Question Backup data - Bad sectors

Oct 24, 2024
49
4
35
Hello all ,
I keep my writing concise.

I asked my question once before, but now from a different perspective. I hope to receive a suitable answer.

Six months ago, my 1 TB external hard disk had 52 pending sectors (#197 S.M.A.R.T). Since then, it has been set aside and unused. The critical S.M.A.R.T attributes are fine (I have inserted an image).

I ran GNU ddrescue to create an image of the drive. It made a sound like "Vizzzz" "Vizzz", which might be described as a buzzing noise. The speed was lower than usual. After 500 MB, I stopped the process and checked S.M.A.R.T again—current pending sectors increased to 58, while reallocated sectors remained at 0.

The total capacity of this HDD is 1 TB, with 800 GB occupied. I need to recover about one-tenth of the data from different partitions (the drive has four partitions, recognized as /dev/sdd).

I would like to copy several folders, even if the HDD fails afterward. If I can retrieve some files, I will discard the drive.

What solutions do I have?​

  1. Can I continue using ddrescue in this situation? Will the buzzing sound cause further damage?
  2. Is there a way to copy specific folders directly in Linux or Windows? (Six months ago, I was unable to access the HDD'd drives.)
  3. Is it logical to use software like HDAT2 or Victoria to attempt resolving pending sectors? The pending sectors have not been reallocated (remapped).
  4. Western Digital has its own software, Data Lifeguard Diagnostics, which offers automated diagnostics and repair (possibly by writing zero/random data to affected sectors). Can I use it?
Before starting ddrescue
1.jpg

--------
----------------
-----
S.M.A.R.T attribute after a few minutes :

4.jpg

Thanks and regards
 
Any continued attempts to use this drive in any way will be risking complete failure. There's just no way around that, nor any sure way to estimate the severity of the risk. It could work with ddrescue if you keep trying, or it could just start shredding the disk surface. The sound you're hearing is the drive's actuator moving back and forth trying over and over to read the same failing sectors (it makes the same sound during normal operations but it varies enough because it's not going to the same location over and over that you don't notice it).

"Pending sectors" indicate that the drive thinks they're questionable, but they haven't yet reached the point that it needs to reallocate them. It's having to read them repeatedly, but eventually succeeds. The fact that they have increased that much after having tried to read only 500MB indicates there is at least some area of the drive that is severely damaged. Continuing to run ddrescue could let it eventually get past that bad area, OR that area could fail catastrophically and ruin the read/write heads as well as other areas of the platters (bits of the magnetic material coming loose and acting like sandpaper).

Notice also that the Seek_Error_Rate is 4618. That's pretty bad.

Your next step depends on how important the data is. If you REALLY need it, you should stop completely and disconnect the drive immediately, and send it to a data recovery service. They will attempt to read the drive and recover your data, and usually charge you only if they succeed. They might be able to "exclude" the bad areas so that it doesn't risk causing more damage, or even just read the platters that are good and not the bad one.

If it's not really that important, then you can just let ddrescue keep trying and hope that it manages to get past the bad area eventually. It seems like this may be the best option, as those questionable sectors ARE eventually being read successfully instead of being remapped, it just takes many attempts.

You can run Victoria in re-map mode, or one of the other repair tools, which will force the drive to read those pending sectors over and over until they finally are marked as bad by the firmware, crossing the threshold of quality, and re-mapped. This risks causing so much physical stress that the catastrophic failure is more like, I think.

As far as trying to read the folders/files in the OS, you could try using a tool like Recuva or similar things which will read the raw drive (where the filesystem allocation table or partition table isn't readable) and reconstruct the filesystem or just scan for things that look like files and rebuild them. I don't know if this will be any more or less successful than ddrescue, or if they're basically doing the same thing and ddrescue just happens to be open-source.
 
  • Like
Reactions: Grobe and xilin_0
Any continued attempts to use this drive in any way will be risking complete failure. There's just no way around that, nor any sure way to estimate the severity of the risk. It could work with ddrescue if you keep trying, or it could just start shredding the disk surface. The sound you're hearing is the drive's actuator moving back and forth trying over and over to read the same failing sectors (it makes the same sound during normal operations but it varies enough because it's not going to the same location over and over that you don't notice it).

"Pending sectors" indicate that the drive thinks they're questionable, but they haven't yet reached the point that it needs to reallocate them. It's having to read them repeatedly, but eventually succeeds. The fact that they have increased that much after having tried to read only 500MB indicates there is at least some area of the drive that is severely damaged. Continuing to run ddrescue could let it eventually get past that bad area, OR that area could fail catastrophically and ruin the read/write heads as well as other areas of the platters (bits of the magnetic material coming loose and acting like sandpaper).

Notice also that the Seek_Error_Rate is 4618. That's pretty bad.

Your next step depends on how important the data is. If you REALLY need it, you should stop completely and disconnect the drive immediately, and send it to a data recovery service. They will attempt to read the drive and recover your data, and usually charge you only if they succeed. They might be able to "exclude" the bad areas so that it doesn't risk causing more damage, or even just read the platters that are good and not the bad one.

If it's not really that important, then you can just let ddrescue keep trying and hope that it manages to get past the bad area eventually. It seems like this may be the best option, as those questionable sectors ARE eventually being read successfully instead of being remapped, it just takes many attempts.

You can run Victoria in re-map mode, or one of the other repair tools, which will force the drive to read those pending sectors over and over until they finally are marked as bad by the firmware, crossing the threshold of quality, and re-mapped. This risks causing so much physical stress that the catastrophic failure is more like, I think.

As far as trying to read the folders/files in the OS, you could try using a tool like Recuva or similar things which will read the raw drive (where the filesystem allocation table or partition table isn't readable) and reconstruct the filesystem or just scan for things that look like files and rebuild them. I don't know if this will be any more or less successful than ddrescue, or if they're basically doing the same thing and ddrescue just happens to be open-source.
Hello, and I appreciate your response. I am very grateful for your thorough reply.

Since you commented here last night, I have read over 100 posts, threads, and articles related to this topic. I am not exaggerating.

I kindly ask you to take a few minutes to review my understanding so that I can reach an appropriate conclusion. This problem has severely impacted my life for more than six months.

Allow me to restate my current understanding once more, and at the end, I will ask several questions for clarification. I do not like to play with words. Throughout my research, I have encountered terms such as "damaged," "defective," "RAW," "corrupted," and similar. My concerns are genuine, not childish excuses or pointless insistence. I am sincerely seeking the best answer and solution.

If I understand correctly that my HDD has a mechanical issue, I will immediately set it aside.
What I understand from Pending_Secotrs is :
Pending sectors are those sectors that have reading problem. If can write on sector it clears an error.If not succeed (even physical damage) it reallocates to spare sectors, therefore reallocate_sector_count attribute would be increased.
1-This attribute is 0 for me.Why? I think I am not trying to write on those problematic sectors .In addition I tried to read them with GNU ddrescue (and because of reading, pending_sector has been increased but unable to reallocate them due to nothing has been written to those sectors , so should I try to write on sector ? If yes ?
Which option you prefer?
  1. Find sectors with long test(or software or Linux tool) and try to write zero/null by dd command?
  2. -Victoria, but in Windows
  3. Western data lifeguard (filling zero on pending sector )
Last night after your comment, I visted several top-notch data recovery software such as R-Studio , DMDE , Disk Drill , easeUS , Stellar Data ,they claim to retrieve data back from bad sector and even corrupted/RAW and damaged disk
------Does imaging with ddrescue have any advantages over one of these tools?
There are two types of bad sector :
1- Logical or soft bad sector
2- Physical or Hard bad sector
---- In my case, which is mine? soft or hard one?
---- From your perspective, using ddrescue gently that skips those bad areas could be an effective approach?(smaller cluster, at least 3 -4 MB/s read speed, not trying on first run , stay maximum 1 s on bad area and useful option if needed)

Fortunately, none of them I heard while I was using ddrescue
------The sound I heard (Vizzzz Vizzzz): How can I be sure it's a mechanical issue(head touches platter) or not?
This is the sound I was hearing : (second 28 to 34 - if you hear Vizz Vizzz(just vizz vizzz sound and not other sound mixed with Vizz Vizzz) :



I am more than grateful for the time you've taken to engage with my post 🙏 🍀
 
One additional point :
I don't remember where I took this screenshot:
This is one of the many ddrescue's outputs and a damaged disk, If it were healthy, it didn't take 3 weeks, similar healthy 4 TB took just 14 H.
47500 Bad sectors.I'm not sure did OP of this comment heard any unusual sound like me or not .
photo-2025-05-18-00-07-47.jpg
 
Focus on whatever folders or individual files have your personal data.
Try those first.
Thank you.
Could you please elaborate a bit? Try those first. Since ddrescue works at the block level, I couldn't try your suggestion with ddrescue. Did you mean data recovery software? If yes, which one would you recommend?
 
Thank you.
Could you please elaborate a bit? Try those first. Since ddrescue works at the block level, I couldn't try your suggestion with ddrescue. Did you mean data recovery software? If yes, which one would you recommend?
No.

No 'data recovery', no ddrescue.

Those would be attempting to work with the entire drive. And when it encounters bad sectors, it errors out.

Just try to copy the files/folders in question, off to some other drive.


If THIS fails, then you move to something else, like HDDSuperRescue.

But currently, the ONLY thing you should be worried about is the data on the drive.
 
Others have already commented appropriately, but I'm going to provide some observations (which might or might not be useful to you).

You have a standard old tech platter hard drive (this is what "sdd" implies, although it might be something else; comment if this is incorrect), and so "dd" is appropriate. I don't know if your "ddrescue" differs in options compared to a raw "dd", so keep that in mind as I talk about "dd".

"dd" has the ability to convert missing bytes to NULL. This is useful when a block has unreadable bytes. Most old hard drives use a block size of 512, but even if the size were larger, then "dd" could use a smaller block size. You could even use a block size of 1 byte, although this would be so extraordinarily slow that it could take weeks to copy a drive. 512 bytes is an appropriate size on a standard hard drive (old tech) recovery.

If you do copy something with "dd", then from that point on you could use a loopback mounted image to work with using your recovery tools. The tools don't know the difference between working with a loopback device and an actual block device (that's the purpose of loopback: Make another memory device appear as a disk/block device). There is an advantage of reading your actual drive once and making an image which can be loopback mounted. You can work on that image as much as you want without fear of the disk failing further.

This isn't perfect of course because if just one byte in the 512 bytes is bad, then all of those 512 bytes are gone with this method. However, what you're examining is a filesystem, and not raw binary bits. The filesystem itself will have a block size, and this will never be less than 512 bytes. Odds are high that losing the 512 byte span will leave NULL bytes only in that one file. In some cases filesystems will have some sort of efficiency algorithm which could affect two sparse files by losing 512 bytes, but this would be rare.

Lower level recovery hardware and software might look at the actual signal the heads are putting out to try and recover questionable content quality, and the "dd" loopback image version will not have any ability to work with this. One would have to risk further damage to the actual drive to run those tools. Personally I would only run that after I've made a "dd" copy.

Also, if you had a matching model of that hard drive which is good, then the "dd" image could be directly imaged onto the replacement drive. Missing data would still be missing, but anything which works with that drive and which does not encounter NULL byte replacements would "just work".

I'm assuming you are running Linux of course, and have a lot of extra space available. If that disk is 10 TB, then a full image will take up 10 TB on your system which is performing the recovery. Using "sdd" as the drive, then the following would image a complete drive using 512 byte blocks and converting errors to NULL filler bytes, along with a bit of output to tell you about the progress and encounters with errors:
Code:
dd if=/dev/sdd of=/dev/sdd bs=512 conv=sync,noerror status=progress

This is the same thing, but creates a log for you to examine later:
Code:
dd if=/dev/sdd of=dd_image.img bs=512 conv=sync,noerror status=progress --log-file=image.txt

After this one could the the image with a loopback device like this::
Code:
sudo losetup --find --show ./dd_image.img

Whatever that device is showing up for covering this can use tools like "sudo gisk -l /dev/loop0" (I'm assuming loop0, but adjust for your case). This is the entire disk. One could further use "dd" to copy an individual partition of the loopback device. I think "lsblk -f -T" would show the loopback device once it exists, not sure.

Or you could create an image of just a single partition, and loopback mount that directly. If your disk only has the "/dev/sdd1" partition, then you could copy the partition itself like this:
Code:
dd if=/dev/sdd1 of=dd_sdd1_image.img bs=512 conv=sync,noerror status=progress --log-file=image_sdd1.txt

One can use "mount" to directly mount this and add the loopback device in a single step since it is a partition:
Code:
sudo mount -o loop ./dd_sdd1_image.img /mnt
(mount location "/mnt" is arbitrary)

You might want to look up the man page for "losetup" since there are a limited number of loop devices, and if you just keep creating them, then they do not automatically release.

"dd" has no understanding of the underlying filesystem. It doesn't care, and it doesn't need to (missing bytes won't stop "dd" if you tell it to keep going). However, once you have that image covered by loopback you can run operations such as disk repair. It is the filesystem and the content of files and directories which do care about missing or corrupt bytes. If files have bytes wiped out, then you won't be prompted for filesystem repair; if something related to the filesystem is damaged, then you will be prompted for repair. Once repaired (if required) individual files and directories can be accessed (perhaps much of what you want survived without NULL byte replacement; even if NULL bytes are padded into a failed block you could perhaps recover parts of those files). Example:
Code:
sudo fsck.ext4 /dev/loop0

Overall I would try to read the failing disk only once to create an image. Do whatever is possible with the loopback mounted image. If more is required, then tools which work with low level signals could be used if failure isn't complete. For that you'd like need a disk recovery service since it can involve hardware designed to work with the signal on the drive head.
 
Manually formatting some of this due to the quoting sections having been done poorly. You should not type inside the "quote box" when you're adding your own lines. You can quote individual sections of someone else's comment by highlighting it and clicking Reply from the menu that appears, so that it gets added to your new comment and then you write below it, OUTSIDE the box.

1-This attribute is 0 for me.Why? I think I am not trying to write on those problematic sectors .In addition I tried to read them with GNU ddrescue (and because of reading, pending_sector has been increased but unable to reallocate them due to nothing has been written to those sectors , so should I try to write on sector ? If yes ?
Which option you prefer?

  1. Find sectors with long test(or software or Linux tool) and try to write zero/null by dd command?
  2. -Victoria, but in Windows
  3. Western data lifeguard (filling zero on pending sector )
The reallocated sectors value will only increase when a sector completely FAILS. Until it becomes "bad" (meaning the quality of the magnetic signal of the bits drops below the threshold programmed into the firmware) it will only be PENDING, where the firmware can detect that the quality is not perfect, but it's still working. Different drives have different thesholds. Your drive may still consider the sector good enough to be PENDING if it just has to be read twice, or maybe three times, but if it needs 4 reads then it's "bad" and gets reallocated. But that means it takes 2 or 3 times as long to read those sectors compared to a perfect drive with no defects. Note that software can't control how often the drive attempts to read a pending sector with a single request; the software can ask just once, but the drive determines how many attempts to make and the software doesn't know how many attempts it took, and the software can't tell the drive to make fewer attempts.

ddrescue and any other tools have to read every sector in order to locate legitimate data. Pending sectors are still considered valid sectors, so they have to be read. If the sector is marked bad and remapped, then NO consumer software will ever look at that physical sector ever again. The only way to make that happen is for the software to attempt writing to that sector over and over until the quality gets so bad that the drive firmware remaps it.

I don't know much about dd but there are ways to force it to rewrite specific blocks many times until they fail and get remapped. I presume you'd need to do it against every pending sector, which means needing to find out every sector. That may not really be effective either, since the number of sectors on your drive with problems keeps increasing. The data in those sectors is erased.

ddrescue is not concerned with trying to "fix" the drive and force sector remaps. It's only concerned with trying to copy the data from it. The "pending" sectors are currently readable, it just takes multiple attempts. That will make it take longer than normal to read and copy the data, but it should succeed eventually unless there is catastrophic failure. How long it ultimately takes depends on how many sectors are having problems and how many retries are required to read them or force them to fail and be remapped.

A tool like Victoria in Windows is just an easier way to force the pending sectors to fail on the entire drive. It will automatically hammer the pending sectors by making repeated requests until they fail (when you use re-map mode), without affecting good sectors. (The software also doesn't know that a specific sector is "pending". It only knows that it took longer than normal to read the data, so it assumes that sector is starting to fail.) The data in the pending sectors SHOULD get moved to the remapped sectors instead of being lost, unless the sector fails catastrophically and can't be read. The rest of your data will be unaffected. But just like using dd, all this is doing is trying to force the sectors to be remapped in an attempt to make the drive "good" again. The process could cause the drive to fail catastrophically and lose ALL your data.

WD Data LifeGuard fills the ENTIRE drive with zeros, so all your data would be lost, and it doesn't repeatedly write to the pending sectors to try to force them to be remapped. You'd have to run it over and over to do that. So this option would not be good.

Last night after your comment, I visted several top-notch data recovery software such as R-Studio , DMDE , Disk Drill , easeUS , Stellar Data ,they claim to retrieve data back from bad sector and even corrupted/RAW and damaged disk
------Does imaging with ddrescue have any advantages over one of these tools?

ddrescue (and dd itself) is open-source and has a LOT of options and capabilities, so if you know what you're doing you can do a lot more than commercial tools, and of course it's free. Some of those other tools are also free while others may only show you what they CAN recover but won't do it until you pay them. ddrescue is also MUCH more complex to use since it's only by command line.

NO consumer software can recover data from a sector that has been re-mapped by the drive firmware. Those sectors simply don't exist anymore as far as the drive is concerned. Most rescue tools are concerned with recovering data that has been accidentally deleted, or where the partition table or file allocation table (or equivalent) has been damaged or lost, or the drive has been repartitioned or reformatted. That's what a RAW or corrupted drive is. In those cases, there is no physical fault with the drive, and the software just reads the disk sector by sector and attempts to find data structures that indicate where the partitions and files were located, and copies the data to another location. They can also scan a drive that does have physical problems, such as pending sectors, which may have caused the corruption, but they still depend on the drive itself being able to read the physical sectors. That's all ddrescue is doing. If the drive is unable to read a sector after multiple attempts, the data is lost and the sector is remapped.

Your drive may not have any reallocated sectors yet, but it does have pending sectors that are increasing, and it seems that it has had data corruption occur since you can't read the partitions. Any of those tools can likely recover a lot of the data, but during the process more sectors will become pending, and possibly some will be remapped. But the pending sectors ARE still readable.

Unfortunately the more you try to recover data, the more you're going to risk causing more problems and total failure. That's just the nature of this type of failure. If the data is important enough, you need to physically send the drive to a data recovery specialist. (A company that does this professionally. Not just some general computer repair company that says they'll recover data.)

There are two types of bad sector :
1- Logical or soft bad sector
2- Physical or Hard bad sector
The logical bad sector is where the operating system made a decision that a sector is bad because it didn't respond properly. For example if the sector has to be read 3 times and it takes 3 seconds to do that, the operating system may be coded to only wait 2 seconds. If it takes longer than 2 seconds, the OS decides the sector is "bad" and marks it as such in a special location in the filesystem. Or it may return an error instead of valid data and be marked bad that way. Or it may do a read/write/read test and if the data gets corrupted the sector is marked bad. In Windows, after you run chkdsk there is a line that shows the number of bad sectors. That refers to logical bad sectors that the OS has detected during normal operation or during a chkdsk scan specifically for bad sectors. Logical bad sectors are NOT remapped. You just lose the amount of capacity of however many bad sectors there are. If you ever format the drive, the data about those logical bad sectors is erased, so they will then get used again. Logical bad sectors CAN be perfectly good physically, as there are other reasons for the drive to take longer to respond at times.

Physical bad sectors is obviously when there is a physical fault with the magnetic surface. Magnetic media can wear out if it was poor quality from the factory, or become detached from the platter surface, or be damaged by impact. A physical bad sector is detected by the read/write heads of the drive because it can sense the strength of the magnetic field. When it goes below a certain threshold, the drive's firmware records that the sector is bad and remaps it. This is a permanent reallocation and the physical sector will never be readable by software again.

Is there a way to copy specific folders directly in Linux or Windows? (Six months ago, I was unable to access the HDD'd drives.)
I have taken this to mean that when you plugged it in, the operating system could not see the partitions or the files. If you can provide more information on what was done it might be possible to make it accessible again. If you can do that, then you can just copy the files you need before destroying or recycling the drive. Getting access to the files themselves that way would be the fastest and safest way to get what you need, because there would be no need to scan the whole disk and cause more stress on it.

ddrescue will only read and copy the data of the entire drive to another location, so that you can then dig through the contents. Some other tools like TestDisk and PhotoRec, as well as some of the ones you mentioned, can try to just identify the files and create a list of what it discovered, instead of taking the time to copy the entire drive, and then allow you to select which ones you want to retrieve.

I think those tools are all equally stressful to the drive, but ddrescue or another tool that just tries to image the entire disk MAY be the safest. It will just read the entire drive and create an image of it, and then you can work with the image instead of the drive. ddrescue is supposed to try to read only "good" sectors first, but in your drive's case there aren't any "bad" ones yet, none that are actually returning errors, so it might just take a bit longer as I said, while the drive itself retries the questionable sectors until the data reads successfully. Once it gets past the bad areas, it will go much faster.

If you use a tool like TestDisk or PhotoRec that generates a list of recoverable files, it will have to read the entire drive once to build the list, then read it again to recover the files you select. Depending on where the bad areas are, this COULD result in more stress and more failures and loss of data. I think they can also be set to simply recover all the files they find though, similar to ddrescue, but they just copy the files instead of creating a solid image of the entire drive. You then have to depend on whatever directory structure they decide is accurate and have to hope it's useful. With the ddrescue image file, you can mount the image file itself and treat it like a hard drive to perform any other data recovery you want, including running TestDisk, PhotoRec or others, without risking further damage.
 
You have a standard old tech platter hard drive (this is what "sdd" implies, although it might be something else
"sd" refers to any SATA drive or SAS/SCSI, whether mechanical or SSD, as well as USB drives. "hd" was the prefix for IDE/PATA mechanical drives, and for those very few PATA SSDs that were hacked together. But given the SMART values including things like "spin" one can conclude it's mechanical.

It's kind of surprising that the community accepts the use of the name "ddrescue" when it is not connected at all to "dd", seemingly to deliberately make people confuse the two. But ddrescue has capabilities designed specifically for recovering data from possibly failing drives.
 
"sd" refers to any SATA drive or SAS/SCSI, whether mechanical or SSD, as well as USB drives. "hd" was the prefix for IDE/PATA mechanical drives, and for those very few PATA SSDs that were hacked together. But given the SMART values including things like "spin" one can conclude it's mechanical.

It's kind of surprising that the community accepts the use of the name "ddrescue" when it is not connected at all to "dd", seemingly to deliberately make people confuse the two. But ddrescue has capabilities designed specifically for recovering data from possibly failing drives.
I use the actual "dd" when recovering data. Never used "ddrescue". There are other tools, but mostly what I do is create an image from "dd", and the use the other tools on the loopback mounted image.