Data recovery from a failing disk drive

Hard drives fail, sometimes without warning, but other times there are indications. Indications can be as below

• Ticking noise on start up
• Occasional reports of sector errors
• Some files being very slow to read
• Some files lost
• System failing to boot up

Within a normal PC, it is difficult to determine if these symptoms do indicate a possible disk failure, but they should all indicate that there is a possibility. A backup is required, but sometimes, a simple backup is not possible, so data recovery will be required.

With any partial disk failure, one can never determine if the disk is going to fail, and so it must be assumed that a total failure is extremely likely, and soon.

Recovery process

The first stage of the recovery process must be to take an image of the disk. There are programs that will image between disks, but the CnW approach is to create an image file on a different disk. One advantage of this is the image could be stored on a NAS or other remote storage device, or just on a plug in USB drive, with a capacity slightly larger than the original. The second aspect of the CnW approach is that failed sectors are padded with fixed data, and so there is no chance of accidently reading data that would have been written on a second drive if a drive clone was attempted.

CnW software has several options to allow for skipping of bad sectors, and even more importantly, the disk may be imaged in sections. It is typical for a failing disk to have a bad area, and ofther parts read OK. A very common example is for a disk to have problems in the first 10%, and the final 90% to read without errors. If the disk is full, then getting 90% off quickly is a great step in securing valuable data. The remaining 10% may then take a lot of disk retries, and a total disk failure is more likely to occur.

Once a disk image has been created, the image file can be treated as a normal disk, and all the CnW Recovery routines can be applied to recover files

Head failure

A common failure mode with disk drives is for a single head to fail. Drives typically have multiple platters and so 2, 4, 6 etc heads is common. If a single head fails, then areas of the disk will be readable, and others will either be unreadable, or read very slowly with many errors. Some experimentation with view sector, and raw image will enable the pattern to be determined and it may be that 75MB will read correctly followed by 25MB not reading. This would indicate that one head in 4 has failed. With the Image Raw function it is possible to set the Configuration so that when a few errors are detected, the Image will jump say 5MB. This way the bad area of disk may be skipped quickly. If the exact length can be determined, then the quickest way is to jump just of the expected length, eg 25.1MB of data.