ZAR hangs after completing scan

[Alexey V. Gubin]

Recently there was an influx of reports of ZAR hanging after completing a volume scan. The problem occurs in both image recovery and filesystem recovery modes.

This post will be updated to reflect the most current developments.

Symptoms:
ZAR completes the identification process normally (the volume map fills completely with data), and after this, a process stalls, with no disk activity (check - LEDs blinking on the devices) and no CPU usage (check - Ctrl+Alt+Del and use Task Manager, "Performance" section). The "Elapsed time" counter in ZAR continues ticking, but no other activity can be observed.

Current status:
This issue is believed to be resolved as of version 8.3

[Alexey V. Gubin]

In all image recovery cases, please report the megapixel number of a camera.

[ausie1]

I have just bought V 8.3 and I am having the exact same problems as described. ZAR scans, shows root, folders and files but when asked to copy will freeze trying to copy the first file after copying the folders. Have had the same result using 2 computers.

[Alexey V. Gubin]

The log file
C:\Program Files\ZAR\logfile.txt
may contain the error message near the end of the file - what is in there?

[ausie1]

I changed some settings, Time out set to 200, unticked avoid repeated retries and set the skip factor to 32 and it now has retrieved files from the formatted disk. Problem solved.
Cheers

[Alexey V. Gubin]

Interesting. Honestly, I found it surprising that it worked. We'll have to keep an eye on it. Anyway, good that it finally worked out.

[Binki]

Hi.

I have just had a similar problem. I downloaded the ZAR software today (11/29) and installed. I borrowed an external USB Western Digital drive (120GB) model WD1200BB, from a friend to backup pictures, etc. before I did a computer rebuild. I confirmed it was all there before disconnecting the drive, by comparing the Main Drive and the USB Drive contents a folder at a time. (Yes, tedious, but made me feel better).

After the rebuild I reconnected the drive. It seemed to connect and I got the messages that a drive was available, could not see it, except in Administrative Tools | Computer Management | Disk Management. It showed there as 'Unallocated'. I tried on all 3 home computers and at work, no go. Same error every time. No virus is found on any of our computers and we have different scanners running, so some overlap.

I followed the tutorial here: http://www.z-a-recovery.com/partition-recovery-tutorial.htm. On the 'Scan for missing partitions' dialog, all seemed well, but then at 91% it just stopped, all CPU, MB/sec, etc. stopped. The light on the drive blinked occastionally. After another hour still at 91% I clicked 'Stop Scan'. Nothing. Clicked again. Nothing. Being patient, I waited. Eventually, when I came back, it was at the 'Select Volume to Process' dialog and showed a FAT volume.

I did the next steps in the tutorial, highlighting it and clicking next. That worked. I get to the 'Volume Analysis' screen. It shows all white squares. The Elapsed time is ticking off, now at 16 minutes. Filesystem is 'Not known yet'. Raw scan is about 1%. 0% CPU and 0.0 MB/sec. 0 seeks/sec. 3304 KB read cache.

I tried what the previous person did, adjusting the Runtime control settings, but nothing happening. So, it looks like 'something' is happening, the drive lights flicker now and again, but nothing on the scree has changed except elapsed time and Current operation and its progress bar is about 1/30th, not having move for several minutes now.

I will keep trying. If we can get this working, you've got a sale! Thanks.

Gary

[Alexey V. Gubin]

Looks like the device stalls at certain point, at 91% drive. After that, no further read can be made. This typically happens if the drive itself got a bad block and USB enclosure fails to handle it properly. So you need to get rid of the usb enclosure if at all possible. Since the drive is regular Parallel ATA one, is it possible that you get it out of the enclosure and attach directly to the motherboard?

If yes, then you need to try as described here for a drive unformat (http://www.z-a-recovery.com/unformat-tutorial.htm). However, during step 4, "Select logical volume", there will be nothing listed. You need to click "Define volume manually" and select "There was only one volume" in the dialog appeared. Everything else is pretty much standard.

[cadrock]

I just completed a scan of a WD1200BEVS hard drive that was dead. ZAR completed the scan and I could see the files to recover. I selected the files to copy and went the next screen.

I am stuck on that screen. I can click on any of the buttons, change any of the options, however nothing does anything.

The "start copying the selected files" doesn't do anything.
The "skip current file" doesn't do anything.

Even the "Exit" simply pulls up the message, are you sure you want to exit, then it doesn't exit.

Please help.

Thx.

[Alexey V. Gubin]

What does it mean "dead" drive?
And then
1. Restart it,
2. On the first screen click "Advanced Configuration", then under "General" change "Normal logging" to "Extended logging", and click OK to close configuration.
3. Retry the scan to see if it locks up again.

[cadrock]

I installed the updated 8.3 on this system and retried the scan. Now it is saying "access violation......." the program has been terminated.

It will not finish the scan at all now.

Any new ideas?

By dead drive I mean the drive failed, now we are running data recovery software to get the data back.

[nzadam]

I have had the same problem above and have been unable to resolve the problem. I am using a Cannon G9 digital camera, 12.1 mega pixels but shooting at 8mp, 4gb toshiba SDHC series 4 card, computer running windows xp and a kingston traveller card reader. My card became corrupted when inserted computer at a hostel which has likely been infected with all sorts of nasties and the camera simply says "no image" although the number of remaining photos is the same as before the issue arose. I have changed the settings to those described above but still have no joy. I have used several different machines. When the initial scan finishes the analysis shows that there are 300 odd images found but the scan has frozen and no activity on the card reading device. When i go back or exit, the auto save screen appears showing the root folder and the jpeg image titles below but I am unable to select or save them in the evaluation version. Any help would be appreciated.

[Alexey V. Gubin]

Can you get the image of the card?

When you have a list of a physical devices, right click the card, select "Create image file". You need to store the image file on NTFS volume with enough free space.

When it is done, restart ZAR, proceed to the list of physical devices, right click anywhere in the list, select "Load image file" and point it to the image file you just created.

This way we eliminate possible card-related issues. See if this helps?

[nzadam]

Hi, thank you for your prompt reply. I have made an image file and performed the same scan on this, as instructed. The initial scan is carried out as if I had run it off the card, if not a little faster and the statistics show that there are 323 images in one directory. However the computer hangs, just like before. When I go back or exit, I can see the image titles in the auto save screen... Any more help would be great as they are my only photos of Rio de Janeiro from my holiday.

Many thanks.

[Alexey V. Gubin]

Try this: when you see the list of images for the first time, right click anywhere on the empty space in the list. Do NOT click on the file. The menu will pop up; in there, disable "show preview" and try copying files.

Also, in "Advanced configuration", under "General" set logging to "Extended, for debug purposes". If disabling preview does not help, I'd like to see a log file, C:\Program Files\ZAR\logfile.txt, zip it and email to development@z-a-recovery.com

[filmore]

Hello,

no question, just wanted to add my experience made this morning:

the last days I tested ZAR (trial version) and had never experienced that ZAR itself is behaving strange.
After having upgraded to the full version I experienced that ZAR quitted abnormally on the very first operating time after switching to the full version.
The 2nd part of the scanning ("Raw Scan: Quick - identifying data..") was completed and right afterwards before going to the next step of scanning, ZAR quitted. Window closed. No message. Nothing, which could give a hint on what happened. The log file contained nothing pointing to a connected problem, I actually believe that ZAR got quitted that immediately so that there was even no chance to write further log information.

Then I rebooted the PC and started again a ZAR scan. This time it continued to the other scanning parts (..analysing indx blocks, parsing MFT, numerical computation, parsing filesystem, reconstructing directory tree and finally switching to the next GUI showing up the directory tree and starting the validation operation).

So right now it looks ok again. Don't know what happened with the "first scan after upgrade".

[Alexey V. Gubin]

Logging is actually buffered to improve performance with large drives. So if a hard error occurs, and normal exit cleanups are waived, the latest update to the log file is not written.

If this sort of thing happens once again, in "Advanced Configuration" under "General" set logging mode to "Extended - for debug purposes". This has two effects - more information is logged, and the buffering is disabled. This way we can get the pre-crash part of the log.

[mynidecker]

I sort of have a similar problem. I'm trying to recover jpeg and/or raw image files from a western digital 500 gb passport usb drive. Zar 8.3 does the prescan and now that the volume map is filled it stops while identifying at 50% and the elapsed time clock keeps ticking but there is no other activity to speak of.

[Alexey V. Gubin]

I recall last time we had that type of issue, we disassembled the Passport enclosure, and the drive worked well while attached to the motherboard port via the dumb converter (3.5" to 2.5").

[cpshelton]

Hi,

I'm having a similar problem with ZAR hanging during a scan. It completes the quick and full scans, but gets stuck on "Detecting volume parameters - Numerical computation in progress (0%)"

The clock keeps ticking, but there is no disk or CPU activity.

This is on a 120 GB HD in an HP 6910p laptop.

I've attached the detailed log file.

I manually set the cluster size to 8 to see if that would fix it, but I have the same problem. Any help you can give is appreciated!

[Alexey V. Gubin]

Looking at the log it is pretty clear that there is no data on the disk. Nothing that can be recognized at all. Except for a set of ext2 (Linux filesystem) superblocks. This looks much like a blank ext2 (or ext3) filesystem. What type of the filesystem should be there? What was the originating problem with the volume?

[cpshelton]

Looking at the log it is pretty clear that there is no data on the disk. Nothing that can be recognized at all. Except for a set of ext2 (Linux filesystem) superblocks. This looks much like a blank ext2 (or ext3) filesystem. What type of the filesystem should be there? What was the originating problem with the volume?

On the contrary, I'm sure most of my data is still on the hard drive. It's a 120 GB NTFS partition. After a scan, ZAR shows that only 2 small groups of clusters are corrupted, they just happen to contain the boot sector and backup boot sector, unfortunately. I think there might have been a power surge when I plugged the laptop into my docking station, causing damage to some clusters on the disk. But most of the drive is still intact. I can still access the file structure if I boot the laptop using an NTFS4DOS boot disk. I can copy files off the drive onto a USB stick in the NTFS4DOS environment, and they are readable on other machines. The problem is that NTFS4DOS does not support long file names or batch copying, so I would have to copy each file one at a time off of a 120 GB hard drive.

I've tried several tools including testdisk, ZAR, and getdataback. And I've had no success accessing the file structure using any of these tools. But NTFS4DOS can still see all of the files and directories on my disk, so I'm sure it can be salvaged.

Again, the problem is that the boot sector and backup boot sector are both corrupted, but the MFT seems to be okay, and all of the files and directories are visible in NTFS4DOS, but not in any other windows based tool that would allow me to easily copy the data off of the disk. ZAR seems to go through a complete scan, but just get stuck on calculating the disk parameters, and I don't know why. If you don't think ZAR can help, are there any other tools you could suggest?

Thanks.

[Alexey V. Gubin]

In the log file, we have

00000614: Object count : Unknown 0
00000614: Object count : Physcially bad 32
00000614: Object count : FAT16 boot sector 0
00000614: Object count : FAT32 boot sector 0
00000614: Object count : FAT16 sector 0
00000614: Object count : FAT32 sector 0
00000614: Object count : NTFS boot sector 0
00000614: Object count : NTFS MFT entry 2
00000614: Object count : NTFS INDX block 0
00000614: Object count : NTFS RSTR block 0
00000614: Object count : NTFS RCRD block 0
00000614: Object count : ext2/3 superblock 15
00000614: Object count : ext2/3 inodes 0
00000614: Object count : ext2/3 directory start 0
NTFS uses one MFT entry per file. Furthermore, $MFT itself (a blank one) needs at least 16 entries. So there are maximum two files in the area you scanned.

So I wonder how can this be. Actually I got a couple of ideas but need some more testing here. Be back to you in 48 hours or so.

[indiadawg]

I am using version 8.4 and still experiencing this problem.

ZAR goes through the first phase of quick scan "identifying data" and the percentage ticks over until it reaches 100%, but then it restarts at 0% and hangs up. The time counter keeps ticking, but the percent done doesn't increase and nothing else appears to be happening.

Any advice?

[Alexey V. Gubin]

What is the device you are scanning? Are there any "red dots", indicating bad blocks on the disk when it performs the first pass?

[1ndtech]

I'm also running into problems trying to recover data from a microSD-card that was used in a nintendo ds with some kind of adapter.

It completes the quick and full scans, but gets stuck on "Detecting volume parameters - Numerical computation in progress (0%)"
The clock keeps ticking, but there does not seem to be disk or CPU activity.

I've tried making an image file of the card and that seemed to work, but after opening the image file, having it scanned (it finds a single FAT16 partition, which is correct), the same problem occurs.

I have tried doing this on a windows vista system with a t7700 dualcore and on an older pentium 4 single core system running xp sp2. It makes no difference, whatever i try, i keep getting stuck on "Detecting volume parameters - Numerical computation in progress (0%)". I'm convinced it's not an issue with the drives holding the image file, but something in the image file that makes the volume parameter detection hang.

If desired i can send you the image file thru my ftp server or by some other means, but it is about 1,9 GB (it's a 2GB microSD-card)

[Alexey V. Gubin]

Sure - send me either an email (development@z-a-recovery.com), or a private message with an URL where I can fetch the image. Probably if you ZIP it, it would be little less in size, but that does not really matter.

[1ndtech]

Thanks for the quick response. The file is currently being zipped - hope your mail server takes large files (not too sure if my ftp is functional at this moment). Trying to mail the file later this evening as soon as the zip program has finished.

[Alexey V. Gubin]

There is no chance whatsoever we can get a gigabyte single file via email.
I have just sent you a forum private message with an FTP login data for our server - please upload ZIPped file there.

[Alexey V. Gubin]

Try http://www.z-a-recovery.com/zar-84-017.exe

There was a bug preventing recovery run from starting if too little of certain data was obtained during initial scan.

I made an adjustment as required, then did a test run on your image and it worked. Although I did not test the data to see if the result of the recovery itself is good or not - that would be up to you.

[1ndtech]

The hang problem is fixed - at least for my specific image. Thanks for your effort!

I have been able to recover a bunch of files with valid file names and some info seems to be readable. I'll test the results on the target system and then i'll know for sure if the recovery worked.

[Paula123]

hi , i am having a similar problem. i just downloaded the program this morning - ran it for the first time (using a card reader to recover from a compact flash photos taken on a canon eos 400d) and it hung after completing and finding 1000s file (approx) and 1 directory. i waited for about 30 minutes for it to move to the next screen (per the tutorial) and eventually hit 'back' (as i thought this better than exit). it created an auto save and then flashed to the next screen (that i was waiting for) and then went back to the original. I have repeated this a few times now and the same thing happens. the most recent time i changed the time out to 200m unclicked avoid repeated entries and the skip factor to 32, per a suggestion on this forum. this has not fixed it.

do you have any suggestions as to how i can make it work. please note that in the repeated scans, each time it finds 0 files, so it seemed to have only found files in the first original scan.

thank you in advance
paula

[Alexey V. Gubin]

Restart the machine,
then start ZAR,
on the first screen click "Advanced Configuration",
in there under "Image Recovery" set "End of file detection" to "None",
click OK to close config and retry.

see if this helps.

[smittyeh]

I am running ZAR 8.3 on my comp main drive, to recover my 1TB external hard drive. It takes approx 27 hours to run, gets to 99% of Volume Analysis and freezes. the Error i received was http://lh6.ggpht.com/_IeLnDgG529A/SpBigGl9OuI/AAAAAAAABmI/QYi0_jSKe8w/zar.jpg i have the LogFile verbose (i believe).

While it is running it shows more and more dots of data, filling up around half the hard drive (which is how full it was) so it seemed to be finding things...

Alexey do you have any suggestions?

[smittyeh]

http://lh6.ggpht.com/_IeLnDgG529A/SpBigGl9OuI/AAAAAAAABmI/QYi0_jSKe8w/zar.jpg here is my error.

[Alexey V. Gubin]

If you have a verbose log file, zip it and see if it comes down to the reasonable size. Then, email it to development@z-a-recovery.com so I can have a look at what happens.

[Alexey V. Gubin]

Try this

1. Start ZAR and proceed up to the selection of the physical disk.
2. Select your disk and click NEXT.
3. ZAR will prompt you to pick the volume. Do not select the existing volume. Instead, right click the volume list and pick "Define volume manually". The window will pop up asking for the parameters.
4. Select "The volume is defined as follows".
5. Verify the units are set to "megabytes".
6. Leave "Start location" at 0, enter "Volume size" 900000.
7. Cick OK, and the new volume will be added to the list, with the listed as "User input".
8. Select this volume and have ZAR scan it.

see if this helps. All the important data will still be captured, but if there is something at the end of the disk which causes it to hang, it will be left out.

[PG_60]

I've got another hang problem.

My 500Gb Passport Essential, WDME5000, was dropped (from a very low height) and is inaccessible. Vista cannot open and wants me to format the drive.

I bought ZAR 8.4017 and have tried running it. Used timeout 200 ms, 1 retry and 32 skip factor. The quick pre-scan completed ok, but the "Quick - Identifying Data" stage has run 11hrs 50 min so far and seems stuck on 31% since last night.

The drive was nearly full, jpegs, video files, PDFs, mp3s. But the scan map shows the drive nearly empty of data fragments. It did find quite a few bad sectors.

Should I try something new? Wait? put the drive in a new enclosure and try?

Thanks!

[Alexey V. Gubin]

If you can attach the drive directly to the desktop motherboard (the particular unit is most likely SATA so this should be pretty straightforward), this is worth a try.

Also, try making an image of the drive if you have enough free space - right click the physical disk, select "create image". This has advantages of 1) making exactly one pass over the disk and 2) stabilizing the conditions (image file cannot degrade; physically damaged drive can).

[smittyeh]

I gave this a try and came up with the same error.

Try this

1. Start ZAR and proceed up to the selection of the physical disk.
2. Select your disk and click NEXT.
3. ZAR will prompt you to pick the volume. Do not select the existing volume. Instead, right click the volume list and pick "Define volume manually". The window will pop up asking for the parameters.
4. Select "The volume is defined as follows".
5. Verify the units are set to "megabytes".
6. Leave "Start location" at 0, enter "Volume size" 900000.
7. Cick OK, and the new volume will be added to the list, with the listed as "User input".
8. Select this volume and have ZAR scan it.

see if this helps. All the important data will still be captured, but if there is something at the end of the disk which causes it to hang, it will be left out.

[Alexey V. Gubin]

I'm afraid there is nothing else I can suggest in your case, except that you mention version 8.3, maybe if you try once more with the most cuurent version as on the website (http://www.z-a-recovery.com/download.htm).