Imaging a drive

Geoffsplace

Member
Reaction score
8
Location
australia
Hiya all,

Just out of interest how many of you always take an image of a faulty drive before trying to repair it (eg running a scan to recover data from and mark bad sectors).

rgds
Syb
 
Even when a reseller tech or end user brings in a drive and says that the drive is healthy, we always start by cloning the drive.
 
First thing I do to a customer's PC before I even start any type of repair. This has saved my a$$ numerous times.
 
Hiya all,

Just out of interest how many of you always take an image of a faulty drive before trying to repair it (eg running a scan to recover data from and mark bad sectors).

rgds
Syb
Absolutely always. And then do all data recovery from the image, not the drive. If the drive is faulty, I always replace it... not repair it.
 
I'm wondering how everyone stores these images. I don't have a server, but I do have a couple of NAS boxes. Imaging directly to the NAS is problematic, so I mostly image locally, then copy it to the NAS. I work on the local copy, then, depending on what is being done, also store the recovered data. If it's just cloning, I delete the image after the machine is repaired. If I'm trying to recover data, I keep everything for 30 days after the job. This all ends up costing a lot of disk space, and time moving things back and forth. Often, I will call the customer after a couple of weeks to make sure everything is working fine, then delete the image ahead of the 30-days just to clear out space. I'm already thinking about how to best increase my storage capacity next year.
 
No imaging in the field. All jobs that need imaging for whatever reason come back to the bench.

Absolutely. No way I would image a drive onsite. Total wasted idle time.

As for failing drives in the shop.. of course!! This is rule #0 isn't it? ddrescue a badly failing drive ALLLLWAYS!
 
This is a great thread. I'm curious what software you all use to accomplish this. It can take hours to clone/image a drive, so I'm wondering if there's a faster way... And how you manage the scheduling. I try to turn computers around very quickly, and my clients appreciate this.
 
I'm wondering how everyone stores these images.
I have a RAID 1 array with eSATA and USB 3.0 ports. Normally, it's connected to my shop PC via eSATA but to image a customer's drive, I either remove it and stick it in a drive doc on the shop PC and image it to the RAID, or if the customer's PC has USB 3.0 and removing the drive looks to be too much work, I plug the RAID into the customer's PC and image directly. My terms say we do not keep back-ups of customers' data once the job is done, but if it was a tough data recovery job, I'll hold onto the backup until they confirm they have backed it up themselves. The RAID has 3TB capacity and that's sufficient, although I may stick a 4TB drive into a drive doc if needed, as supplementary short-term storage.
 
It can take hours to clone/image a drive
Yes, it takes hours. Apart from making sure that the patient drive is connected to hardware that reduces the bottlenecks, it will always take hours.

This is why, imo, a single huge drive is so much worse than multiple smaller drives. Whole-drive backup, imaging, recovery and restore operations just take so long.
 
Back when I used to do residential PC work we would also image customers drives. To answer your time query first - the way we handled it was 30 minutes before the end of each day we would take a look at the shelf of computers we hadn't got to yet. If there was any suspicion that the drive might have a fault we'd image it. Similarly, for any fault descriptions that sounded like there may have been viruses we'd remove the drive and leave it scanning overnight.

We had dedicated PCs for this. These PCs had their SATA/IDE (yeah, this was quite a few years ago) and molex/sata power cables hanging out the front. We'd plug the customers HDD into those as a slave drive and boot into Windows. For cloning we typically used Ghost32 (much easier doing the clone from Windows - no MSD driver issues, and it was fast). We had a bunch of spare hard drives we used to clone to. I prefer cloning to another drive as you can plug it in and boot off it, run all your recovery tools against it etc. We'd plug the customer drive in, kick off the clone and go home. When you came in the next day you're right to go - no wasted time.

The dedicated PCs also had a few virus/malware scanners on them. We even automated it in the end - the results of each scan would automatically save against the clients notes in our system. This was the best decision we ever made - 80% of the work was done by the time we came in the next day and typically we only had a bit of testing and cleaning up a few leftover bits and the job was done.

We'd also image the drive any time we we're doing a format & reload. Same process - left it cloning overnight to a spare HDD. We automated much of this process too. I wrote a program that we'd run on the customers computer first - it would note down product keys, user accounts, grab WiFi, email and other passwords, email account settings, and locations of users folders (like My Docs). We'd then clone the drive to a spare overnight and would reinstall Windows on the clients original drive. Then we'd plug the customers cloned drive in and run another program I wrote that read back the location of My Docs, Desktop etc and would copy that data to the corresponding folder on the fresh install of Windows. It also copied every file to "C:\Old Hard Drive" on the fresh install of Windows (so when customers rang back claiming there was a file on their computer and we lost it we could point them to that folder).
 
This is a great thread. I'm curious what software you all use to accomplish this. It can take hours to clone/image a drive, so I'm wondering if there's a faster way... And how you manage the scheduling. I try to turn computers around very quickly, and my clients appreciate this.

I use Acronis, I have found it the most reliable of all image software, I have a dedicated computer that i just hook the drive up to and let it run while I work on other machines. It has two 2 terabyte drives as well as a 500g drive for windows.

I also keep the backup for 30 days.

As far as a fast turn around I temper that with I would rather have it for an extra day than have it bounce.

Another point i found even when the disk diagnosis programs or smart drive says the disk is ok, I have found countless times that the drive is in fact faulty so tend to trust my experience rather than the diagnoses software.

Rgds
Syb
 
Good points Geoffsplace. We made Ghost our first choice because we found it would clone faulty drives successfully more often than Acronis. The only annoying thing with Ghost is it would stop the clone if it found 1 bad sector. We had a few times where we'd leave a drive to clone overnight only to find it stopped 5 minutes after we walked out the door. Thankfully there are a couple of options to tell it to continue cloning so we ran it from a batch file with these options set.

In our experience Acronis would sometimes lock up with faulty drives - sometimes we'd leave it another 24 hours and it would eventually get through, sometimes it would be a complete lock up. With that said though Acronis was our backup for faulty drives that Ghost wouldn't clone (which would sometimes happen) and there were times when Acronis did the job successfully. They're both good tools, and I'd recommend having both available.

For drives that wouldn't clone with either tool (or were taking too long) my go-to tool was TestDisk (which I'd use to selectively recover important data, instead of the whole drive). It's not a clone tool but a data recovery tool and I consistently find it can recover files when other tools can't. It is fiddly to use for recovery though - it's a command-line tool and you have to choose each folder you want to copy. TestDisk also lets you find and rewrite the partition table if it get's corrupted. Awesome tool, and it's also free.

One other tool for selectively copying from failing drives is Unstoppable Copier. It lets you tell it how many times to retry copying each sector before giving up and moving on. This level of control is great for letting you choose how much you want the data vs how quickly you want to recovery to run.

Regarding keeping backups for 30 days - absolutely agree. It costs very little to do this, and can save you big time.
 
Good points Geoffsplace. We made Ghost our first choice because we found it would clone faulty drives successfully more often than Acronis. The only annoying thing with Ghost is it would stop the clone if it found 1 bad sector. We had a few times where we'd leave a drive to clone overnight only to find it stopped 5 minutes after we walked out the door. Thankfully there are a couple of options to tell it to continue cloning so we ran it from a batch file with these options set.

In our experience Acronis would sometimes lock up with faulty drives - sometimes we'd leave it another 24 hours and it would eventually get through, sometimes it would be a complete lock up. With that said though Acronis was our backup for faulty drives that Ghost wouldn't clone (which would sometimes happen) and there were times when Acronis did the job successfully. They're both good tools, and I'd recommend having both available.

For drives that wouldn't clone with either tool (or were taking too long) my go-to tool was TestDisk (which I'd use to selectively recover important data, instead of the whole drive). It's not a clone tool but a data recovery tool and I consistently find it can recover files when other tools can't. It is fiddly to use for recovery though - it's a command-line tool and you have to choose each folder you want to copy. TestDisk also lets you find and rewrite the partition table if it get's corrupted. Awesome tool, and it's also free.

One other tool for selectively copying from failing drives is Unstoppable Copier. It lets you tell it how many times to retry copying each sector before giving up and moving on. This level of control is great for letting you choose how much you want the data vs how quickly you want to recovery to run.

Regarding keeping backups for 30 days - absolutely agree. It costs very little to do this, and can save you big time.

Hiya,
I had the opposite experience with Ghost, it failed when trying to restore a image of Windows server... ahhhhhhhhhhhh disaster, cost me hours and hours to re-install and re-configure. Especially embarrassing as i had made a point with the client that if they had a proper backup (imaging) system then if all hell broke loose i could have them back up and running inside an hour ... :(

I also use Testdisk, love it, don't mind the command line interface as I started in computers with Dos 3.3, 286 CPU, 20 meg H/D and if I remember correctly 4 meg of ram.

I also have an arrangement with a data recovery company in Melb, so if the board on the drive is fried or for whatever reason i cant recover the data myself they can in most cases. This allows me to take on all data recovery jobs and if it is possible to recover data "I" can do it.

Will have a look at unstoppable Copier, sounds good.

rgds
Syb
 
Last edited:
We only do an image if we suspect a failing drive. To save time we always run Fab 's Auto Backup to backup all the data which is much quicker.
 
Back
Top