Cloning before data recovery

[Mindfulness]

I recently started cloning all hard drives and memory cards with ddrescue before doing data recovery. I started doing it to use best practices. I did not expect it to give me higher success rates. After I have completed a successful recovery, for personal research, I have tried doing recovery on these devices directly to compare results. Working from the clone almost seems to double my recovery rates(that figure may be off a bit, lately it has seemed that way) . I started cloning to be responsible, but it turns out it is helping my success rates and the bottom line tremendously.

edit added later//

today I got an 8gb mem card in. made a backup with ddrescue. I then uses rstudio to recover from the image. it seemed to get a great recovery, I would guess 90%(basing that on a hunch). aftering being confident I got their data, I tried to rstudio on the card directly, I failed to read it. Maybe it was coincidence and it just died.

 

[Mindfulness]

I think I was a little off with saying my recovery rate doubled. I had a couple jobs that it seemed to make a huge difference, it threw my average off(up). Even if it just makes a 20% difference and it is best practice, I will keep doing it.

 

[SAG]

edit added later//

today I got an 8gb mem card in. made a backup with ddrescue. I then uses rstudio to recover from the image. it seemed to get a great recovery, I would guess 90%(basing that on a hunch). aftering being confident I got their data, I tried to rstudio on the card directly, I failed to read it. Maybe it was coincidence and it just died.

Close the card again and see what happens.
If you get the same results as previously, then you have more data to base your conclusions on.

I (as well as most others here) always recover from a cloned image. It helps to preserve the hardware in case it needs to be farmed out, and recovery software has better luck on images than failing hardware.

 

[lcoughey]

As I've said before, this makes perfect sense if the drive has even 1 bad sector within the data or file structure.

Software programs read in (usually larger block sizes 256 sectors or more) and when 1 sector us unreadable, they skip the entire block...possibly losing 256 times more data than necessary. ddrescue and data recovery hardware cloning tools like DeepSpar Disk Imager will cut the block size down around the bad sectors and eventually get all possible sectors read.

 

[Mindfulness]

Close the card again and see what happens.
If you get the same results as previously, then you have more data to base your conclusions on.

I tried to duplicate the results and am not able to get anything from the card or the second clone I made from the card. It appears the card changed sometime after the first clone process.

I could make a fair assumption that if I failed to go strait to making a clone and tried first recovery on the card directly, I may not have not had as good as results as I got

 

[lcoughey]

I tried to duplicate the results and am not able to get anything from the card or the second clone I made from the card. It appears the card changed sometime after the first clone process.

I could make a fair assumption that if I failed to go strait to making a clone and tried first recovery on the card directly, I may not have not had as good as results as I got

This is a good assumption. Had you gone the software recovery route, you would have scanned through the entire card, reading almost every sector once, the card fails and then not have copied a single sector off. With a clone, you only read a sector once...that is all you need.

I know that if the card/drive were healthy, then you should get the same results, but you can never be sure about the condition of all the sectors until you test them all. So, why not get a clone and test every sector at the same time?

 

[brandonkick]

Good information.


I think one of the hardest things is deciding exactly when it's necessary to do a clone.

For instance, a machine comes in with what appears to be a virus issue. The underlying problem is a failing hard drive but you don't become aware of that until it's too late.

What are your criteria for making the decision to clone?

 

[SilverLeaf]

Good information.


I think one of the hardest things is deciding exactly when it's necessary to do a clone.

For instance, a machine comes in with what appears to be a virus issue. The underlying problem is a failing hard drive but you don't become aware of that until it's too late.

What are your criteria for making the decision to clone?

That's one of the more compelling reasons I do a full hardware diagnostic on every functioning machine that comes in...before I do anything else.

 

[lcoughey]

Good information.


I think one of the hardest things is deciding exactly when it's necessary to do a clone.

For instance, a machine comes in with what appears to be a virus issue. The underlying problem is a failing hard drive but you don't become aware of that until it's too late.

What are your criteria for making the decision to clone?

As the only thing that cannot be replaced is the data stored on the computer, I suggest you always start with ensuring it is backed up before doing any type of work. The best way, in my mind, is to get a full clone of the drive which kills two birds at once. A hard drive test and a full backup.

 

[Mindfulness]

Good information.


I think one of the hardest things is deciding exactly when it's necessary to do a clone.

For instance, a machine comes in with what appears to be a virus issue. The underlying problem is a failing hard drive but you don't become aware of that until it's too late.

What are your criteria for making the decision to clone?

I agree it is tough. We are a repair and service company first. As of now, the only stuff we clone 100% are standalone data recovery jobs.

If a client brings in a computer for repair or maintenance we do a short and long test of the hard drive using gsmart control. If it has read errors, and the client agrees to installing a new hard drive, we will first try and copy the data directly from the hard drive. 9 out or 10 times we will get the data without errors using Windows explorer. If we get any copy errors in explorer, then we will create a clone using ddrescue and recover from that.

We have to find the balance between the safety of our clients data and the time spent on their total repair. Clients are sensitive to price which means we need to decide where to spend our time(their money).

We may change our procedure someday, if we feel the extra time and cost of cloning everything will benefit the client.