{"id":53079,"date":"2019-11-23T00:00:00","date_gmt":"2019-11-22T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/samostoyatelnaya-diagnostika-zhestkih-diskov-i-vosstanovlenie-dannyh"},"modified":"2020-02-18T14:00:56","modified_gmt":"2020-02-18T11:00:56","slug":"samostoyatelnaya-diagnostika-zhestkih-diskov-i-vosstanovlenie-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/samostoyatelnaya-diagnostika-zhestkih-diskov-i-vosstanovlenie-dannyh","title":{"rendered":"Self-diagnosis of hard drives and data recovery","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

This article describes methods for self-diagnosing various faults in hard drives based on the symptoms presented, as well as relatively safe ways to clone hard drives with minor issues.<\/p>\n

Various cases of data loss are considered along with a set of optimal actions that can help you restore your information without outside help, even with limited knowledge of file system operations through automatic recovery programs.<\/p>\n

However, before you begin any self-directed actions, it is essential to carefully review all the materials in this article, and only then analyze the condition of your hard drive, to ensure that your attempts do not lead to its final failure and do not rob you of your last hopes for recovering the necessary data. <\/p>\n

\"Self-diagnosis
\n <\/a><\/noindex><\/p>\n

CONTENTS<\/h2>\n

\n<\/p>\n

Part One: Diagnostics<\/h3>\n

<\/a><\/noindex>
\n1. Visual Inspection<\/b><\/a><\/noindex>
\n2. Test Startup<\/b><\/a><\/noindex>
\n3. Preparation for Testing<\/b><\/a><\/noindex>
\n4. Testing<\/b><\/a><\/noindex>
\n5. Sector-by-Sector Copy<\/b><\/a><\/noindex><\/p>\n

<\/p>\n

Part Two: Data Recovery.<\/h3>\n

<\/a><\/noindex>
\n6. Methods of Data Recovery<\/b><\/a><\/noindex>
\n7. Typical Cases and Recommended Actions<\/b><\/a><\/noindex>
\n8. File Integrity Check<\/b><\/a><\/noindex>
\n9. Common User Errors<\/b><\/a><\/noindex><\/p>\n

By agreeing to follow the further instructions, you acknowledge that no one other than yourself is responsible for any potential failure of the drive and irreversible data loss. The set of measures is aimed at reducing the likelihood of an unfavorable outcome but does not provide a 100% guarantee against it.<\/p>\n

<\/a><\/noindex><\/p>\n

Diagnostics<\/h2>\n

\n<\/a><\/noindex><\/p>\n

1. Visual Inspection<\/h4>\n

\nInspect the drive for any deformations, missing or burnt elements on the controller board, and check the integrity of the connectors. If serious damage or burnt elements are found, it is strongly recommended not to apply power to that drive to avoid worsening the problem.<\/p>\n

Using screwdrivers (typically Torx \u2014 T5, T6, T9), unscrew the screws securing the controller board and check the condition of the contact pads on the controller board. <\/p>\n

\"Self-diagnosis
\nFig. 2 shows that there is an oxidized film on the contact pads.<\/i><\/p>\n

If there are oxides, you can try to remove them from the contact pads using a regular eraser. You can only work with the eraser on flat surfaces, as shown in the illustration. In other cases, this action is not applicable.<\/p>\n

\"Self-diagnosis
\nFig. 3 cleaned contact pads.<\/i><\/p>\n

If any damage to the board is found, do not attempt to substitute the controller board from a similar drive in modern hard drives, as the firmware on the board may contain various adaptive parameters that are formed during the manufacturing cycle and are unique to each drive. In relatively rare cases, foreign parameters may lead to damage to the hard drive.<\/p>\n

If you have a soldering station, you need to transfer the MCU, EEPROM, NV-RAM, NAND (depending on what is present on the controller board and what must be transferred) and after such adaptation, use a donor controller. It should be noted that for adapting many controllers, it is sufficient to transfer only the EEPROM chip.<\/p>\n

When selecting a board, first look at the printed circuit board (PCB) number. Then assess the match of the MCU and VCM&SM controller markings. If the markings of the MCU and VCM&SM controllers differ between the original board and the donor board, there is a high likelihood that the potential donor board is not suitable. Within a single family, different versions of boards may exist, and in some cases, they may be compatible with certain conditions, but it is not advisable to try to determine this at home.<\/p>\n

Attempting to substitute an incompatible controller board (with a different PCB number) may lead to the burning out of the preamplifier switch.<\/p>\n

If you have a multimeter, check the 5V and 12V circuits for short circuits. Also, check the resistance of the motor windings. If there is a guaranteed functioning identical drive available (matching manufacturer, model series, controller board revision), verify if the same number of pins in the switch connector will show continuity to 'ground' and compare resistances. Significant differences may indicate that the switch-preamp is faulty, and you should cease any further attempts at data recovery.<\/p>\n

<\/a><\/noindex><\/p>\n

2. Test Startup<\/h4>\n

\nEnsure that your test system is functioning properly to avoid misdiagnosis. If no external factors hinder the startup attempt, connect the interface cable and power cable to the appropriate ports and turn on the power supply.<\/p>\n

If you are aware that the drive has been dropped or struck while in operation, or if it started making knocking sounds before reaching you, refrain from attempting to power it on.<\/p>\n

In such cases, opening the hard drive in a laminar flow box (or clean room) is mandatory, along with meticulous examination using a microscope.<\/p>\n

\"Self-diagnosis
\nFig. 4 Connecting cables to hard drives.<\/i><\/p>\n

After power is supplied, the drive should start spinning the spindle. In some cases, this may not happen with completely functional drives if a spin-up command has been configured in the drive settings for some reason. <\/p>\n

When the spindle is rotating, a slight noise from the airflow is audible. In some drives, this sound is barely perceptible, so you may use a stethoscope (or hold the drive close to your ear while adhering to all safety protocols to avoid short circuits).
\nIf instead of the airflow noise, you hear a series of cyclic buzzing, faint beeping, or sounds reminiscent of telephone busy signals, the drive is most likely unable to start the spindle. Possible causes include the read\/write head sticking outside the parking zone, a seized spindle, or a malfunction in the VCM&SM controller chip.<\/p>\n

If a suitable donor drive is available, you can check the version with a VCM&SM controller malfunction, provided you are ready to carry out the necessary adaptations of the donor board as described in the 'visual inspection' section.<\/p>\n

In cases where the BMG sticks outside the parking ramp, self-actions motivated by videos on YouTube usually lead to additional scratches on the surfaces of the plates or detachment of sliders. Even if you manage to reasonably get the BMG onto the parking ramp, the defects in the polymer coating that occurred at the slider sticking points, micro-scratches from the sliders obtained during the BMG extraction, combined with offline scanning procedures and dust from unclean air, are unlikely to allow you to read a significant volume of data in the overwhelming majority of cases before further irreversible degradation processes begin. You can learn how data recovery occurs in such cases at a specialized company in this article. Data Recovery from Seagate FreeAgent Go External Hard Drive<\/a><\/noindex><\/p>\n

In case of the motor shaft seizing, usually a disk pack transplant is required in the hermetic block of the donor drive. Such an operation at home without proper preparation and the absence of necessary tools will in 99.9% of cases be doomed to failure.<\/p>\n

If there is no sound when power is applied and the drive does not start spinning the shaft, the following diagnoses are possible: the controller board is faulty, the preamplifier switch is faulty, or the BMG is faulty.<\/p>\n

Once the drive starts spinning the shaft, it must perform calibration, read the firmware, and, after initializing the translation system, be ready. If, instead of calibration, cyclic knocking sounds, grinding, or other loud noises occur, immediately turn off the drive. Such phenomena may be caused by: a malfunction of the BMG or preamplifier switch, or a defect in the VCM&SM controller chip.<\/p>\n

Some drive firmware polls the preamplifier switch before the motor spindle spins up, and if it detects an incorrect response or an over-the-limit resistance in any of the heads, it performs an emergency stop of the initial initialization process. Unfortunately, not all firmware adequately checks the device's integrity and allows attempts to start a clearly problematic hard drive. It is recommended to perform the head swap in a laminar flow cabinet with a clean air stream and specialized tools. Additionally, it is essential to know how to select a donor to choose one with a compatible revision of the preamplifier switch, head map, and similar adaptive parameters. Just a match of the manufacturer and model does not guarantee that the drive is a suitable donor. Even if you manage to independently find a donor and carry out the swap procedure, it is unlikely that you will be able to read a significant volume of data due to accompanying issues.<\/p>\n

The actions that can be taken in case of a faulty controller board are specified in the 'Visual Inspection' section.<\/p>\n

\"Self-diagnosis
\nFig. 5 severely scratched surface of the platter (multiple grooves).<\/i><\/p>\n

It is important to understand that with each attempt to power on a drive with a faulty head stack assembly, there are risks of further damaging the surfaces of the platters, which may lead to a complete inability to recover data.<\/p>\n

If the drive does not emit any suspicious sounds, then after performing all initialization procedures, it should be ready. From this moment, the drive should be prepared for data exchange through the interface, and if connected to the motherboard port of the PC, it should respond to the BIOS's requests for its identification. If everything is in order with the connections and BIOS settings, but the disk remains invisible to the PC, then it is likely that there are firmware issues preventing it from becoming ready.<\/p>\n

If the drive returns incorrect identification data, such as only the model name and zero capacity, or if the model name is not quite as it should be and the serial number is missing, it indicates that the initialization procedures have failed, and there are issues with the firmware. In such cases, it is usually impossible to resolve the problem independently without using professional software and hardware solutions.<\/p>\n

An exception can be made for the Seagate 7200.11 (Moose family), with which some problems were solvable using an RS232-TTL adapter and a standard terminal, but here it is important to understand that without delving into the microcode problem, there is a risk of significantly exacerbating the situation.<\/p>\n

It is strongly not recommended to apply this method to other families, as it will lead to a recalibration of the translator, which in the vast majority of cases will be incorrect, and access to the user area will extend only to the first point of discrepancy. Data recovery in this case becomes significantly more complicated.<\/p>\n

If all fields in the drive's identification report are correct except for the capacity, then it is necessary to check whether this is due to a BIOS error on certain motherboards, which, using HPA management commands, instead of cutting a small piece of the LBA range to preserve a copy of the BIOS, cut nearly 1TB.<\/p>\n

\"Self-diagnosis
\nFig. 6 The identification capacity of the 1TB disk after incorrect BIOS operation of Gigabyte motherboard.<\/i><\/p>\n

To solve this problem, you can use HDAT2 or similar free diagnostic software, which can restore the original identification capacity of the drive, as well as disable HPA management in DCO to prevent recurrence of the issue.<\/p>\n

<\/a><\/noindex><\/p>\n

3. Preparation for Testing<\/h4>\n

\nWhen testing drives outside of professional setups, it is important to prepare the operating system in advance. Automatic mounting of disk volumes should be disabled to avoid any interference from the operating system.<\/p>\n

In Windows OS, this can be done by launching it with administrator rights diskpart<\/b> and executing the command automount disable<\/b>. If the potentially problematic disk was previously connected to this OS, it is necessary to remove the mounting parameters from the registry with the command automount scrub<\/b>To apply these settings, a restart is recommended.<\/p>\n

It is also necessary to prepare diagnostic software. On Windows, you can use the free PC3000 DiskAnalyzer, which not only has a diagnostic function but also the capability to create sector-by-sector copies. It is also advisable to have a bootable USB flash drive with HDAT2 at hand.<\/p>\n

It is not necessary to use only this software for diagnostics. You can utilize any other analogs, except for some paid software aimed at overly trusting users, which may advertise slogans such as \"... unique program for regeneration of physically damaged hard disk drives. It does not hide bad sectors, it really restores them!\". When such loud claims are made, the software often has very modest capabilities, no better than free software, and the ideology of dealing with defects is more aimed at ultimately destroying the drive rather than assisting in data recovery.<\/p>\n

If the OS boot time has increased several times with the drive connected, even with automatic volume mounting turned off, it is recommended to cease any further actions to avoid worsening the problem.<\/p>\n

A significant increase in OS boot time when connecting a potentially problematic hard drive is a very characteristic sign that there are surface defects present on the drive plates. Delays in OS booting occur due to calls to defective sectors and attempts by the firmware to perform offline scanning procedures that it cannot handle.<\/p>\n

After successfully loading the operating system, open Device Manager and ensure that your drive is listed among the devices. If it is not there, check if the driver for the controller it is connected to is installed and if the controller itself is enabled in the device list. If the driver and OS settings are fine, but the drive still doesn't show up in the OS or disappears after a while, this typically indicates a wide range of issues. The most likely causes are controller board malfunctions, the drive firmware hanging, or the drive entering a failure mode where it stops responding to most commands.<\/p>\n

To clarify the diagnosis, you can try booting into DOS and using HDAT2 to check the SMART parameters. If signs of defects are detected (non-zero values for attributes 5 and 197 (C5) in the fields for unnormalized values), it can be concluded that nothing can be done at home without changing firmware settings. If there are no signs of defects, the cause of the stalls may lie in the improper functioning of the controller board. In this case, you might try using a controller board from a donor drive.<\/p>\n

<\/a><\/noindex><\/p>\n

4. Testing<\/h4>\n

\nHaving gone through the previous steps without noticing substantial reasons to stop the process, you can proceed to further assess the state of the drive. Most drives released this century are equipped with S.M.A.R.T. technology, which monitors the drive's condition and logs various events over its operational lifespan. You can read more about the implementation of this technology in HDDs and which parameters to monitor during disk operation in our article \"What is SMART and How to Read It\"<\/a><\/noindex>.<\/p>\n

Using diagnostic software, you need to request the S.M.A.R.T. parameters. <\/p>\n

\"Self-diagnosis
\nFig. 7 SMART attributes of a healthy hard drive<\/i><\/p>\n

It is important to evaluate the indicators for attributes 5 and 197 (C5). If the values in the RAW column are zero or the problem indicators are minimal, then you should proceed to further testing. <\/p>\n

\"Self-diagnosis
\nFig. 8 SMART attributes of a drive with serious defects<\/i><\/p>\n

If the number of candidates for defects is a three- or four-digit number, then in most cases, further attempts at surface testing or scanning with data recovery utilities will exacerbate the problem to the point of making data retrieval completely impossible.<\/p>\n

To recover data in such cases, it is important to intervene in the firmware settings of the drives and disable offline scanning procedures and S.M.A.R.T. logging to free the drive from background processes that can significantly shorten the lifespan of the problematic device. Unfortunately, simple methods cannot achieve this without a deep understanding of the architecture of drive firmware and professional tools. The next task is to assess the condition of each head individually and localize the main defective zones. Linear reading with multiple repetitions over defective areas is contraindicated in such cases as it is too risky.<\/p>\n

Even if the drive appears to be functioning correctly at first glance and there are no signs of defects according to S.M.A.R.T. readings, this does not guarantee that there are no defects. Therefore, it is necessary to perform a final testing stage and validate the surface.<\/p>\n

It is important to continuously monitor the scanning process. If any unusual noises occur or large areas with reading errors are detected, immediately stop the process and disconnect the drive to avoid irreversible consequences.<\/p>\n

\"Self-diagnosis
\nFig. 9 Scanning graph of a functioning disk<\/i><\/p>\n

If the result of scanning the disk yields a monotonously decreasing speed graph with no reading errors recorded, the drive can be considered functional, and you can proceed to the next section.<\/p>\n

In disks with a large media cache and different types of translation from the classical one (usually in disks with shingled magnetic recording (SMR)), the graph may exhibit a different shape. Various kinds of dropouts are possible.<\/p>\n

\"Self-diagnosis
\nFig. 10 Scanning graph of a disk with a problematic head<\/i><\/p>\n

If cyclic 'slow' zones are detected during disk verification, this is a characteristic sign of a head that is not entirely functional. Do not wait for defects to be found; testing should be stopped immediately.<\/p>\n

In such situations, one cannot expect anything good from attempting data extraction independently. There is a high likelihood that the drive will not survive the attempt to create a sector-by-sector copy using user-available tools.<\/p>\n

In cases where the S.M.A.R.T. attributes 5 and 197 (C5) show signs of defects, or if point defects are detected during verification, a disk copy must be created.<\/p>\n

<\/a><\/noindex><\/p>\n

5. Sector-by-Sector Copy<\/h4>\n

\nIf the testing results show that the drive is functioning well and no issues are detected, you may not need to create a sector-by-sector copy and can work with the original disk. However, to avoid various unforeseen circumstances, it is strongly recommended not to skip this step and to continue working only with the copy.<\/p>\n

With a functioning hard drive or a drive with a few defects, there is not much difference in the tools you use, as long as they create a complete copy. It is also important not to try using options from some programs for creating compressed images, as you will likely only be able to work within the limitations of the software that created such an image.<\/p>\n

On Windows, the following programs can be used: WinHex, DMDE, PC3000 DiskAnalyzer, R-studio, and others.<\/p>\n

On Linux, the built-in dd command is sufficient.<\/p>\n

Not all software is free, but many trial\/demo versions will have sufficient capabilities for creating a copy of the drive.<\/p>\n

As an example, we will use WinHex for disk cloning. <\/p>\n

\"Self-diagnosis
\nFig. 11 options in the WinHex menu for disk cloning.<\/i><\/p>\n

In the \u2018Tools\u2019 tab, select the \u2018Disk Tools\u2019 option, then choose \u2018Clone Disk\u2019 from the dropdown menu or simply press Ctrl+D.<\/p>\n

\"Self-diagnosis
\nFig. 12 cloning parameters settings.<\/i><\/p>\n

For the source, select the disk that needs to be cloned.<\/p>\n

The destination can be a disk of equal or greater capacity, or it can be cloned to a file image.<\/p>\n

Make sure there is enough free space on the destination disk.
\nIn the copy settings, it is advisable to enable the \u2018skip defect sectors\u2019 option.<\/p>\n

If your drive has a sector with a physical sector size of 4096 bytes, but is reported with a virtual size of 512 bytes by the OS, you should set the value to 8 to avoid unnecessary read attempts on the problematic sector.<\/p>\n

The \"Source Defect Replacement Template\" \u2014 specify a word or phrase that is easy to search for, which will fill in the sector in the copy for unreadable sectors from the source. This will make it easier to find damaged files later.<\/p>\n

When creating a copy, it is essential to closely monitor the process without interruption. If any strange sounds arise, the drive hangs, or a greater number of errors than was observed during the initial testing is detected, immediately stop the process and disconnect the drive to avoid irreversible consequences.<\/p>\n

Professional data recovery tools, such as DataExtractor, offer significantly more capabilities for customizing data copying scenarios, as well as monitoring the condition of the drive, which greatly increases the chances of successful retrieval when handled by a skilled specialist.<\/p>\n

\"Self-diagnosis
\nFig. 13 settings for reactions of a professional complex when reading problems occur<\/i><\/p>\n

<\/a><\/noindex><\/p>\n

Data Recovery<\/h2>\n

\n<\/a><\/noindex><\/p>\n

6. Recovery Methods<\/h4>\n

\nToday, there are many automatic data recovery programs that do not require any specialized knowledge from the user and provide data recovery with just a click of a mouse. However, this approach often will not yield the maximum possible results or will produce many irrelevant options.<\/p>\n

To work effectively with data recovery software, it is better to narrow the search area as much as possible. It is advisable to specify the scanning range and the type of filesystem being searched for. This clarification can eliminate numerous options from previous filesystems and reduce the likelihood of incorrect interpretation of the detected filesystem metadata.<\/p>\n

\"Self-diagnosis
\nFig. 14 Example of R-Studio settings for searching metadata of the desired filesystem<\/i><\/p>\n

Filesystem metadata consists of structures that describe the location of files, their names, attributes, access rights, logs, etc. <\/p>\n

\"Self-diagnosis
\nFig. 15 Example of metadata. Fragment of the MFT (Master File Table in NTFS)<\/i><\/p>\n

In many cases, data recovery software does not accurately determine the starting point based on the found metadata, and it does not always correctly filter data from different file systems. This can lead to incorrect calculations of the file locations, and various junk interpretations may increase the estimated volume of data, sometimes many times more than the capacity of the storage device itself.<\/p>\n

Professional suites include tools for creating virtual volumes of various file systems with manually set parameters, as well as tools for searching metadata with the ability to manually filter out unnecessary objects.<\/p>\n

In cases where the required filesystem metadata no longer exists or is incorrect, it is necessary to apply a method using regular expressions characteristic of particular file types.<\/p>\n

\"Self-diagnosis
\nFig. 16 0xFF 0xD8 0xFF is a regular expression characteristic of JPG files.<\/i><\/p>\n

Data recovery programs that use this method mostly have the following disadvantages: there is no folder structure and original file names, file structure analysis is not performed, and the integrity of the found file is insufficiently controlled. Hence, many junk data items are found that cannot be used, and for many file types, the size is not calculated correctly.<\/p>\n

\"Self-diagnosis
\nFig. 17 R-Studio settings for searching for the regular expressions of your required files.<\/i><\/p>\n

<\/a><\/noindex><\/p>\n

7. Typical Cases and Recommended Actions<\/h4>\n

\nFile System Corruption<\/b><\/p>\n

As a result of PC component failures, improper OS operation, sudden power loss during disk writing, or hard drive malfunctions, the filesystem metadata may become corrupted. In many types of corruption, the OS will not be able to mount the volume with the corrupted file system.<\/p>\n

\"Self-diagnosis
\nFig. 18 corrupted filesystem metadata (unrecognized RAW filesystem).<\/i><\/p>\n

In these cases, the method of searching for filesystem metadata within the boundaries of the existing partition is quite effective. With minor damages, it is possible to achieve results close to 100%. This recommendation is relevant for most different file systems.<\/p>\n

Of course, there are cases where a large volume of metadata in the current file system becomes corrupted due to failures. In such situations, if the first option does not work, it is necessary to use regular expression analysis to locate the files you need.<\/p>\n

The work of a specialist is distinguished by the fact that they assess the nature of the metadata damage, and if it is not destroyed but remains in a distorted form, manual corrections are possible in a hexadecimal editor.<\/p>\n

Deletion of a file or group of files.<\/b><\/p>\n

Accidental data deletion is a fairly common occurrence. The consequences of this action largely depend on the type of file system, as well as, in relatively new drives, on the firmware design of the device itself.<\/p>\n

If files were deleted from a partition with the NTFS file system, the optimal search method would be a quick analysis in various utilities, where key structures (MFT, Index, Logfile) are rapidly scanned without a full partition scan. If the required file records and the space occupied by these files have not been overwritten by other data, you can fairly quickly recover the files of interest.<\/p>\n

\"Self-diagnosis
\nFig. 19 after scanning $MFT the records identified as deleted are highlighted in purple.<\/i><\/p>\n

If the needed data is not found or is corrupted during a quick scan, a full partition scan can be performed, but it is likely that the result will not change significantly, and apart from searching with regular expressions, nothing else will be possible.<\/p>\n

The specialist has access to a tool to map the unallocated space and further analyze only these areas, which removes existing data from the recovery results. This significantly saves the user's time when searching for necessary files among a multitude of unnamed data.<\/p>\n

If files are deleted on a partition with the FAT16 or FAT32 file system, it is possible to use metadata analysis to recover some data with original names. In the case of SFN, the first character of the file name will be missing, but if the file had a long name, its full name will be in the LFN record. When fragmented files are deleted, data recovery using automated recovery programs will not be successful, as the record of the chain of clusters belonging to the file is removed from the FAT table upon deletion. Additionally, in FAT32, in some cases, apart from deleting the chain of the file's location in both copies of the table, the first character of the SFN and the upper two bytes in the number of the first cluster occupied by the file are removed from the directory. Most automated recovery utilities analyzing metadata will not identify the correct position of the file.<\/p>\n

Recovering fragmented files is generally quite a complex task that is not well automated. Automation methods can be developed for specific types of structures. Most often, the task boils down to low-performance manual analysis in search of the necessary fragments. An example of such work can be seen in the article \u201cRecovering the 1C:Enterprise Database (DBF) After Formatting\u201d<\/a><\/noindex> <\/p>\n

If the metadata analysis methods do not lead to finding the desired data, or the necessary files cannot be opened, there remains the method of searching using regular expressions. It may be possible to recover some files.<\/p>\n

If files are deleted on a partition with the HFS+, Ext2, Ext3, or Ext4 file systems, then, unfortunately, analyzing metadata is useless. There is nothing else left except for searching with regular expressions.<\/p>\n

Deleting a data partition<\/b><\/p>\n

If one or more partitions have been mistakenly deleted in the Disk Management console, it is recommended for the user wanting to recover data to run automated recovery utilities with a full scan of the entire device. It is also advisable to consider the positions of existing partitions to eliminate obviously incorrect options in the findings. <\/p>\n

\"Self-diagnosis
\nFig. 20 Deleted Partition<\/i><\/p>\n

Such work is done relatively quickly by specialists through the search for boot sectors and superblocks in expected locations. Based on the findings, the exact positions of section beginnings and their lengths are calculated.<\/p>\n

You can also try using DMDE or similar utilities, which can relatively quickly help identify signs of section beginnings and attempt to display the filesystem of the discovered partition.<\/p>\n

\"Self-diagnosis
\nFigure 21 shows the result of a quick partition search using DMDE.<\/i><\/p>\n

The partition containing data has been formatted.<\/b><\/p>\n

In such cases, the recommended course of action heavily depends on the type of filesystem that was present before the partition was formatted and what filesystem is being used after the formatting.<\/p>\n

For example, if a FAT32 partition with an 8KB cluster was formatted to FAT32 with a 64KB cluster, the size of the new FAT tables became eight times smaller, thus both copies of the new tables corrupted only the first copy of the old FAT tables. In this situation, searching for metadata can yield results close to 100%. However, if the partition was formatted to FAT32 with a cluster size smaller than or equal to the original size, the new clean tables will completely overwrite the old ones and partially affect the area with user data. In such a case, searching for metadata will yield significantly poorer results.<\/p>\n

If FAT32 was used on the partition before formatting, and the partition was formatted to NTFS, the new structures ($MFT, $Bitmap, $Logfile) are typically not located right at the beginning of the partition, and there is a high likelihood of retrieving most data with a normal directory structure and minimal damage to the data itself using the metadata search method.<\/p>\n

A high recovery rate will also occur when a partition with an NTFS filesystem is formatted to FAT32. In this case, the FAT tables will corrupt the data at the beginning of the partition and generally not affect key NTFS structures. Poor results will be observed with a small amount of data, the size of which is comparable to the sizes of two copies of the FAT tables.<\/p>\n

However, if the user does not wish to delve into the nuances of metadata placement across various file systems, a logical step would be to run the automatic data recovery utility in metadata search mode. If the amount of data recovered is insufficient, the method of regular expression search can be applied.<\/p>\n

The partition has been formatted and partially overwritten with other data.<\/b><\/p>\n

As often happens, a user may format a partition and begin filling it with other data, only to later realize that important information was on the old partition. In such cases, there can be no definitive recommendation. It all greatly depends on how much (both in quantity and volume) new data has been written, as well as where this data is located. Depending on the conditions, the results can range from 0 to nearly 100%. It is unpredictable in advance.<\/p>\n

In many cases with extensive overlap of data areas, it makes sense to start with a regular expression search method for the required file types to determine if there are still signs of the existence of the needed data, and if discovered, to perform a filesystem metadata search.<\/p>\n

In a data recovery laboratory setting, a specialist will map the unallocated space and conduct a regular expression search only in these areas to exclude the presence of already existing data from the search results. Additionally, by utilizing integrity control tools, the number of false positives will be significantly reduced. In some tasks, such as recovering jpg files (for instance, from a personal photo album), the specialist can sort according to the information contained in the Exif tags of jpeg files, resulting in a chronological order and sorting by camera models.<\/p>\n

\"Self-diagnosis
\nFig. 22 Result of sorting JPG files found via regular expression search<\/i><\/p>\n

Abrupt termination of resizing, moving, or merging operations.<\/b><\/p>\n

In cases of emergency termination of disk manager procedures for resizing partitions, moving, or merging multiple partitions, it is necessary to figure out exactly which steps were taken and at what stage the operation was stopped, in order to achieve the best possible outcome.<\/p>\n

Given the complexity and number of possible variations, let\u2019s consider only a universal option for a user looking for results with minimal actions. The target for analysis should be the entire drive to ensure that all data locations are covered. Use the metadata search method and copy all variants of data found in the discovered file systems. There is a high likelihood that different sets of files will be valid in each variant. Searching with regular expressions by specified file types is also important, as in such cases, partial loss of information about filenames and file locations is possible.<\/p>\n

<\/a><\/noindex><\/p>\n

8. Integrity Check of Recovered Data<\/h4>\n

\nIt is important to understand that the display of filenames in data recovery software or the number of found regular expressions does not guarantee that everything found will be usable. Therefore, a crucial step after recovering data with automated recovery software is checking the integrity of the data itself.<\/p>\n

Unfortunately, there is no universal free tool for checking the integrity of a large number of different files. However, free software can be found that can monitor specific types of files individually. For example, many archivers will allow checking the integrity of archives, the MP3Diag utility can verify the integrity of mp3 files, and ImageMagick can be used to test jpg files.<\/p>\n

The main drawback of many free file integrity checking utilities is that they do not guarantee a comprehensive check of files. Consequently, widespread errors may occur.<\/p>\n

For many types of files, users have no choice but to visually assess the integrity of the data by opening files sequentially in the corresponding applications.<\/p>\n

Professional solutions include a set of tools that allow for partial control over file integrity, which reduces the number of junk files in the data recovery results.<\/p>\n

In addition to filtering out junk, it's crucial to identify corrupted files. If you created a sector-by-sector copy filling unreadable sectors with a pattern, finding damaged files can easily be done by searching for the string \"BAD!BAD!BAD!BAD!\" in the files (in our example, we've used the filler \"BAD!\"). Once found, it is important to assess the extent of the damage, as some file formats may not be severely affected by the loss of a small piece of data, while others may be completely unusable.<\/p>\n

<\/a><\/noindex><\/p>\n

9. Common user mistakes.<\/h4>\n

\nVarious attempts to 'fix' defects using popular diagnostic tools in hopes of restoring data access are among the main mistakes made by many users. Attempts to conceal defects on a drive with damaged polymer surfaces typically result in grinding the platters rather than regaining data access. For this reason, without knowing the nature of the defects on the surface, it is strongly advised not to perform any service operations on the disk until the data is recovered. After the successful data recovery, one can attempt to service the drive, and if lucky, it may still be suitable for further use in less critical tasks.<\/p>\n

Often, defects affect the metadata of the file system. In such cases, the OS can freeze for a long time when attempting to mount the corrupted volume. With the problematic drive connected, the OS boot time can extend to several minutes. One of the worst ideas to solve this problem is to format the problematic partition. Newly created metadata may write correctly, and the issue of long OS boot times could be resolved, but the task of data recovery will become more complicated, and the quality of the recovery result may suffer significantly.<\/p>\n

Copying data found by the utility to the same partition from which you are trying to recover files. In this case, it usually ends up with the user receiving garbage instead of data, and the next attempt at data recovery will yield even worse results. If you follow the instructions in this article, you'll be protected from such errors.<\/p>\n

Integrity checks of the restored data are not performed, and the contents of the original drive are destroyed along with its copy. In this case, there is a risk of ending up with a bunch of folders filled with erroneous results from the data recovery attempt, with no way to achieve a quality outcome.<\/p>\n

Choosing the wrong tool and data recovery methods, resulting in outcomes that are significantly worse than they could have been. <\/p>\n

\nI hope this set of measures will help you decide whether your drive's situation allows for self-attempts at data recovery and whether you are ready to carry out this relatively simple set of actions outlined in this article.<\/p>\n

Previous publication: The ordeal or the long story of one data recovery attempt<\/a><\/noindex>
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043c\u0435\u0442\u043e\u0434\u044b \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u043a\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043d\u043e\u0441\u0442\u0435\u0439 \u0436\u0435\u0441\u0442\u043a\u0438\u0445 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e \u0441\u0438\u043c\u043f\u0442\u043e\u043c\u0430\u043c \u0438\u0445 \u043f\u0440\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0436\u0435\u0441\u0442\u043a\u0438\u0445 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438. \u0420\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u044b \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u0443\u0442\u0440\u0430\u0442\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043d\u0430\u0431\u043e\u0440 \u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u0435\u0437 \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u0445 \u0437\u043d\u0430\u043d\u0438\u0439 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u0430\u043c \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432\u0430\u0448\u0443 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0431\u0435\u0437 \u043f\u043e\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0439 \u043f\u043e\u043c\u043e\u0449\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53079","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Self-diagnosis of hard disks and data recovery | ProHoster","description":"This article describes methods for self-diagnosing various hard disk failures based on their symptoms, as well as relatively safe methods for cloning hard drives with minor issues.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/samostoyatelnaya-diagnostika-zhestkih-diskov-i-vosstanovlenie-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u043a\u0430 \u0436\u0435\u0441\u0442\u043a\u0438\u0445 \u0434\u0438\u0441\u043a\u043e\u0432 \u0438 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043c\u0435\u0442\u043e\u0434\u044b \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u043a\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043d\u043e\u0441\u0442\u0435\u0439 \u0436\u0435\u0441\u0442\u043a\u0438\u0445 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e \u0441\u0438\u043c\u043f\u0442\u043e\u043c\u0430\u043c \u0438\u0445 \u043f\u0440\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0436\u0435\u0441\u0442\u043a\u0438\u0445 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/samostoyatelnaya-diagnostika-zhestkih-diskov-i-vosstanovlenie-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-22T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53079","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 05:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:31:29","updated":"2026-01-24 05:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/53079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=53079"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/53079\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=53079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=53079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=53079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}