Question Backup data - bad sectors ?

Oct 24, 2024
62
4
35
Hello all ,
I keep my writing concise.

I asked my question once before, but now from a different perspective. I hope to receive a suitable answer.

Six months ago, my 1 TB external hard disk had 52 pending sectors (#197 S.M.A.R.T). Since then, it has been set aside and unused. The critical S.M.A.R.T attributes are fine (I have inserted an image).

I ran GNU ddrescue to create an image of the drive. It made a sound like "Vizzzz" "Vizzz", which might be described as a buzzing noise. The speed was lower than usual. After 500 MB, I stopped the process and checked S.M.A.R.T again—current pending sectors increased to 58, while reallocated sectors remained at 0.

The total capacity of this HDD is 1 TB, with 800 GB occupied. I need to recover about one-tenth of the data from different partitions (the drive has four partitions, recognized as /dev/sdd).

I would like to copy several folders, even if the HDD fails afterward. If I can retrieve some files, I will discard the drive.

What solutions do I have?​

  1. Can I continue using ddrescue in this situation? Will the buzzing sound cause further damage?
  2. Is there a way to copy specific folders directly in Linux or Windows? (Six months ago, I was unable to access the HDD'd drives.)
  3. Is it logical to use software like HDAT2 or Victoria to attempt resolving pending sectors? The pending sectors have not been reallocated (remapped).
  4. Western Digital has its own software, Data Lifeguard Diagnostics, which offers automated diagnostics and repair (possibly by writing zero/random data to affected sectors). Can I use it?
Before starting ddrescue
1.jpg

--------
----------------
-----
S.M.A.R.T attribute after a few minutes :

4.jpg

Thanks and regards
 
Any continued attempts to use this drive in any way will be risking complete failure. There's just no way around that, nor any sure way to estimate the severity of the risk. It could work with ddrescue if you keep trying, or it could just start shredding the disk surface. The sound you're hearing is the drive's actuator moving back and forth trying over and over to read the same failing sectors (it makes the same sound during normal operations but it varies enough because it's not going to the same location over and over that you don't notice it).

"Pending sectors" indicate that the drive thinks they're questionable, but they haven't yet reached the point that it needs to reallocate them. It's having to read them repeatedly, but eventually succeeds. The fact that they have increased that much after having tried to read only 500MB indicates there is at least some area of the drive that is severely damaged. Continuing to run ddrescue could let it eventually get past that bad area, OR that area could fail catastrophically and ruin the read/write heads as well as other areas of the platters (bits of the magnetic material coming loose and acting like sandpaper).

Notice also that the Seek_Error_Rate is 4618. That's pretty bad.

Your next step depends on how important the data is. If you REALLY need it, you should stop completely and disconnect the drive immediately, and send it to a data recovery service. They will attempt to read the drive and recover your data, and usually charge you only if they succeed. They might be able to "exclude" the bad areas so that it doesn't risk causing more damage, or even just read the platters that are good and not the bad one.

If it's not really that important, then you can just let ddrescue keep trying and hope that it manages to get past the bad area eventually. It seems like this may be the best option, as those questionable sectors ARE eventually being read successfully instead of being remapped, it just takes many attempts.

You can run Victoria in re-map mode, or one of the other repair tools, which will force the drive to read those pending sectors over and over until they finally are marked as bad by the firmware, crossing the threshold of quality, and re-mapped. This risks causing so much physical stress that the catastrophic failure is more like, I think.

As far as trying to read the folders/files in the OS, you could try using a tool like Recuva or similar things which will read the raw drive (where the filesystem allocation table or partition table isn't readable) and reconstruct the filesystem or just scan for things that look like files and rebuild them. I don't know if this will be any more or less successful than ddrescue, or if they're basically doing the same thing and ddrescue just happens to be open-source.
 
  • Like
Reactions: Grobe and xilin_0
Any continued attempts to use this drive in any way will be risking complete failure. There's just no way around that, nor any sure way to estimate the severity of the risk. It could work with ddrescue if you keep trying, or it could just start shredding the disk surface. The sound you're hearing is the drive's actuator moving back and forth trying over and over to read the same failing sectors (it makes the same sound during normal operations but it varies enough because it's not going to the same location over and over that you don't notice it).

"Pending sectors" indicate that the drive thinks they're questionable, but they haven't yet reached the point that it needs to reallocate them. It's having to read them repeatedly, but eventually succeeds. The fact that they have increased that much after having tried to read only 500MB indicates there is at least some area of the drive that is severely damaged. Continuing to run ddrescue could let it eventually get past that bad area, OR that area could fail catastrophically and ruin the read/write heads as well as other areas of the platters (bits of the magnetic material coming loose and acting like sandpaper).

Notice also that the Seek_Error_Rate is 4618. That's pretty bad.

Your next step depends on how important the data is. If you REALLY need it, you should stop completely and disconnect the drive immediately, and send it to a data recovery service. They will attempt to read the drive and recover your data, and usually charge you only if they succeed. They might be able to "exclude" the bad areas so that it doesn't risk causing more damage, or even just read the platters that are good and not the bad one.

If it's not really that important, then you can just let ddrescue keep trying and hope that it manages to get past the bad area eventually. It seems like this may be the best option, as those questionable sectors ARE eventually being read successfully instead of being remapped, it just takes many attempts.

You can run Victoria in re-map mode, or one of the other repair tools, which will force the drive to read those pending sectors over and over until they finally are marked as bad by the firmware, crossing the threshold of quality, and re-mapped. This risks causing so much physical stress that the catastrophic failure is more like, I think.

As far as trying to read the folders/files in the OS, you could try using a tool like Recuva or similar things which will read the raw drive (where the filesystem allocation table or partition table isn't readable) and reconstruct the filesystem or just scan for things that look like files and rebuild them. I don't know if this will be any more or less successful than ddrescue, or if they're basically doing the same thing and ddrescue just happens to be open-source.
Hello, and I appreciate your response. I am very grateful for your thorough reply.

Since you commented here last night, I have read over 100 posts, threads, and articles related to this topic. I am not exaggerating.

I kindly ask you to take a few minutes to review my understanding so that I can reach an appropriate conclusion. This problem has severely impacted my life for more than six months.

Allow me to restate my current understanding once more, and at the end, I will ask several questions for clarification. I do not like to play with words. Throughout my research, I have encountered terms such as "damaged," "defective," "RAW," "corrupted," and similar. My concerns are genuine, not childish excuses or pointless insistence. I am sincerely seeking the best answer and solution.

If I understand correctly that my HDD has a mechanical issue, I will immediately set it aside.
What I understand from Pending_Secotrs is :
Pending sectors are those sectors that have reading problem. If can write on sector it clears an error.If not succeed (even physical damage) it reallocates to spare sectors, therefore reallocate_sector_count attribute would be increased.
1-This attribute is 0 for me.Why? I think I am not trying to write on those problematic sectors .In addition I tried to read them with GNU ddrescue (and because of reading, pending_sector has been increased but unable to reallocate them due to nothing has been written to those sectors , so should I try to write on sector ? If yes ?
Which option you prefer?
  1. Find sectors with long test(or software or Linux tool) and try to write zero/null by dd command?
  2. -Victoria, but in Windows
  3. Western data lifeguard (filling zero on pending sector )
Last night after your comment, I visted several top-notch data recovery software such as R-Studio , DMDE , Disk Drill , easeUS , Stellar Data ,they claim to retrieve data back from bad sector and even corrupted/RAW and damaged disk
------Does imaging with ddrescue have any advantages over one of these tools?
There are two types of bad sector :
1- Logical or soft bad sector
2- Physical or Hard bad sector
---- In my case, which is mine? soft or hard one?
---- From your perspective, using ddrescue gently that skips those bad areas could be an effective approach?(smaller cluster, at least 3 -4 MB/s read speed, not trying on first run , stay maximum 1 s on bad area and useful option if needed)

Fortunately, none of them I heard while I was using ddrescue
------The sound I heard (Vizzzz Vizzzz): How can I be sure it's a mechanical issue(head touches platter) or not?
This is the sound I was hearing : (second 28 to 34 - if you hear Vizz Vizzz(just vizz vizzz sound and not other sound mixed with Vizz Vizzz) :



I am more than grateful for the time you've taken to engage with my post 🙏 🍀
 
One additional point :
I don't remember where I took this screenshot:
This is one of the many ddrescue's outputs and a damaged disk, If it were healthy, it didn't take 3 weeks, similar healthy 4 TB took just 14 H.
47500 Bad sectors.I'm not sure did OP of this comment heard any unusual sound like me or not .
photo-2025-05-18-00-07-47.jpg
 
Focus on whatever folders or individual files have your personal data.
Try those first.
Thank you.
Could you please elaborate a bit? Try those first. Since ddrescue works at the block level, I couldn't try your suggestion with ddrescue. Did you mean data recovery software? If yes, which one would you recommend?
 
Thank you.
Could you please elaborate a bit? Try those first. Since ddrescue works at the block level, I couldn't try your suggestion with ddrescue. Did you mean data recovery software? If yes, which one would you recommend?
No.

No 'data recovery', no ddrescue.

Those would be attempting to work with the entire drive. And when it encounters bad sectors, it errors out.

Just try to copy the files/folders in question, off to some other drive.


If THIS fails, then you move to something else, like HDDSuperRescue.

But currently, the ONLY thing you should be worried about is the data on the drive.
 
  • Like
Reactions: xilin_0
Others have already commented appropriately, but I'm going to provide some observations (which might or might not be useful to you).

You have a standard old tech platter hard drive (this is what "sdd" implies, although it might be something else; comment if this is incorrect), and so "dd" is appropriate. I don't know if your "ddrescue" differs in options compared to a raw "dd", so keep that in mind as I talk about "dd".

"dd" has the ability to convert missing bytes to NULL. This is useful when a block has unreadable bytes. Most old hard drives use a block size of 512, but even if the size were larger, then "dd" could use a smaller block size. You could even use a block size of 1 byte, although this would be so extraordinarily slow that it could take weeks to copy a drive. 512 bytes is an appropriate size on a standard hard drive (old tech) recovery.

If you do copy something with "dd", then from that point on you could use a loopback mounted image to work with using your recovery tools. The tools don't know the difference between working with a loopback device and an actual block device (that's the purpose of loopback: Make another memory device appear as a disk/block device). There is an advantage of reading your actual drive once and making an image which can be loopback mounted. You can work on that image as much as you want without fear of the disk failing further.

This isn't perfect of course because if just one byte in the 512 bytes is bad, then all of those 512 bytes are gone with this method. However, what you're examining is a filesystem, and not raw binary bits. The filesystem itself will have a block size, and this will never be less than 512 bytes. Odds are high that losing the 512 byte span will leave NULL bytes only in that one file. In some cases filesystems will have some sort of efficiency algorithm which could affect two sparse files by losing 512 bytes, but this would be rare.

Lower level recovery hardware and software might look at the actual signal the heads are putting out to try and recover questionable content quality, and the "dd" loopback image version will not have any ability to work with this. One would have to risk further damage to the actual drive to run those tools. Personally I would only run that after I've made a "dd" copy.

Also, if you had a matching model of that hard drive which is good, then the "dd" image could be directly imaged onto the replacement drive. Missing data would still be missing, but anything which works with that drive and which does not encounter NULL byte replacements would "just work".

I'm assuming you are running Linux of course, and have a lot of extra space available. If that disk is 10 TB, then a full image will take up 10 TB on your system which is performing the recovery. Using "sdd" as the drive, then the following would image a complete drive using 512 byte blocks and converting errors to NULL filler bytes, along with a bit of output to tell you about the progress and encounters with errors:
Code:
dd if=/dev/sdd of=/dev/sdd bs=512 conv=sync,noerror status=progress

This is the same thing, but creates a log for you to examine later:
Code:
dd if=/dev/sdd of=dd_image.img bs=512 conv=sync,noerror status=progress --log-file=image.txt

After this one could the the image with a loopback device like this::
Code:
sudo losetup --find --show ./dd_image.img

Whatever that device is showing up for covering this can use tools like "sudo gisk -l /dev/loop0" (I'm assuming loop0, but adjust for your case). This is the entire disk. One could further use "dd" to copy an individual partition of the loopback device. I think "lsblk -f -T" would show the loopback device once it exists, not sure.

Or you could create an image of just a single partition, and loopback mount that directly. If your disk only has the "/dev/sdd1" partition, then you could copy the partition itself like this:
Code:
dd if=/dev/sdd1 of=dd_sdd1_image.img bs=512 conv=sync,noerror status=progress --log-file=image_sdd1.txt

One can use "mount" to directly mount this and add the loopback device in a single step since it is a partition:
Code:
sudo mount -o loop ./dd_sdd1_image.img /mnt
(mount location "/mnt" is arbitrary)

You might want to look up the man page for "losetup" since there are a limited number of loop devices, and if you just keep creating them, then they do not automatically release.

"dd" has no understanding of the underlying filesystem. It doesn't care, and it doesn't need to (missing bytes won't stop "dd" if you tell it to keep going). However, once you have that image covered by loopback you can run operations such as disk repair. It is the filesystem and the content of files and directories which do care about missing or corrupt bytes. If files have bytes wiped out, then you won't be prompted for filesystem repair; if something related to the filesystem is damaged, then you will be prompted for repair. Once repaired (if required) individual files and directories can be accessed (perhaps much of what you want survived without NULL byte replacement; even if NULL bytes are padded into a failed block you could perhaps recover parts of those files). Example:
Code:
sudo fsck.ext4 /dev/loop0

Overall I would try to read the failing disk only once to create an image. Do whatever is possible with the loopback mounted image. If more is required, then tools which work with low level signals could be used if failure isn't complete. For that you'd like need a disk recovery service since it can involve hardware designed to work with the signal on the drive head.
 
  • Like
Reactions: xilin_0
Manually formatting some of this due to the quoting sections having been done poorly. You should not type inside the "quote box" when you're adding your own lines. You can quote individual sections of someone else's comment by highlighting it and clicking Reply from the menu that appears, so that it gets added to your new comment and then you write below it, OUTSIDE the box.

1-This attribute is 0 for me.Why? I think I am not trying to write on those problematic sectors .In addition I tried to read them with GNU ddrescue (and because of reading, pending_sector has been increased but unable to reallocate them due to nothing has been written to those sectors , so should I try to write on sector ? If yes ?
Which option you prefer?

  1. Find sectors with long test(or software or Linux tool) and try to write zero/null by dd command?
  2. -Victoria, but in Windows
  3. Western data lifeguard (filling zero on pending sector )
The reallocated sectors value will only increase when a sector completely FAILS. Until it becomes "bad" (meaning the quality of the magnetic signal of the bits drops below the threshold programmed into the firmware) it will only be PENDING, where the firmware can detect that the quality is not perfect, but it's still working. Different drives have different thesholds. Your drive may still consider the sector good enough to be PENDING if it just has to be read twice, or maybe three times, but if it needs 4 reads then it's "bad" and gets reallocated. But that means it takes 2 or 3 times as long to read those sectors compared to a perfect drive with no defects. Note that software can't control how often the drive attempts to read a pending sector with a single request; the software can ask just once, but the drive determines how many attempts to make and the software doesn't know how many attempts it took, and the software can't tell the drive to make fewer attempts.

ddrescue and any other tools have to read every sector in order to locate legitimate data. Pending sectors are still considered valid sectors, so they have to be read. If the sector is marked bad and remapped, then NO consumer software will ever look at that physical sector ever again. The only way to make that happen is for the software to attempt writing to that sector over and over until the quality gets so bad that the drive firmware remaps it.

I don't know much about dd but there are ways to force it to rewrite specific blocks many times until they fail and get remapped. I presume you'd need to do it against every pending sector, which means needing to find out every sector. That may not really be effective either, since the number of sectors on your drive with problems keeps increasing. The data in those sectors is erased.

ddrescue is not concerned with trying to "fix" the drive and force sector remaps. It's only concerned with trying to copy the data from it. The "pending" sectors are currently readable, it just takes multiple attempts. That will make it take longer than normal to read and copy the data, but it should succeed eventually unless there is catastrophic failure. How long it ultimately takes depends on how many sectors are having problems and how many retries are required to read them or force them to fail and be remapped.

A tool like Victoria in Windows is just an easier way to force the pending sectors to fail on the entire drive. It will automatically hammer the pending sectors by making repeated requests until they fail (when you use re-map mode), without affecting good sectors. (The software also doesn't know that a specific sector is "pending". It only knows that it took longer than normal to read the data, so it assumes that sector is starting to fail.) The data in the pending sectors SHOULD get moved to the remapped sectors instead of being lost, unless the sector fails catastrophically and can't be read. The rest of your data will be unaffected. But just like using dd, all this is doing is trying to force the sectors to be remapped in an attempt to make the drive "good" again. The process could cause the drive to fail catastrophically and lose ALL your data.

WD Data LifeGuard fills the ENTIRE drive with zeros, so all your data would be lost, and it doesn't repeatedly write to the pending sectors to try to force them to be remapped. You'd have to run it over and over to do that. So this option would not be good.

Last night after your comment, I visted several top-notch data recovery software such as R-Studio , DMDE , Disk Drill , easeUS , Stellar Data ,they claim to retrieve data back from bad sector and even corrupted/RAW and damaged disk
------Does imaging with ddrescue have any advantages over one of these tools?

ddrescue (and dd itself) is open-source and has a LOT of options and capabilities, so if you know what you're doing you can do a lot more than commercial tools, and of course it's free. Some of those other tools are also free while others may only show you what they CAN recover but won't do it until you pay them. ddrescue is also MUCH more complex to use since it's only by command line.

NO consumer software can recover data from a sector that has been re-mapped by the drive firmware. Those sectors simply don't exist anymore as far as the drive is concerned. Most rescue tools are concerned with recovering data that has been accidentally deleted, or where the partition table or file allocation table (or equivalent) has been damaged or lost, or the drive has been repartitioned or reformatted. That's what a RAW or corrupted drive is. In those cases, there is no physical fault with the drive, and the software just reads the disk sector by sector and attempts to find data structures that indicate where the partitions and files were located, and copies the data to another location. They can also scan a drive that does have physical problems, such as pending sectors, which may have caused the corruption, but they still depend on the drive itself being able to read the physical sectors. That's all ddrescue is doing. If the drive is unable to read a sector after multiple attempts, the data is lost and the sector is remapped.

Your drive may not have any reallocated sectors yet, but it does have pending sectors that are increasing, and it seems that it has had data corruption occur since you can't read the partitions. Any of those tools can likely recover a lot of the data, but during the process more sectors will become pending, and possibly some will be remapped. But the pending sectors ARE still readable.

Unfortunately the more you try to recover data, the more you're going to risk causing more problems and total failure. That's just the nature of this type of failure. If the data is important enough, you need to physically send the drive to a data recovery specialist. (A company that does this professionally. Not just some general computer repair company that says they'll recover data.)

There are two types of bad sector :
1- Logical or soft bad sector
2- Physical or Hard bad sector
The logical bad sector is where the operating system made a decision that a sector is bad because it didn't respond properly. For example if the sector has to be read 3 times and it takes 3 seconds to do that, the operating system may be coded to only wait 2 seconds. If it takes longer than 2 seconds, the OS decides the sector is "bad" and marks it as such in a special location in the filesystem. Or it may return an error instead of valid data and be marked bad that way. Or it may do a read/write/read test and if the data gets corrupted the sector is marked bad. In Windows, after you run chkdsk there is a line that shows the number of bad sectors. That refers to logical bad sectors that the OS has detected during normal operation or during a chkdsk scan specifically for bad sectors. Logical bad sectors are NOT remapped. You just lose the amount of capacity of however many bad sectors there are. If you ever format the drive, the data about those logical bad sectors is erased, so they will then get used again. Logical bad sectors CAN be perfectly good physically, as there are other reasons for the drive to take longer to respond at times.

Physical bad sectors is obviously when there is a physical fault with the magnetic surface. Magnetic media can wear out if it was poor quality from the factory, or become detached from the platter surface, or be damaged by impact. A physical bad sector is detected by the read/write heads of the drive because it can sense the strength of the magnetic field. When it goes below a certain threshold, the drive's firmware records that the sector is bad and remaps it. This is a permanent reallocation and the physical sector will never be readable by software again.

Is there a way to copy specific folders directly in Linux or Windows? (Six months ago, I was unable to access the HDD'd drives.)
I have taken this to mean that when you plugged it in, the operating system could not see the partitions or the files. If you can provide more information on what was done it might be possible to make it accessible again. If you can do that, then you can just copy the files you need before destroying or recycling the drive. Getting access to the files themselves that way would be the fastest and safest way to get what you need, because there would be no need to scan the whole disk and cause more stress on it.

ddrescue will only read and copy the data of the entire drive to another location, so that you can then dig through the contents. Some other tools like TestDisk and PhotoRec, as well as some of the ones you mentioned, can try to just identify the files and create a list of what it discovered, instead of taking the time to copy the entire drive, and then allow you to select which ones you want to retrieve.

I think those tools are all equally stressful to the drive, but ddrescue or another tool that just tries to image the entire disk MAY be the safest. It will just read the entire drive and create an image of it, and then you can work with the image instead of the drive. ddrescue is supposed to try to read only "good" sectors first, but in your drive's case there aren't any "bad" ones yet, none that are actually returning errors, so it might just take a bit longer as I said, while the drive itself retries the questionable sectors until the data reads successfully. Once it gets past the bad areas, it will go much faster.

If you use a tool like TestDisk or PhotoRec that generates a list of recoverable files, it will have to read the entire drive once to build the list, then read it again to recover the files you select. Depending on where the bad areas are, this COULD result in more stress and more failures and loss of data. I think they can also be set to simply recover all the files they find though, similar to ddrescue, but they just copy the files instead of creating a solid image of the entire drive. You then have to depend on whatever directory structure they decide is accurate and have to hope it's useful. With the ddrescue image file, you can mount the image file itself and treat it like a hard drive to perform any other data recovery you want, including running TestDisk, PhotoRec or others, without risking further damage.
 
  • Like
Reactions: xilin_0
You have a standard old tech platter hard drive (this is what "sdd" implies, although it might be something else
"sd" refers to any SATA drive or SAS/SCSI, whether mechanical or SSD, as well as USB drives. "hd" was the prefix for IDE/PATA mechanical drives, and for those very few PATA SSDs that were hacked together. But given the SMART values including things like "spin" one can conclude it's mechanical.

It's kind of surprising that the community accepts the use of the name "ddrescue" when it is not connected at all to "dd", seemingly to deliberately make people confuse the two. But ddrescue has capabilities designed specifically for recovering data from possibly failing drives.
 
  • Like
Reactions: xilin_0
"sd" refers to any SATA drive or SAS/SCSI, whether mechanical or SSD, as well as USB drives. "hd" was the prefix for IDE/PATA mechanical drives, and for those very few PATA SSDs that were hacked together. But given the SMART values including things like "spin" one can conclude it's mechanical.

It's kind of surprising that the community accepts the use of the name "ddrescue" when it is not connected at all to "dd", seemingly to deliberately make people confuse the two. But ddrescue has capabilities designed specifically for recovering data from possibly failing drives.
I use the actual "dd" when recovering data. Never used "ddrescue". There are other tools, but mostly what I do is create an image from "dd", and the use the other tools on the loopback mounted image.
 
Just try to copy the files/folders in question, off to some other drive.
Thank you for your response. I will do it with Linux Mint.

I hope I can. Afterward, I won’t need my HDD; I could even fill it with zeros, perform low-level formatting, or do whatever , and then just dispose of it. The most important thing is trying to access the data.
 
You have a standard old tech platter hard drive (this is what "sdd" implies, although it might be something else; comment if this is incorrect), and so "dd" is appropriate. I don't know if your "ddrescue" differs in options compared to a raw "dd", so keep that in mind as I talk about "dd".
Thank you for your response.
I meant "GNU ddrescue : https://www.gnu.org/software/ddrescue/
I go for comparing dd with ddrescue.
Thank you.

EDITED: I found this link may be useful.
I read it one time.
https://superuser.com/questions/1024643/in-which-case-should-i-prefer-dd-over-gnu-ddrescue
 
Manually formatting some of this due to the quoting sections having been done poorly. You should not type inside the "quote box" when you're adding your own lines. You can quote individual sections of someone else's comment by highlighting it and clicking Reply from the menu that appears, so that it gets added to your new comment and then you write below it, OUTSIDE the box.
Hello, I appreciate your comment, and of course, I consider your points.

I have read your comment multiple times and noticed several good points.

I overlooked using software like Victoria, WDL, etc.

I mentioned what I had in the next post.

I'm not sure if you asked this, but regarding how much of my data is important: I could say that half, 60%, or even 70% of the data can be skipped. However, around 50 to maybe 80 GB is still useful for me.

You're right—if I could access the entire drive and just copy a few folders, it would be less stressful for the disk.

Someone advised me that if I want to use ddrescue, I could experiment with its options, such as changing the cluster size, setting a maximum read speed (so if it drops below my threshold, it moves on), adjusting the time spent on bad areas, or using direct access instead of kernel cache during the first run.

Honestly, I'm confused. I don't need this HDD for much longer; I just need a few GB of data. I mentioned that I might need around one-tenth or even less.

That noise has been upsetting and frustrating me. Maybe due to aging, the drive has developed mechanical issues, but it has never been physically damaged or dropped.
 
Last time before this time I plugged in HDD was about 6 months ago:
what it was :
There's a good chance that the recovery software that searches for files could pull some data from the drive without needing to use something like ddrescue. TestDisk, PhotoRec, etc. can scan the drive since it is visible and there are at least visible partitions even if Windows can't read the filesystem. (You have an EXTREMELY weird set of partitions on both of those drives, IMO. I've never seen anyone break a drive up like that.) Since the sectors are still pending, those tools can probably also manage to read the data without having anything lost. I think you should give them a try.
 
  • Like
Reactions: xilin_0
There's a good chance that the recovery software that searches for files could pull some data from the drive without needing to use something like ddrescue. TestDisk, PhotoRec, etc. can scan the drive since it is visible and there are at least visible partitions even if Windows can't read the filesystem. (You have an EXTREMELY weird set of partitions on both of those drives, IMO. I've never seen anyone break a drive up like that.) Since the sectors are still pending, those tools can probably also manage to read the data without having anything lost. I think you should give them a try.
Hello and I I sincerely appreciate your kind response.
I will try and hope there will be a chance.
Could you please answer the questions below once more:

  1. You mentioned that if I only need some data and do not need to create a full image, I can access the HDD directly. You also warned that continuing to use the hard drive in its current state may cause further damage. My question is: can I create a full image of the drive before it completely fails and gone? How can I be sure that the drive is still operational enough to image up to 800 GB of data? (This time, I plan to use more ddrescue options, such as smaller clusters, setting a minimum read speed, etc.) If I set options to skip bad sectors and only image the good parts, it might work. From your experience, do you think it will complete before the drive fails completely?
  2. Instead of using TestDisk and PhotoRec (which I plan to try ), is there a way to copy my files directly? For example, using Lixu copy command, would that be recommended? Or is there a more effective and reliable method to recover files?
  3. When using software like R-Studio, DMDE, or UFS Explorer and clicking on scan, does that process essentially perform the same operation as creating an image? In other words, are they scanning the drive to recover data in a similar way?
  4. If I connect the drive via SATA instead of USB, would that have any positive effect on data recovery or imaging?
  5. if I use Testdisk with Windows , does Windows wriitng/reading from faulty drive ? If yes , should I use this HDD with a boot live Linux?
  6. Just out of curiosity: I find it hard to believe that the person in the video made it just for views. In an ideal situation (such as in a clean room), would the recovery process work? I’m not sure where I should ask this question — do you have any advice?


Thanks and regards
 
1) Since the partitions are visible, and all you've got are PENDING sectors, I think that you're safe enough just trying to read the drive with one of the tools. For recovering individual files, I think PhotoRec would be best. It will scan each partition for blocks that look like valid files. It will copy any files it finds to the destination that you indicated. You can specify the type of files that you want as well, so that you don't need as much space on the destination storing a bunch of garbage like application/OS library files, executables, etc, and it may speed up the process.

If you use a tool like ddrescue to make an image of the disk, you will need as much space on the destination as the total space used on the failing drive. (And then you have to mount that image and scan for your files and copy them to a DIFFERENT destination with PhotoRec since the filesystem isn't readable by Windows.) The benefit of making an image however is that you'll have ALL that data which you can go back and look at later, if you realize you needed some other files, without needing to connect the failing drive. So that may be preferable to you.

The number of pending sectors will probably continue to increase regardless of which option you choose, and some sectors may even be marked as bad and reallocated, but this is a GOOD thing because it means the drive may be able to move the data from those bad sectors instead of losing it. PhotoRec and ddrescue don't perform any write operations though so nothing should get any worse. The drive will just be reading all the sectors of the disk, which means it will be detecting those questionable sectors that get marked pending but should not be making them worse. So I think both PhotoRec and ddrescue will be equally safe now that we fully see the state the drive is in. ddrescue also should not end up needing to skip any bad sectors, since right now there aren't any BAD sectors. All of the pending sectors are returning valid data as far as the drive is concerned; it is just warning that they may fail soon.

2) Right now you have partitions with unknown filesystems. The formatting data was lost/damaged, so Windows can't tell that there is any formatting at all, but the actual data should still be there, depending on exactly what happened. (The fact that all 4 partitions got messed up is worrisome. You never said exactly what happened to make you see those pending sectors and the filesystems to disappear originally.) In order to look for the files yourself and use the copy command, you have to be able to read the filesystem so Windows will give it a drive letter, or Linux will mount it with a path. There are tools like TestDisk or DiskGenius (paid) that could scan the partition and try to restore the filesystem (rebuilding the master file table or repairing damage that is making it unreadable by Windows), but there's no guarantee. And right now, you only have ONE copy of everything on a failing drive, so if anything goes wrong, you lose data. If you wanted to try one of those tools, you could first create the image with ddrescue, then mount that image and use the repair tool on it.

3) All of those tools have options for making an image file like ddrescue or for recovering individual files, and they work in similar ways but using different algorithms. PhotoRec is totally free but doesn't have a nice GUI interface and not as many features and options. The others have both free and paid versions, with limitations on what they can do. R-Undelete Home for instance will only recover tiny files on an NTFS partition. UFS Explorer will only recovery tiny files in the free trial. DMDE free version will recover up to 4000 files at a time from ONE directory, but you can run the program as many times as you want to recover in other directories, or it can make an image file like ddrescue.

4) Since it's a mechanical drive, USB3 is perfectly fine for data throughput, but connecting it via SATA may improve performance by reducing latency and random seeking.

5) Since Windows doesn't see a filesystem on any of the partitions, it won't be writing any data to them itself. If you use any of the tools to scan for files to copy to another destination, or to create an image, they will operate in read-only mode. But if you use something like TestDisk or DiskGenius to try to repair the partitions and filesystems, they will be making changes (writing) which could potentially overwrite some data. If they succeed in restoring a usable filesystem, Windows would mount them with a drive letter and might write data to them, which could overwrite some data that the restored filesystem didn't recognize, making it permanently unrecoverable. I would not try to repair the filesystem on the drive itself. I would make an image of it, and then try to repair the filesystem in the image, so the original drive was unchanged in case you needed to make an image again.

6) Yes, it is sometimes possible to repair a drive that is failing by opening it up and possibly replacing parts. That's one of the things that professional recovery services do. However the success rate depends on exactly what has gone wrong.

Read/write heads being "stuck" on a platter is catastrophic and will almost always result in lost data, if it's because the heads themselves have made contact with the platter. That would destroy the surface of the platter and possibly the heads themselves, requiring the actuator assembly to be replaced, and then trying to scan for readable files on the areas of the platters that weren't damaged. If the drive was running for a long time after the heads made contact, and the actuator arm was able to move, there'd be a lot of damage all over the drive. If it got stuck solidly in one position and was shut off quickly, then just a single ring of tracks might be damaged which might mean only a small percentage of loss, like in the video. Luckily, that drive still had a readable filesystem, so the damage wasn't in those critical areas, but it could have damaged the partitions or filesystem and result in needing to do recovery like you're trying to do.

If the heads are just stuck because the actuator arm has become jammed, then there may be no platter or head damage if the arm wasn't on the platters at the time. The grease on the arm may have been contaminated or something along those lines, and as the host mentioned, sometimes just giving the drive a good smack can release it. However, a good smack in ANY situation could cause even more damage because if the actuator arms are over the platters you might be forcing the heads to hit the platters even more, and making the actuator arm drag them across the platters.

Moving the actuator manually like in the video does also carry risks of further damage. You could hear the screech of the heads dragging across the platter when he moved the arm, which probably damaged more sectors. When the drive isn't spinning and the heads are parked, away from the platters in that orange plastic piece in the video, the heads for the top and bottom of a platter are being held "up" away from the platter mechanically. If they weren't separated that way, they'd be so close together the platter couldn't fit between them. The drive has to spin up before the heads are moved, because the spinning platters create airflow that makes the heads "float" above the platter surface. If the drive loses power while the heads are over it, the drive is supposed to snap the actuator arm back into the parked position immediately (part of the function of the big curved magnet, which acts like a spring), before the platters have stopped spinning. It takes several seconds for the platters to slow down, which keeps enough air flowing to keep the heads floating. The heads fly at only 5 NANOMETERS above the platters on modern drives.

For the drive in that video, the user would want to immediately begin copying data files off of it and hoping it didn't get stuck again during the process, and then the drive should be destroyed or recycled.

In other cases, replacing parts can't fix anything. If the service tracks on the platter were failing, the drive's controller may not be able to properly load firmware or read the drive-specific data needed, in which case there is special software that can basically force it to scan the disk without trying to be "functional" in order to recover data.

Your situation is different, since you only have pending sectors and no indication that the heads are getting stuck or damaging the surface. Increasing pending sectors like this probably indicate a defect in the materials of the platter or magnetic materials themselves, such that the sectors are unable to be given or hold a magnetic field strength sufficient to be considered fully healthy. The drive controller is now "watching" those sectors just in case they get worse, which probably would happen over time if you continued to write data to it and eventually they would fail. Depending on the reason the sectors are getting weaker, that could result in the magnetic media even detaching from the platter and turning into shrapnel inside the drive, damaging other sectors or the heads. But just reading the sectors is less stressful on the material than writing (it's just the mechanical stress and heat of the spinning platter, rather than altering the magnetic state), so there is less chance that there is going to be a failure while you try to recover the data if you don't try to repair the filesystem and just try to recover files or make an image.
 
  • Like
Reactions: Misgar