Need help with failing Hard drive

[16bwhitt]

Hi all- First time dealing with file recovery. Had a customer with a failing hard drive after it repeatedly lost power (bad ice storm with power outages and surge/brown-outs). I took the hard drive out, and slaved it onto my computer to see if I can see the files. I could not. So, I ran chkdsk /f to see if that would help and it did. I could then see the disk and the files. (NOTE: In disk management, it says the drive is healthy). So, I copied all the files and transferred them over to a folder on my computer, and now I am running Macrium on the drive and cloning it.

Am I doing the right thing? Should I have done anything different?

I explained to him that we can either replace the hard drive (and CD-ROM, that is broken too), or he can get a new computer. He would like a new computer. It is, of course, coming with Windows 10. I have never used Macrium before, but what I understand is that all I do is create a disk from the clone and boot from the disk and it begins restoring the data. So this will overrride the Windows 10 OS, and reinstall 7 and all the files? Or will it keep 10 and put the files back on there?

I have already recommended BackBlaze and possibly an external drive for backups in the future.

 

[300DDR]

ARG... NEVER run chkdsk on a questionable drive! You should always clone first. If you can't, then at least use something like R-Studio to recover the files BEFORE running chkdsk (which can completely destroy files to the point they are unrecoverable and/or destroy the partition structure). But... well done for checking in on the forum so in the future you can do it the safer way.

 

[Pacific Blue IT]

Plug his old drive to his new computer and use Fabs to transfer the data, offer him an external back up drive with his recovered data on it.
For recovery and cloning most here use ddrescue I believe, there's a guide on the Technibble articles.

 

[16bwhitt]

ARG... NEVER run chkdsk on a questionable drive! You should always clone first. If you can't, then at least use something like R-Studio to recover the files BEFORE running chkdsk (which can completely destroy files to the point they are unrecoverable and/or destroy the partition structure). But... well done for checking in on the forum so in the future you can do it the safer way.

I read that just a few minutes ago after searching the forum. . Although, it did get me to a point in which I can see files. Some files is better then no files, right?

 

[Larry Sabo]

+1 to what 300DDR said. I'd recommend running ddrescue to clone any drive that is experiencing problems--before attempting to recover any data--and then working on the clone. Many imaging programs choke up when they come to unstable sectors--even if you tell them to skip them--and you can end up flogging the drive to death trying recovery programs.

Edit: Being able to see a file structure/listing just means you can read the MFT; it doesn't mean you can actually read the files listed. Hence the importance of imaging sector-by--sector before trying to recover any of those files.

 

[Markverhyden]

Double ditto on the imaging first. The reason that should ALWAYS be your first step is you have no idea what is wrong or how long the old HD will last. Once you have the image you work off of the image because you know your drive is good (hopefully)

 

[lcoughey]

I read that just a few minutes ago after searching the forum. . Although, it did get me to a point in which I can see files. Some files is better then no files, right?

As long as you are honest with your client that your running chkdsk might be why they are getting some files instead of all files.

 

[16bwhitt]

As long as you are honest with your client that your running chkdsk might be why they are getting some files instead of all files.

How would you recommend getting and accessing a hard drive that is asking me to format it, and is giving me a CRC error?

I just tried imaging it, and it got to about 95% and it aborted due to a Cyclic Redundancy Check error 23 in Macrium. Cloning it won't work either.

 

[lcoughey]

Here are a couple articles I wrote for this forum:

https://www.technibble.com/forums/resources/how-to-triage-a-hard-drive.17/
https://www.technibble.com/forums/resources/data-recovery-process.18/

And an article on my company blog why to never run chkdsk without first having the data backed up

http://www.recoveryforce.com/is-it-safe-to-run-chkdsk/

If the drive is not stable enough to read, it most definitely is not stable enough to write to. And, by doing so, it will only make things worse.

Macrium is not designed for failing hard drives. If you can't clone it with ddrescue, you definitely need data recovery hardware. What tools did you use to clone the drive that couldn't work?

 

[brandonkick]

Learn from this one.

If you can't get a good clone with ddrescue then your next step would be
to ask the customer how valuable the data is to them. Chances are if you
can't get a good clone, then you aren't capable of safely and successfully
getting the maximum amount of recoverable data back.

Customers might gripe about a few hundred dollars in data recovery fee's
but are all those business documents or years upon years of family photos
worth it? If you botch the repair attempt, you've basically made that decision
for them.

 

[Rosco]

I agree with everything said here. It is so lucky you totally did not destroy all the data. I would recommend buying parted magic and use ddrescue. It is only like 9 bucks. Plus it has a ton of diagnostics like gsmartcontrol.

 

[fencepost]

I would recommend buying parted magic and use ddrescue.

I highly recommend Parted Magic for everyone, but on my (admittedly slightly out of date) version the "easy" way to run ddrescue is through a GUI which quite frankly seemed to have a variety of poor choices and no way to set some options I was reading about elsewhere. It's what I ended up using to image the only drive I've needed to do any recovery on recently, but I ended up needing to run it from the command line.

 

[glennd]

I highly recommend Parted Magic for everyone, but on my (admittedly slightly out of date) version the "easy" way to run ddrescue is through a GUI which quite frankly seemed to have a variety of poor choices and no way to set some options I was reading about elsewhere. It's what I ended up using to image the only drive I've needed to do any recovery on recently, but I ended up needing to run it from the command line.

I didn't know there was a gui. I've always used the command line.

 

[GTP]

Ive had great success with failing/failed drives by running "Spinrite" at level 4. I always run Spinrite at level 2 when the customer starts to complain about "weird" things happening on their computer, just in case. As soon as Spinrite is finished I clone the drive and also backup their document folders just in case.

 

[Kitten Kong]

Spinrite is basically snake oil.

I wouldn't dream of using it on ANY machine ever.

The damage it can, and does cause is beyond belief!

 

[GTP]

Spinrite is basically snake oil.

I wouldn't dream of using it on ANY machine ever.

The damage it can, and does cause is beyond belief!

Heehe! Ill forward this on to Steve Gibson at GRC.com, Im sure he will get a giggle from it!

 

[Eagle21]

Heehe! Ill forward this on to Steve Gibson at GRC.com, Im sure he will get a giggle from it!

Steve can giggle as much as he likes. Spinrite is still snake oil.

I'm selling some magnetic bracelets, and thought you may be interested. They improve blood flow, relieve pain, and help cure cancer.

 

[Kitten Kong]

I've never heard of Steve Gibson, don't know who he is, or what his company is about.

To be honest, I don't really care either. I know that I could count the number of techs who would trust spin rite (from tn), on the fingers on one hand, it is that good of a 'repair' tool.

As @Eagle21 has stated. As well as the magnetic bracelets, I have some tin foil hats here, which stops interference from the wireless radio waves, from transmitting to your brain. Only asking $99 each for them.. how many would you like?

 

[Markverhyden]

I've never heard of Steve Gibson, don't know who he is, or what his company is about.

To be honest, I don't really care either. I know that I could count the number of techs who would trust spin rite (from tn), on the fingers on one hand, it is that good of a 'repair' tool.

As @Eagle21 has stated. As well as the magnetic bracelets, I have some tin foil hats here, which stops interference from the wireless radio waves, from transmitting to your brain. Only asking $99 each for them.. how many would you like?

Gibson is of the Gibson Research which also does Shields Up. Unlike spin rite, shields up is actually a good tool.

 

[Kitten Kong]

Ahh cheers Mark.