Long analysis - is there any hope?

[dshap]

My 500GB Western Digital MyBook stopped working. Windows would recognize it but would freeze as soon as I tried to browse it in My Computer. I ran a WD Diagnostic tool on it to find out that it was failing SMART which means it has physical failures. I know my files are still there, however, because I can plug it into my Archos Personal Video Player (which has a USB host for transferring photos and what not) and view the folders/files (transferring small files to the PVP works but large files don't make it).

I removed the HDD from its external USB enclosure and plugged it directly into my motherboard via SATA cable hoping to be able to copy stuff from it but I had no luck.

I did further research and tried this linux utility called dd_rescue which tries to copy partitions off drives by raw data but it would cause the entire kernel to freeze after a few minutes.

That's when my friend told me about ZAR and so far I've had it running for 26 hours and it is at 26% of "Raw scan: Full - identifying data." I'm a little worried because in the beginning of this stage it was taking about 20 minutes per 1% progress and now it seems it has been on 26% for about 45 minutes to an hour. The reason this is taking so long is clearly because the access speed is often 0.0 - 0.2 Mb/sec and it sometimes jumps up to 5 or so for short periods. I seem to remember it going at higher speeds (~30 Mb/sec) at the previous stage.

I have several red dots on the volume map (although there are definitely more green/blue than red).

Do you think this slow access speed is because my drive has physically WEAKENED since the start of the test? Or is it possibly because it is in an area with many bad sectors and it will speed up once it gets out?

I've set retry attempts down to 0 and I have skip factor at 32.

Does anyone think I'll be able to get at least some of my files back?

Any advice/info would be greatly appreciated. Thanks!


EDIT:
I just read in another thread that if there are many red dots then I might want to disabled "avoid repeated retries" or click the "Forget Bad Sectors" button. How do I know if I should do this? I have 2 GB of RAM in my computer that is running ZAR and I currently have the read/write cache maximized (512 mb each). I really don't want to have to run ZAR again as it is taking a VERY long time and I'm pretty sure my drive is on its way out. What are the pros and cons of turning off "Avoid repeated retries" and clicking "forget bad sectors" ?

[Alexey V. Gubin]

Open Task Manager (via Ctrl+Alt+Del). Switch to "Performance" tab. If the memory usage ("Commit charge, total") reads above 1.3GB, click "Forget bad sectors". Other than that, you just wait and that's it. Alternative, if you have an approx. 500 GB spare NTFS storage, is to make an image of the disk. This takes similar time, but you are then able to work with it without risking that a drive condition deteriorates.

Speed drops as the bad block is encountered; it quickly scans through the good area, and then a bad sector (or series of) slows it down.

[dshap]

ZAR has been running for 48 hours now and it at 42% of the full raw scan. I have a brand new, 1 Tb USB Hard Drive that I can use to store an image of the drive. Would you recommend I let ZAR finish (at this rate will take probably at least 3 more days) or should I cancel it and use Zlon to make an image? If I cancel ZAR, is there any way to have it start back up from where it was at or does it need to start all over?

Thanks for the help.

[Alexey V. Gubin]

Make sure your 1TB USB drive is formatted with NTFS. This is important, as FAT will not allow to write a 500GB file.
Attach the 1TB USB drive to the machine, make sure it is ready to work.
In ZAR, click "Back" button. This brings you to the partition selection. Click "Back" again and you end up at a physical disk selection.
Right click the damaged drive, select "Create image file". It will prompt you where to store the file. Point to the new 1TB drive, enter a file name, click OK.Try not to exit ZAR before the image is written, if possible.

[dshap]

My 1 Tb drive is formatted for NTFS but my damaged drive was formatted FAT32. Is this a problem?

[Alexey V. Gubin]

No. Go ahead.

[dshap]

Clicking "BACK" does not appear to do anything except it seems that the program is not scanning anymore because it seems to be stuck at "0.9 MB/sec." Should I keep clicking back until it goes? Or should I just wait a while?

[dshap]

I should also note that it says 0% CPU in ZAR but my task manager shows that the CPU seems to be at a full load. No other programs are running.

[Alexey V. Gubin]

Do not click repeatedly. If it would not unfreeze in 15 minutes, just kill it with Task Manager, restart, go to the point when it prompts for a physical disk, and set it to create image.

[dshap]

Ok. Just to clarify, the program is not completely froze - I can still adjust the runtime controls and the "back" button seems to be clickable (animation of it being clicked) but it just doesn't do anything. I'll wait 15 minutes and then try to do an image from the beginning I guess. Do you think the image could possibly take less than the extreme amount of time this scan has taken?

[Alexey V. Gubin]

When you are dealing with bad sectors, scans taking several days are not unheard of. I'd expect imaging to be faster than a scan, but not much faster.

[dshap]

Ok it is writing the image now. Do I need to change the runtime control parameters? Right now they are at:

TImeout = 200 ms
Retry attempts = 0
Skip factors, sectors 2048
enabled avoid epeated retries
enabled force reset
512 mb read/write cache

[Alexey V. Gubin]

I'd say set skip factor to 128. Should not make things massively slower.

[Alexey V. Gubin]

And also, disable "Avoid repeated retries". When imaging, it only accesses each sector once, and hence that book-keeping is not needed.

[dshap]

Alright it took almost a week to make the image of my 500 GB drive but now it's done and I ran the analysis on it and it's finding files/directories.

Right now I'm in the "Mark Files to Recover" dialog and I see a whole bunch of stuff that doesn't mean anything. A lot of folders and files with < 1 KB with things like CHANGE.LOG and RestorePointSize and folders called "RP...". I don't need any of this, right? All I need are the things inside the folder called "ROOT", right?

Right now it is at 7% Validating and it has found 2264 files with 1844 damaged files and 8411 checked. How do I know which files are damaged? Also, if they are damaged, does that mean they are useless or could they still partially be okay? I'd understand if a program installer was damaged that it might not be useful at all but what if a video or audio file was damaged? Perhaps only part of the video/audio would be corrupted and the rest would work?

Once this validating is done, should I just try to backup/save my entire ROOT? I guess I'm just confused about the "damaged files."

Please advise. Thanks!

EDIT: Oh yeah...it found 952 GB of files in my root when the drive really only holds 500 GB...how is this possible? I read about it finding deleted files but I assumed that was if the drive had free space on it...How do I know which of the 952 GB of files I need to back up to get as much of my original 465 GB of data as possible? Thanks!

EDIT #2: Ok I figured out about the green/red icons...still would like info about the extent of damage and what I should back up or not back up and or rely on.

[Alexey V. Gubin]

CHANGE.LOG, RP whatever is a system restore point data. You do not really need it. There is a filtering in place to get rid of this stuff, but as the damage gets worse, the filtering stops working.

Damaged files can partially be okay. Also, expect up to 5% validation errors (where files is OK but still reported bad).

You can start to mark files regardless of what it validates. Validation is cancelled automatically as you leave the file/folder selection. On the other hand, if you plan on using the list of the validation results, you need to wait till it completes. The list is saved along with the files you copy.

What you do is, you select ROOT, so you have everything selected. This will exceed your available disk space. The selection size is at bottom of screen. Then go one level "deep" into the tree and remove stuff you do not recognize, starting with largest "branches". Remove until the size falls below the capacity limit.