Unsupported

Out of the blue...

One of my hard drives is causing problems/failing. Western Digital WD5000AAKS. It contains about 450GB of mostly irreplaceable data which I would really like to retrieve.

On an otherwise normal reboot of my workstation, Windows boot was extremely slow and hitching/freezing in places.

At first I chalked it up to the delays that sometimes occur on boot after installing Windows Updates, but when the problem persisted -- and I considered the fact that it had been _two_ boots ago that the updates had been installed, so associated housekeeping duties were assumably done -- I realized this was a real issue. Quickly calculating in the fact that my brother had an identical WD5000AAKS drive fail on him about a month ago -- and that this hitching/freezing operation was what it was doing to him before it crapped out completely -- my concern level quickly jumped to "I would panic if I thought it would do any good!"

Accessing the problem drive (E:) in Windows Explorer "locked" up the machine, although I learned later that if I was patient enough with it, it would recover from complete lock-up.

Some files can be read. There was a glimmer of hope when I first realized "Hey that's my desktop wallpaper!" (which is stored on the problem drive). However, when I attempt any bulk copy operation using Windows Explorer, it is only a matter of time before it fails (upon reaching some unreadable file). The files that are successfully read, though, appear to be uncorrupted. The data is an audio/visual media library which contains hundreds of thousands of files in thousands of folders, so obviously taking a piecemeal, manual approach to copying files/folders is almost out of the question. (But if it comes down to it, I will!)

I am not experiencing any of the common indications of a mechanical hardware problem. e.g. strange sounds, clicking, drive doesn't spin up, etc. (FYI: Bro's drive still spins up, doesn't make bad sounds, but isn't recognized at all in Windows.)

At this point, what I have tried:

• Hooking the drive up using a different power supply, data cable, controller channel. The alternate controller channel seemed slightly promising; access to the problem drive seemed slightly faster, but ultimately, still has read errors and freezes. (As an aside: I used the power cable/data cable/controller channel in question to copy the entire contents of yet another WD5000AAKS (one that hasn't failed... yet!) to a backup drive, and everything seemed to complete properly, so is it safe to assume controller and cables are functioning properly?)
  
  
• Running Windows CHKDSK in read-only mode. It took 15-20 minutes to run. Got to the point where it said it was verifying file indexes. It did post a couple lines of the "Correcting error in index [foo] for file [bar]." nature. Ultimately it quit and said it can't correct the problems in read-only mode.
  
  
• Running Western Digital Data Lifeguard Diagnostics. In the physical drives window, the drive in question shows up as having an 8GB capacity (scary!), SMART data is not available. In the logical drives window, however the logical drive info appears to be correct. (i.e. 500GB total space, ~48GB free). When viewing the properties of the drive (it takes a while to load this screen!), the "Health" status is "Warning". (scary!!)

So, The $1,000,000 Question* [*sorry, not real dollars :)]:

What is the best way to immediately get as much data as possible off the drive?

Options up for consideration:

• Windows Explorer - considered and attempted with unsatisfactory results; my last resort
  
  
• XCOPY (or alternative) - will this give me the ability to bulk copy the entire drive, skipping unreadable files, so I can do a "best attempt" unattended overnight or something like that?
  
  Also, I am looking at the following XCOPY command: "XCOPY e:\*.* o: /E /C /F /H /K /Y" where o: is the destination. Will this do the trick? Any suggestions? I don't think I need /O but should I use it just to be safe? Should I not use it just to be safe?! Should I use /V? Will it help/matter? Should I not use it because it will slow the process down? Also, how do I redirect the output of the XCOPY command to a file so I can review the log later? I will need to know the files which failed so I can attempt to reconstruct my library from other backups I made before this catastrophe.
  
  I say "XCOPY or alternative" above because I am aware that there are some third party replacements for this program that have some bonus features which might be helpful, so if you have any recommendations there, please share.
  
  
• Read under Linux using Knoppix Live CD or similar - I am slightly familiar with linux, but have yet to really use it for anything other than "fiddling". If I view this drive under Knoppix, etc., can I expect to have complete access to anything readable on the drive? Will a live CD provide the network support I'll need to back the files up over a network to a Win2k share?
  
  
• Recovery software: FinalData, Spinrite, etc. - If I understand correctly, this type of software performs basically the lowest-level copy possible, to retrieve exactly what is on the drive, good or bad. What type of output file will I then have to work with? A mountable image? Or do I have to have a blank drive prepared to copy it to?
  
  I have heard, but I don't know if it is still true, that Spinrite can only write the recovered data to the same disk, and naturally that sounds like a bad idea in this case. I need a program that will "export" everything it can from a bad drive to a good one. I am looking for any recommendations, if the recovery software approach is deemed constructive.
  
  
• Imaging software: Acronis, Norton, etc. - What will these programs do when they encounter bad data/sectors? Is it sensible/safe to image the drive in its existing (screwed) state, in the hopes of having a second shot at recovery if initial efforts wind up failing or damaging the data/drive further? Will these programs copy the drive data verbatim, to the best of their ability, regardless of issues I am having in higher-level copy operations (i.e. not fail like Windows Explorer?)
  
  
• Professional Recovery Services - I am aware of this option, but, due to the cost involved, I am going to explore the other alternatives, first. However, if you have had an extremely positive, first-hand experience with any professional recovery company and would like to recommend them, feel free.
  
  
• Any other options I am unaware of?

In all cases, I would like to be assured of which options have the least risk of endangering the data further.

I am not opposed to eventually running chkdsk /r, but I want some kind of backup in place in case this screws things further. (If a genie appeared and said "You can perform one fix operation on this drive, and then it is going to go poof!", I don't think I would choose "chkdsk /r" to be that one operation!)

A slight amendment: while doing research for this post, I came across some anecdotal information which strengthens my belief that this is an actual hardware problem (though not necessarily mechanical) with the drive. So, I am leaning more towards the options that will require the least amount of time, to lessen the chance of complete hardware failure before I get my data back.

I have listed the options I am aware of based on my experience and my first round of research on this subject (Googling, Q&A sessions with knowledgeable individuals, etc.) If there are any good alternatives that I have completely overlooked, please share!

All things considered, I am leaning toward a simple XCOPY-type operation as being my best choice for getting my data out of this dangerous limbo ASAP, with minimal further expenditure of time and money.

Please advise! Thank you!

wiseleo

Lots of writing... same answer. My method would be the safest way and you have ample hardware. If you don't try to take shortcuts, you should be fine. If the imaging completes without too many errors, the new drive should be capable of simply booting Windows like nothing ever happened.

Don't try anything else if you value your data. Especially, no spinrite-type tools. Seriously. I share your concern about CHKDSK ;)

Well, the safest way would be to image the drive at the fastest speed possible. This method is about 20MB/sec on my system. However, the faster way requires some pretty expensive equipment.

Unsupported

Thanks for the response. I am reading through the process...

Also, FYI, not that it should make much difference, but the problem drive here is only a data store; my boot drive is fine; system seems otherwise fine.

One question already.. I bought a new 1TB drive, partitioned it in "halves", hoping to use one half to recover the data from this bad drive, and the other half to back up data from my other WD 500GB drive mentioned in my post.

With the imaging process you describe, will I be able to image the dying drive to a partition of my new 1TB drive, or should I go get a 500GB drive?

If I need a new physical drive, will it matter if it is not an identical drive to the original? My confidence in WD is low at this point, and if I do need to buy another 500-gigger, I would probably prefer a Seagate option. Will that work?

Thanks for the info, and thanks for your help!

wiseleo

Repartition the drive to have one large NTFS partition. We are imaging to a file, not directly to the drive. Your safest bet would be to use the 1TB as your backup drive and get another 500GB as your second data drive.

The drives do not need to be identical and Seagate will work fine. If you already have an internal drive that will be replacing the failed unit, then no more new drives are necessary. 500GB image will fit on the 1TB drive just fine. :)

You can then send your original drive for warranty replacement.

Unsupported

Hi Leo,

I am in the middle of a trial of this process. I have imaged my still-working 500GB drive to the 1TB drive using the "ddrescue -n" command. There were no errors here so this seems to be the complete, pristine image.

The next thing I want to be able to do is mount/access that image file in Windows. I see you say you use VDK for this, and I am just wondering how that process works. I tried simply mounting the .dd file with VDK using "vdk open * g:\dimage.dd /L:F". (VDK output included at end of post.) I could read folder and file names but windows would give various errors when I tried to open actual files -- "delayed write failed", "cannot read from source file or disk", etc.

Initially I had the .dd file marked as read-only in windows, but these errors persisted even after marking it write-able.

So, is there some special command/format option I have to use with ddrescue or VDK? (Now that I take a closer look at VDK output, I see the image is mounted as read-only. Perhaps it needs to be mounted as write-able?)

Also, once I get through these image reading issues, and have proven that I can successfully retrieve files from the .dd image, I am going to attempt the whole process with one of my problem disks. When the time comes to do so, is there any way to script the execution of the "ddrescue -n" command followed by the "ddrescue -r" command? If so, I could let the whole process run overnight and not worry about putting extra running hours on the problem drive. (Otherwise I have to babysit the process until "-n" completes, which is probably going to be about 3-4 hours, based on today's trial, then run "-r" manually...)

Thanks a bunch for your help! Any more info you (or anyone else) can provide would be great!

VDK Output:
-===================-