What's your preferred method for testing a hard drive?

Any use of the drive could make the situation worse and could kill the drive. However getting a sector by sector clone gives you a better copy of data to work from and if you use a good program like ddrescue it has a log file option and can skip/retry bad areas rather than just locking up, which gives a much better chance of recovering the most data.
 
My question is: couldn't that potentially kill off the drive before the user data is saved? And what about the length of time this could take?
I usually use Fab's to save user data before full surface scan tests or cloning.
A properly configured cloning process is much less likely, in fact to do damage than a file copy.

Doing a file copy requires mounting the hdd, which already risks data. I forget the specifics but I know a member here wrote a good write up on why even just mounting the drive can cause damage. Maybe @lcoughey or @Markverhyden

Ddrescue works on unmounted drives to avoid just that issue. Another big advantage is that unlike a standard copy/paste job (which is essentially what fabs does) it won't keep retrying to save something from a bad sector over and over. There are options in ddrescue that you set to make it skip over a bad sector, so you get all of the good sectors first and then can come back to the bad ones later. A file copy will get stuck there, potentially allowing sectors that started off good enough to read, to become bad before you get data from them.

@Bryce W did a very good write up on how exactly ddrescue works here
https://www.technibble.com/technical-overview-of-popular-software-data-recovery-procedures/

If someone could find that other article or post about mounting drives I'd appreciate it too. My searchfu has failed me.
 
I wrote about mounting drives in that same guide (ctrl + f "drive mounting"). Definitely not a good idea for questionable drives.
OK, I have read that and now I get it.

Now I'm looking for a way to disable auto-mounting in Windows 7 for drives I connect to my workbench computer.
 
OK, I have read that and now I get it.

Now I'm looking for a way to disable auto-mounting in Windows 7 for drives I connect to my workbench computer.
I would recommend a Linux as an alternative to Windows 7. You can get a Parted Magic iso and boot from a disc if nothing else. Linux handles this situation better.
 
I would recommend a Linux as an alternative to Windows 7. You can get a Parted Magic iso and boot from a disc if nothing else. Linux handles this situation better.
DeepSpar has a bootable diag program that allows you to deactivate the MBR, making it so that the system won't see partitions on a drive or attempt to mount them.
 
Now I'm looking for a way to disable auto-mounting in Windows 7 for drives I connect to my workbench computer.

My understanding is that this is impossible. The only way to prevent automatic mounting is to use a different operating system.
 
I notice many here suggest taking a sector-by-sector image or clone immediately after any sign of HDD problems.
My question is: couldn't that potentially kill off the drive before the user data is saved? And what about the length of time this could take?.

Drives that have suffered some sort of head crash have limited life left, best to capture what data is salvageable while you can; if the drive fails attempting it, then it fails. (Not as if it would proceeded merrily unaffected without the attempt)
 
Drives that have suffered some sort of head crash have limited life left, best to capture what data is salvageable while you can
Well that was a given in my question.
My thinking was that copying specific folders from the drive first like Documents and Pictures might result in less stress on the drive than reading all sectors from the beginning of the drive, presumably copying many gigabytes of useless OS and program files before getting anywhere near the user data.
It's been pointed out that mounting the drive and reading say 10GB of user files at the filesystem level might put more stress on the drive than reading say 1000GB sector by sector sequentially without mounting. It's a tough call and I'm not sure how anyone can be sure of the strategy as a blanket rule.

The other part of my question (not yet addressed by the other responders) was about the time and effort required to image a drive before attempting recovery of files. In my repair shop I'm not sure it's feasible to image every drive that I suspect is failing. I think the more practical strategy should take into account the majority of cases (in my experience) where files are easily recovered if a drive can be mounted, and drives dying completely in the middle of file recovery is rare. My usual charge is 1.5 hours labour for replacing a drive, re-installing Windows, all updates, installing a few basic apps, and attempting data recovery. In my market (home and small business users) it isn't feasible to spend that much time in every case.
 
  • Like
Reactions: GTP
I've recovered tens of thousands of hard drives over the years. P-List develops the best professional data recovery imagers in the world. It would seem reasonable to just trust us. Or, you can take some time to research how you will force the heads to thrash around and repeatedly access the MFT plus the hard drive's built in functions to re-read and remap bad sectors and the drive going unresponsive.

I get drives every day where a tech tries to directly recover the files for days or weeks. Many we recover in a few hours after receiving the drive.
 
Well that was a given in my question.
My thinking was that copying specific folders from the drive first like Documents and Pictures might result in less stress on the drive than reading all sectors from the beginning of the drive, presumably copying many gigabytes of useless OS and program files before getting anywhere near the user data.
It's been pointed out that mounting the drive and reading say 10GB of user files at the filesystem level might put more stress on the drive than reading say 1000GB sector by sector sequentially without mounting. It's a tough call and I'm not sure how anyone can be sure of the strategy as a blanket rule.

The other part of my question (not yet addressed by the other responders) was about the time and effort required to image a drive before attempting recovery of files. In my repair shop I'm not sure it's feasible to image every drive that I suspect is failing. I think the more practical strategy should take into account the majority of cases (in my experience) where files are easily recovered if a drive can be mounted, and drives dying completely in the middle of file recovery is rare. My usual charge is 1.5 hours labour for replacing a drive, re-installing Windows, all updates, installing a few basic apps, and attempting data recovery. In my market (home and small business users) it isn't feasible to spend that much time in every case.

My best practice is to image any drive that is questionable/has problems, no exceptions. The added advantage is a proper image process can include a log file so you can clearly see if there are bad blocks. Pretty simple concept. Even one bad block is reason to not bother doing anything else given the price of new or used HD's. Now that you have an image you can, after making a copy of it of course, work on getting data, doing P2V, etc.

But I don't do much in the break/fix arena these days. So I can understand someone wanting to shave time to improve turnaround times. Even over the native interface, such as SATA, this can take time for large drives. The risk is their's to make.

As mentioned you should use some Linux flavor to do this work. You can use the diskpart command to prevent automount in Windoze. But I've never tried that. One reason is Windoze update has a habit of resetting system settings to default, automount enabled is the default setting. The reason I avoid using Windoze is, if I'm not paying attention, chkdisk may kick in if it detects a mountable partition with the dirty bit set.

What to charge the customer? Depends. Take a look at data recovery prices from various vendors and you will see they are usually flat rate, ignoring disk repairs. Personally I charge $50 for a setup fee, which is waived if I do a paid data recovery. I charge based on my time not elapsed time on a machine grinding away. So it's 1-2 hours. This is over and above any charges related to repairs.

A recent example. OS X Server, which uses mdadm for software raid. The internal drive was mirrored to an attached USB drive. Something poisoned the array so not only was it not booting to an OS with either drive, neither drive was working properly within Finder to recover data with in OS X. Imaged the drive using R-Studio and was able to get all the important stuff.

The data recovery part took almost 12 hours but I was using a USB2SATA bridge for the internal drive. Probably spent a total of 20 minutes monitoring the process. I charged 250 for the data recovery, drive and restore. Normally this would have been something like $350, $100 DR plus repair, but I cut them some slack as the total bill, due to onsite time, was well north of $1k.
 
  • Like
Reactions: GTP
Actually, our friends over at Deepspar/Rapidspar (@P-List here) wrote it.

I wanted to thank you @Bryce W as I hadn't seen that. I've moved almost all my drive imaging and recovery back over to Linux now. Ironically I used to use Linux almost exclusively (except in the corporate world) and had gone back to Windoze to practice what I preach and service.
 
OK, I have read that and now I get it.

Now I'm looking for a way to disable auto-mounting in Windows 7 for drives I connect to my workbench computer.

@Slaters Kustum Machines beat me to it, but I highly recommend picking up Parted Magic and using that for recoveries instead. One nice thing about doing this is that on Parted Magic or other "recovery" distributions they'll mount any filesystems as read-only so there's no concern about anything being written back to it (chkdsk "fixing" bad entries by deleting the files, etc.)

Parted Magic gets updated 4-5 times a year (including about 3 weeks ago), but it mostly doesn't change that much if you want to only do a one-time purchase of it. It's only $9 for that, so it's not like it's going to break the bank.
 
A few questions for Parted Magic.
  • Do you make a clone to another known good drive or to a server?
  • Assume in most cases you remove the drive from the original computer unless it's one of those crappy laptops where you have to strip it down to nothing to get to the drive?
 
Normally, I would think before you being just about any repair.... it's important to ask the
customer if they have ANY data at all on the machine they cannot afford to lose. Those family
vacation pictures, well it would suck to lose them, is one thing... those mission critical business
documents... well that's another.

Ask if any type of really valuable data exists on the machine. Ask if they have any backups of the
data (that isn't on the same machine).

If you think the drive may be failing.... your better off making a backup first. It's a set it up and
walk away thing.... sure it might take hours, but it doesn't take hours of you actually doing anything.
Get the clone on your bench, then run fabs against the clone after you've put in and set up a new
drive in the clients computer. All of that will probably be faster then doing all those scans and
diagnostics to see if the original drive is good or not.


If I suspect a drive is bad (running REALLY slow or I can physically hear the drive making noise) I'll just
change it out. I don't trust smart other than to confirm a drive is bad, good smart results do not mean
the drive is good.
 
Do you make a clone to another known good drive or to a server?

Yes. (really, take your pick. If going over a network, I highly recommend that it be wired Gigabit. If going to a local USB, I highly recommend that it be USB3.)

Assume in most cases you remove the drive from the original computer unless it's one of those crappy laptops where you have to strip it down to nothing to get to the drive?

I think this depends on what you think may be wrong and on the capabilities of the system it's in. Parted Magic will be booted from USB (or CD) unless you're moving the drive into a bench system. Your fastest throughput would be to put the drive in a bench system and go to another local drive or array, but for an awful lot of drives the extra time of pulling the drive may eat up the transfer time savings.

If the cloning will work just as fast without moving the drive and you're not suspecting other hardware problems, my inclination would be to leave the drive in place.

And a caveat on "what you think may be wrong" - if it has "can't lose" data and has had any physical trauma, pull it and send it to a pro like @lcoughey or @300DDR (after discussing with the customer).
 
A few questions for Parted Magic.
  • Do you make a clone to another known good drive or to a server?
  • Assume in most cases you remove the drive from the original computer unless it's one of those crappy laptops where you have to strip it down to nothing to get to the drive?
We typically clone to another drive, sometimes we do clone to our server though. We also pull the drive and connect it to our dedicated computer via SATA.
 
My thinking was that copying specific folders from the drive first like Documents and Pictures might result in less stress on the drive than reading all sectors from the beginning of the drive, presumably copying many gigabytes of useless OS and program files before getting anywhere near the user data.
It's been pointed out that mounting the drive and reading say 10GB of user files at the filesystem level might put more stress on the drive than reading say 1000GB sector by sector sequentially without mounting. It's a tough call and I'm not sure how anyone can be sure of the strategy as a blanket rule.

Absolutely in some particular cases connecting it to Windows and copying files might be a better way. This is a highly unusual scenario though. If Windows could mount the drive and critical files could be saved successfully within Windows then that's a pretty strong indicator that the drive is not too bad. At least it doesn't have bad sectors scattered all over, so probably the heads are not about to crash. The best case for Windows is if there is some localized media damage on the drive that could be avoided entirely by doing a targeted recovery, but ddrescue would handle this situation quite well too by aggressively skipping around the scratch on early imaging passes. In this particular and uncommon situation, Windows would likely be better, but in the vast majority of such cases both procedures would still result in successful recovery.

The thing is, typically the condition of the drive is unknown before recovery procedures are started, so the process should be geared for a drive in an unknown state. Windows-based recovery procedures are definitely much more sensitive to problematic drive behavior than Linux-based procedures. In other words, it takes much less damage for the drive to fail to mount under Windows, or for the file recovery process to fail at some point (for example due to a blue screen, reboot, software crash/freeze, etc.).

If you start a recovery under Windows and it doesn't work out for some reason then there are heavy opportunity costs. At that point the mounting process likely overwrote some data, and the drive went through unnecessary stress which reduced the chances of future recovery. Worst of all, there will either be no results at all (if it failed to mount), or only partial results, and to try to do it better you'd have to start the recovery from scratch on Linux.

If you start all your recoveries with a ddrescue image under Linux then your opportunity cost is some lost time for cases where it turns out to be unnecessary. It is extremely improbable for there to be a case where the drive would crash during the first ddrescue imaging pass, but would successfully mount on Windows, and allow critical files to be copied without crashing. Such cases would definitely be very rare (<1%) due to how aggressively ddrescue skips around bad areas on the first pass.

Of course this is all only applicable for cases which are not viable to send out to professionals and must be done in-house with software.
 
Thanks for your post. @P-List.
If Windows could mount the drive and critical files could be saved successfully within Windows then that's a pretty strong indicator that the drive is not too bad.
Yes, and this is very common in my experience.
The best case for Windows is if there is some localized media damage on the drive that could be avoided entirely by doing a targeted recovery
On the front line, in a computer repair shop, HDD problems most commonly manifest as:
- Failure to boot due to missing or corrupt Windows files
- Extreme slowness
- Bootable drive not found

The first two are probably cases of localised media damage, occuring in some Windows files presumably because that part of the HDD has been most heavily used. In both of these two types of cases, I have had very good success recovering data using a Windows workbench and GetDataBack software if needed. The last type, if the drive is still detected by the BIOS, might be a candidate for Linux-based recovery so I might try that next time.

If you think the drive may be failing.... your better off making a backup first. It's a set it up and walk away thing.... sure it might take hours, but it doesn't take hours of you actually doing anything.
I get this, but it still takes an extra 15 mins or so of billable time, and more importantly it ties up equipment and reduces how many jobs I can work on at once. And I also need to consider the fact that I've successfully recovered data in at least 90% of cases that the drive is mountable.
 
Back
Top