On Sat, 26 Jun 2004 18:55:51 -0700, "Joe B"
My hard drive is failing, but still runs and I have
bought a new (and larger) drive. My system has XP Home
and Norton Ghost installed.
Under these conditions I'd approach as per "Track 1" in
http://cquirke.mvps.org/pccrisis.htm - IOW:
- stay OUT of OSs that write to HD automatically (XP)
- cherry-pick crucial data FIRST
- only then, attempt an image pull of the entire volume(s)
You say the HD's failing, but not what the situation is exactly. It's
usually one of two patterns:
- sometimes the HD's not detected by BIOS at boot
- there are bad sectors and slow-downs due to HD retries
In the first case, assume that every boot that works may be the last
time it ever does so - IOW make hay++ while the sun still exists, it
may not shine again. So if you do boot and can see the HD, make sure
the OS you boot into is a safe platform from which you can evacuate
your data, then do so without any further delay.
In the second case, you want to spin the HD as little as possible,
because effectively it may be rotting away while you walk on it.
Progressively increasing numbers of bad sectors most likely implies a
head mechanism that is shaking itself to pieces, or an airspace that
is polluted with abrasive debris. It's dying, and you do not have the
spin-time to attempt imaging ops that can go on for days.
Different imaging tools work in different ways, in two areas:
1) How they respond to "difficult" disk access
When attempts to read HD fail, the calling code may go into a loop
that retries the operation a number of times before returning an error
message - and the app may either step over the error, or (if it's a
really crap app, in the data recovery context) abort the whole job.
The trouble is, the code the app is retrying X times may itself retry
"difficult" operations Y times, calling deeper code that retries the
same ops Z times, etc. So while each layer thinks it is prudently
retrying (say) 100 times, the end result is 100 x 100 x 100 = 1 000
000 retries that take so long you think the process has locked up
hard, or the HD physically dies on the operating table.
There's a further problem in that the HD itself has its own crappy
"let's hide the problem!" agenda. The firmware that operates the HD's
internal operations may try to remap a failing sector to a spare
sector, then paper over the change so that the rest of the system is
unaware that anyything has gone wrong. Needless to say, retrying
*that* futile quest a million times can convert a HD access that
should be done in a few milliseconds into days of wheel-spinning.
2) Whether they make "smart" or "dumb" images
A "dumb" image simply copies every sector off the donor volume or HD,
irrespective of whether the file system addresses it or not. This
preserves *everything*, including any addressing dependencies that may
fail if the image is "run" on a HD or PC that has a different capacity
or addressing "shape". This is the type of image you want here, tho
you may need an identical HD to paste it onto.
A "smart" image interprets the volume contents according to the file
system's internal logic. This is great when the file system logic is
known to be sane, but otherwise it will leave out what is not
addressed by the file system, and lose the raw file system structural
anomalies that may have cued you into re-addressing that material.
On the face of it, doing a full image backup would seem the best
starting point for recovering data from a sick HD, and I'm sure this
is the advice given in many "how to recover data" web sites.
But because of (1), an attempt to do this may leave you with nothing
at all if the HD dies while you are trying to image it. I've
recovered data from HDs that have died (stopped spinning, or have
descended into an every-sector-is-bad abyss) within hours, and I've
done BING images on 4G HDs that have taken DAYS. Join the dots.
Often a failing HD will cause bad exits and thus corruption of the
file system logic - or holes appear in the file system structure
because sectors within that structure have died. Because the HD
itself "fixes" these bad sectors (as does NTFS's operating code, as do
surface-scanning ScanDisk, ChkDsk /R, etc.), you mayu have sectors
within the file system that load OK but are full of junk. For these
reasons, you may find that concern (2) also applies.
Back to the post...
I can make a clone of the drive, and Windows starts
up on the clone, but stops with a screen that says
"Windows XP" on it.
Executive summary: Windows, XP included, is a "fair weather" OS. It
cannot be trusted once the hardware gets flaky; it WILL fall on its
ass and/or make things worse, often considerably worse.
Do NOT run Windows again until all hardware flakiness has been
resolved. Do this stuff from a safe maintenance OS instead.
http://cquirke.mvps.org/whatmos.htm refers.
<rest of doomed stuff snipped>
--------------- ----- ---- --- -- - - -
Who is General Failure and
why is he reading my disk?
