integrity of the information. That's what imaging is all about, otherwise the result may not be an image as well as the intended result may not be restorable.

For the purpose of this OP, I think imaging is an incorrect choice and there are other applications more suited for the subject problem.

 

[jwilliams4200]

Thanks. Going to run it from Ultimate Boot CD. Any way to skip the image step and copy the files from one to another?

I'm not sure what you are asking. Standard procedure is to image the failing drive to another one, and then only work with the copy to recover data. Even better is to then image the image to a third drive, and then work only on the third drive, keeping the second as a best-case backup in case you want to start over and image to the third drive again.

The forensics wiki outlines the use of ddrescue:

http://www.forensicswiki.org/wiki/Ddrescue

 

[Gillbot]

This is a misunderstanding that I have preached about in these forums. Mainly, good imaging software is very fussy about the integrity of the information. That's what imaging is all about, otherwise the result may not be an image as well as the intended result may not be restorable.

For the purpose of this OP, I think imaging is an incorrect choice and there are other applications more suited for the subject problem.

That's my thought, and why I suggested chkdsk /r

if the drive is failing, migrating it via imaging software would yield a failed image and may end up being useless anyway.

If all that is wanted is to save the data, I'd suggest simply pulling off the required files and not imaging the drive.

 

[VirtualLarry]

This is a misunderstanding that I have preached about in these forums. Mainly, good imaging software is very fussy about the integrity of the information. That's what imaging is all about, otherwise the result may not be an image as well as the intended result may not be restorable.

For the purpose of this OP, I think imaging is an incorrect choice and there are other applications more suited for the subject problem.

I disagree. With a failing physical drive, the best solution IS imaging software, but one that will do sector-by-sector imaging. (Better if it has restart capability, in case the PC hangs upon accessing a particularly nasty bad sector, or causes the HDD itself to hang.)

 

[2is]

Most of the images I've made from drives that had bad sectors but still good enough to boot into Windows restored perfectly fine. The small handful that didn't restore fine still give me a working backup archive, it just wasn't bootable. I see no reason NOT to image it.

 

[jwilliams4200]

I disagree. With a failing physical drive, the best solution IS imaging software, but one that will do sector-by-sector imaging. (Better if it has restart capability, in case the PC hangs upon accessing a particularly nasty bad sector, or causes the HDD itself to hang.)

Right. This is standard procedure for data recovery. I'm surprised people are suggesting otherwise.

ddrescue is the best tool I know of for imaging a failing drive.

 

[Gillbot]

I had the same issue when I used acronis on my drive. Acronis actually suggests using chkdsk /r then re-imaging. That's exactly what I did and everything went fine on the 2nd attempt with no errors.

 

[2is]

I had the same issue when I used acronis on my drive. Acronis actually suggests using chkdsk /r then re-imaging. That's exactly what I did and everything went fine on the 2nd attempt with no errors.

Were you making an image (file) or cloning? I've only ever had acronis refuse to work until i ran chkdsk during a cloning process and it was for file system errors, never for bad physical sectors.

 

[Gillbot]

Tried to make an image and it failed. Didn't realize why so I tried to clone and it popped up with sector errors. Chkdsk /r repaired (relocated) the bad sectors and everything was fine after.

 

[CZroe]

This is a misunderstanding that I have preached about in these forums. Mainly, good imaging software is very fussy about the integrity of the information. That's what imaging is all about, otherwise the result may not be an image as well as the intended result may not be restorable.

For the purpose of this OP, I think imaging is an incorrect choice and there are other applications more suited for the subject problem.

If the failing drive was still bootable then the resulting image should be bootable because all of the sectors needed to boot were there, working, and accessible. It should have been a quick copy of a working setup with all the files, corrupted or not. I wasn't interested in reinstalling an OS or helping he find out what files were corrupted. I'm not getting paid for it. I didn't even intend to do the CHKDISK /R (I was going to give him those instructions).

I'm not sure what you are asking. Standard procedure is to image the failing drive to another one, and then only work with the copy to recover data.

That's what I want to do: Imaging the failing drive to another one as a drive-to-drive image process. The DD-Recover instructions I see are for imaging the drive-to-image file on another drive.

Even better is to then image the image to a third drive, and then work only on the third drive, keeping the second as a best-case backup in case you want to start over and image to the third drive again.

Yep. I just want a booting computer with most of the easily recoverable files as a favor to the owner. He understands that many files may be missing or corrupted. That's why he's not paying for data preservation or recovery. Not everything is of forensic importance. 🙂

The forensics wiki outlines the use of ddrescue:

http://www.forensicswiki.org/wiki/Ddrescue

Will peruse for future use.

That's my thought, and why I suggested chkdsk /r

if the drive is failing, migrating it via imaging software would yield a failed image and may end up being useless anyway.

If all that is wanted is to save the data, I'd suggest simply pulling off the required files and not imaging the drive.

And THAT is precisely what I am complaining about. The image should not fail when it encounters a bad sector and the resulting image should be no more useless than the original drive except as far as random read errors go (retry X number of times and then MOVE ON instead of retry X number and throw up an error). If I pull off the required files, I now have to re-install an OS, application, updates, etc for a guy who no longer has any of it. If it wasn't important enough to pay me for, it wasn't important enough to buy a new OS installation disc, office suite, etc and pay for the labor to install, configure, and update everything. Cloning should be the simplest solution.

CHKDISK /R will make changes to the disk in particularly sensitive file system areas (indexes, tables, etc) and could even ruin the very file system it is trying to repair. If the drive is randomly corrupting reads, it may commit that corruption or write something that gets corrupted.

Most of the images I've made from drives that had bad sectors but still good enough to boot into Windows restored perfectly fine. The small handful that didn't restore fine still give me a working backup archive, it just wasn't bootable. I see no reason NOT to image it.

I guess I wasn't so lucky because the drive wasn't booting when I first looked at it but was after a bit of work (minimal startup repair to determine if caused by failing HDD, malware, or other random corruption). 🙁

 

[CZroe]

Tried to make an image and it failed. Didn't realize why so I tried to clone and it popped up with sector errors. Chkdsk /r repaired (relocated) the bad sectors and everything was fine after.

You could have completely hosed the filesystem by doing that. Sectors don't often fail on their own and often a"failed" sectors are actually random read errors produced by a failing drive. You can't trust anything the software determined when checking and then allowing it to commit that correction is just one more opportunity for a random read/write error.

 

[Arkaign]

When faced with a failing drive, I immediately run my preferred suite of data recovery utils to move only the important data off. I find that in practice, a huge percentage of the contents of a drive are just chaff that can be ignored (OS, apps, temp data, etc). Obviously exceptions are large and/or numerous media files.

I can understand the desire for convenience, and to capture everything possible with a clone/image, but if the drive is truly failing quickly, I try to aim straight for the crucial files first. Reloading OS/drivers/apps is a cakewalk compared to replacing actual work files and irreplaceable data.

 

[jwilliams4200]

That's what I want to do: Imaging the failing drive to another one as a drive-to-drive image process. The DD-Recover instructions I see are for imaging the drive-to-image file on another drive.

You lost me again. What do you mean by "DD-Recover"?

I was referring to ddrescue (not to be confused with dd or dd_rescue).

ddrescue can clone drive-to-drive or drive-to-image-file. The link I gave previously gives several examples of different usage.

Also, there is a tutorial in the official ddrescue manual:

http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html#Examples

 

[jwilliams4200]

I can understand the desire for convenience, and to capture everything possible with a clone/image, but if the drive is truly failing quickly, I try to aim straight for the crucial files first. Reloading OS/drivers/apps is a cakewalk compared to replacing actual work files and irreplaceable data.

Actually, ddrescue is likely to be more efficient at that than any tool that tries to access the filesystem. ddrescue is smart about the way it copies the data, skipping over large areas of bad sectors to copy only the easily readable sectors first. Then it can go back to try multiple times on the areas of bad sectors.

http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html#Algorithm

In contrast, if you use a tool that tries to access the filesystem and it hits an area with a lot of bad sectors, the tool will probably get stuck trying to read those bad sectors over and over (which takes a long time).

 

[Gillbot]

You could have completely hosed the filesystem by doing that. Sectors don't often fail on their own and often a"failed" sectors are actually random read errors produced by a failing drive. You can't trust anything the software determined when checking and then allowing it to commit that correction is just one more opportunity for a random read/write error.

I did what Acronis told me to do, and it worked for me. Shrug.

 

[CZroe]

You lost me again. What do you mean by "DD-Recover"?

I was referring to ddrescue (not to be confused with dd or dd_rescue).

ddrescue can clone drive-to-drive or drive-to-image-file. The link I gave previously gives several examples of different usage.

Also, there is a tutorial in the official ddrescue manual:

http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html#Examples

Just auto-corrected with the wrong word. I was talking about DDRECOVER

I did what Acronis told me to do, and it worked for me. Shrug.

They also sell online backup. In a way, they are invested in you having local failures. It sounds like they market imaging software as a preventative tool to use on a good drive more than as a tool to use for transitioning from a bad drive.

 

[Gillbot]

Possible, but their suggestions worked 100% for me so I have no issues with them or their software.