Very important! Temp. Clicking sound from a drive, system went crazy

[Amanda85]

I have important research and database files on the HDD and some documents on the HDD have a very high sentimental value to me. I don?t have any recent backup (yes, I know).

I had my PC on for four consecutive days (in the last 18h it was connected with the www w/o an active firewall). I transferred a high amount of data to my HDD during that time period (HD material from camcorder). In the last 60 min of this session I was ripping nine CDs (my friend?s orchestra). While ripping the 9th disk, I suddenly noticed a cracking sound. I hoped it came from the CD/RW drive, but it?s very likely it came from the HDD.
I tried to do a quick memory virus scan but the AV program didn't respond.
I attempted to backup my important data with my external HDD and flash drive, but they were not recognized.
After a while, I tried again, and, surprisingly, the external HDD was recognized this time.
When I tried to change the backup folder name on my external HDD, Windows Explorer crashed and my PC lost connection with the external HDD again.
This time a quick memory virus scan worked, but displayed no detection of malware.
Thereafter, I saw the HDD usage LED blinking without stopping and a plausible cause (it didn?t make the cracking sound this time, however). I go to "My Computer" and see free HDD space increasing by multiple hundred MB (maybe GB because I think I have had less free space left than was displayed). It could have been temp data, but that?s unlikely.
I shut down the PC in order to prevent data loss.

Of all my available options (CHKDSK, new HDD/PSU using old HDD as external dev. Then data recov., normal bootup, or sth. else), what is now the best logical course of action to backup my important data while minimizing risk of data loss?
(I think the HDD is very sensitive right now so I don't want to do anything risky. Professional backup is out of the question since I have confidential data on the HDD.

The likelihood that the HDD is dying is high because of the clicking noise.
The probability that the PSU is responsible for the problems is possible, since the USB interface made problems. For about seven months, my Antec PSU made a weird noise during the first 40 sec on startup. This already happened to me with my old Antec PSU so I thought that was normal.
There's a small chance of malware (worm) because of the lack of the active firewall for a prolonged period of time (while exposed to the Internet), but that's unlikely, even though I saw a Windows Update icon on the taskbar during that time. Also, there?s a small chance the clicking came from the CD-RW drive, since I didn?t hear it after the ripping finished.
In conclusion, I think I have a mechanical HDD problem caused by heavy usage (75% chance) or over/under-voltage/high temperature (25% chance).)

OS is Windows XP Home, HDD interface is SATA, the motherboard is Gigabyte DS3. I only have one C drive with one partition.

 

[robisbell]

well, the sounds you heard initially, has me concerned i may be something other than a bad HDD. can you open the case and check for any odd burning smells or swollen capacitors on the motherboard, and also check the HSF and psu.

if you can, download and burn Ultimate Boot CD http://www.ultimatebootcd.com/ after you've done a visual inspection of the hardware inside.

I think you PSU may have blown something, but will need to see, if it's not putting enough power out, that would cause the HDD to struggle.

do the physical checks, do not unplug anything or touch anything if you see any wire that look like the coaing has melted off, unplug the psu from the wall and stop the inspection and let us know.

 

[mechBgon]

edit: ^ those are good things to check too :thumbsup:

Don't connect the system to a network (Internet or otherwise) without firewall protection. If your system has a vulnerability, it can be exploited practically instantly, so you're basically playing the odds as to when you're going to be discovered. For a "raw" WinXP installation, average survival time is about 6 minutes without firewall protection, last I checked (this is a worst-case scenario, of course). Don't play the odds if you don't have to

So if your goal is to back up your data, then one approach would be to start the computer in Safe Mode. Fewer malwares operate in Safe Mode, and it also prevents network connections that could expose the computer to further attack. To start the computer in Safe Mode, start the computer and begin tapping the F8 key on the keyboard (preceded by the F-Lock key if your keyboard has one) when you know the first Windows logo screen is about to appear on the screen. Then pick Safe Mode from the menu. Hopefully your external HDD is available while in Safe Mode.


Also be aware that a fair amount of today's malware will infect CDs, DVDs, and USB drives. This came to mind when I read that you were ripping discs made on someone else's computer, and if your computer is now infected, it may have infected your external hard drive. So keep in mind that your external drive could be malware-infected at this point, or become so.

Once your data is backed up, shut down, disconnect the external drive, and then you could run a few online virus scanners to get second and third opinions. One of my first picks would be the F-Secure Online Scanner, since F-Secure uses several antivirus engines and also detects rootkits and spyware/adware. Use Internet Explorer to run the scanner, since it is ActiveX-based. If malware is discovered, please note the exact names of the malware, e.g. Trojan-Downloader.W32.Bagle.eg or whatnot, and report it here.

At some point, also try the Secunia personal software inspector to check your system for exploitable vulnerabilities in stuff you might not suspect (Acrobat Reader, QuickTime, Skype, instant-messenger programs, etc).

further security suggestions if you want some


There's also the possibility that your capture of hi-def video filled up your hard drive. I haven't done any HD video capture, but I seem to recall it can eat up >10GB per minute of footage?

 

[Amanda85]

@robisbell: I will do that as soon as I use one of the approaches described below.
@mechBgon: I think I had approx. 20GB (out of 320GB) left, after the file transfer. Your approach would work if you are 100% confident that the cause is malware. But what if the problem is that the HDD is about to die?

I now have two main solutions in my mind:

1. On my PC: Buy a new 1TB Samsung SpinPoint, replace the "defective" HDD with the SpinPoint, format SpinPoint and inst. Windows, then connect the "defective" HDD as a non-boot drive and then rescue data with PC INSPECTOR File Recovery. I could also install a net PSU if that was the cause of the problem.
2. On another PC I have: Connect SpinPoint und "defective HDD" as non-boot HDDs and then rescue data with PC INSPECTOR File Recovery.

Which method is preferable? I wanted to get the PSU and the SpinPoint anyways and I don't want to risk the data of the other PC I have.
Also, what would be associated with less risk: To look for the important data or copy the whole image?

Thanks for the elaborated response

 

[robisbell]

I honestly do not think you'll need to do file recovery, but it's possible. before you do either, I would suggest you install AVG Free, Spybot (and teatimer), comodo free firewall, ccleaner, and do all windows non hardware updates 1st then install the previous software I just mentioned, then see if you can access the HDD in question without any special software 1st. I'd sugegst you do my recommendations in my 1st reply before you do either option you mentioned.

 

[mechBgon]

Originally posted by: Amanda85
@mechBgon: I think I had approx. 20GB (out of 320GB) left, after the file transfer. Your approach would work if you are 100% confident that the cause is malware. But what if the problem is that the HDD is about to die?

Actually, the first goal in my suggestion was to rescue a copy of your data by booting into Safe Mode and copying your files to your external drive, if possible Are the files there, or are they missing? Once the passengers are in the lifeboat, then you can go back and see why the Titanic is actually sinking

In the event that you get the new hard drive and install Windows on it, or put the old drive into a second system to rescue stuff from it, you may need this info to get access to your files on your old drive: How to take ownership of a file or folder in Windows XP It looks like you're already aware that you should disconnect the old drive before you install Windows on the new one :thumbsup: