Checklist: Volume analysis takes too long

[Alexey V. Gubin]

Here are some estimations of the run time, from the start of scan to the point when file/folder tree is displayed.

• With a hard disk, expect about 1 gigabyte per minute. Larger disks tend to be faster than that (up to 2GB per minute).
  • 120GB HDD = two hours.
  • 300GB HDD = four hours.
• Digital image recovery (from a flash card) - expect two hours per run maximum if the read cache size is at least 64MB.

If the run is taking longer, look at the colored volume map and the analysis stage indication.

If recovering digital images and the memory card is in the camera (i.e. the camera's own connection is used)

• You need to use the card reader device. Certain camera drivers tend to choke on a damaged card. Remove the card from the camera and use the card reader device.

If the stage is listed as "Raw scan: identifying...", and there are red dots on the map: there is a physical problem with the device.

1. Without stopping the scan, in the runtime control panel
   1. set Timeout to 200 ms
   2. set retry attempts to 0
   3. enable "Avoid repeated retries"
   4. set skip factor to 8
2. Observe the progress for about fifteen minutes. If no speed boost
   1. increase skip factor to the maximum allowed
   2. enable "Force device/bus reset".
3. If this still does not improve speed, there is nothing more we can do (in software) to resolve the problem. For additional considerations refer to
   1. Physical access problems with hard disks.
   2. Physical access problems with flash memory (USB sticks, memory cards).
4. It is recommedned that you abort the scan at this point, to avoid stressing the device.

If the stage is listed other than "Raw scan", and no red dots on the map: there is a problem parsing the filesystem.

1. Check if the "Elapsed time" counter still moves. If not, close the program and report the problem.
2. Check CPU usage (with Task Manager) and disk activity.
3. Check if the log file (C:\Program Files\ZAR\logfile.txt) grows in size.
4. For additional ten minutes, observe
   1. If CPU usage is low, no disk activity, and log file does not grow - close the program and report the problem.
   2. If program seems still working on something, leave it alone for additional two hours. If still no progress - close and report.

What we need to investigate a filesystem analysis problem

1. Filesystem type (FAT/NTFS/ext).
   1. for a FAT filesystem, if it is FAT16 or FAT32 (if known).
   2. for a ext (Linux) filesystem, if it is ext2 or ext3.
2. Log file. Open the log file (C:\Program Files\ZAR\logfile.txt) and look at the end of it. Last entries in the log file record what ZAR was doing before a failure occured. Copy the last about 100 lines (important: see note below) and provide it along with the problem report.
3. Anything else you consider relevant (like the original problem description).

If the debug logging is enabled, the heartbeat entries will be recorded in the log file for each megabyte of data read. These entires look like

XXXXXXX: Local cache hit ratio: ... cache hits of 2047 requests
XXXXXXX: MEMORY STATUS: Address space: ...; Alloc: ...; Free: ...; Small: ...; Big: ...;

These entries only provide information about the memory and cache usage. In most cases, we only need an approximate number of these (how many of these were there at the end of log? 1, 10, or 100?). Scroll up until you see something other than heartbeat - this would be the useful information.

[sermolin]

trying to recover data from 8MB FLASH SD card. Volume analysis takes too long (over one hour). On the console, there are only about 25 colored dots (three green, about 20 blue and one red (the last that was colored)). The rest dots are white. The system always hangs up on the same spot - the red dot. Timeout-200ms, retry - 0, read cache-223MB, read chace- 68MB, avoid repeated retryies - ON.
What should be my next steps?
Thank you
Sergey

[Alexey V. Gubin]

Try creating an image file of the card.

[sermolin]

Ok, I created an image. Now what?

[Alexey V. Gubin]

Load the image into ZAR, scan the image. Image has all the properties of the card except it works predictably.

[rghoogas]

Originally Posted by Alexey V. Gubin

Here are some estimations of the run time, from the start of scan to the point when file/folder tree is displayed.

• With a hard disk, expect about 1 gigabyte per minute. Larger disks tend to be faster than that (up to 2GB per minute).
  • 120GB HDD = two hours.
  • 300GB HDD = four hours.
• Digital image recovery (from a flash card) - expect two hours per run maximum if the read cache size is at least 64MB.

If the run is taking longer, look at the colored volume map and the analysis stage indication.

If recovering digital images and the memory card is in the camera (i.e. the camera's own connection is used)

• You need to use the card reader device. Certain camera drivers tend to choke on a damaged card. Remove the card from the camera and use the card reader device.

If the stage is listed as "Raw scan: identifying...", and there are red dots on the map: there is a physical problem with the device.

1. Without stopping the scan, in the runtime control panel
   1. set Timeout to 200 ms
   2. set retry attempts to 0
   3. enable "Avoid repeated retries"
   4. set skip factor to 8
2. Observe the progress for about fifteen minutes. If no speed boost
   1. increase skip factor to the maximum allowed
   2. enable "Force device/bus reset".
3. If this still does not improve speed, there is nothing more we can do (in software) to resolve the problem. For additional considerations refer to
   1. Physical access problems with hard disks.
   2. Physical access problems with flash memory (USB sticks, memory cards).
4. It is recommedned that you abort the scan at this point, to avoid stressing the device.

If the stage is listed other than "Raw scan", and no red dots on the map: there is a problem parsing the filesystem.

1. Check if the "Elapsed time" counter still moves. If not, close the program and report the problem.
2. Check CPU usage (with Task Manager) and disk activity.
3. Check if the log file (C:\Program Files\ZAR\logfile.txt) grows in size.
4. For additional ten minutes, observe
   1. If CPU usage is low, no disk activity, and log file does not grow - close the program and report the problem.
   2. If program seems still working on something, leave it alone for additional two hours. If still no progress - close and report.

What we need to investigate a filesystem analysis problem

1. Filesystem type (FAT/NTFS/ext).
   1. for a FAT filesystem, if it is FAT16 or FAT32 (if known).
   2. for a ext (Linux) filesystem, if it is ext2 or ext3.
2. Log file. Open the log file (C:\Program Files\ZAR\logfile.txt) and look at the end of it. Last entries in the log file record what ZAR was doing before a failure occured. Copy the last about 100 lines (important: see note below) and provide it along with the problem report.
3. Anything else you consider relevant (like the original problem description).

If the debug logging is enabled, the heartbeat entries will be recorded in the log file for each megabyte of data read. These entires look like

XXXXXXX: Local cache hit ratio: ... cache hits of 2047 requests
XXXXXXX: MEMORY STATUS: Address space: ...; Alloc: ...; Free: ...; Small: ...; Big: ...;

These entries only provide information about the memory and cache usage. In most cases, we only need an approximate number of these (how many of these were there at the end of log? 1, 10, or 100?). Scroll up until you see something other than heartbeat - this would be the useful information.

Hello,

First, where can I post my concerns?
Second, Is the ZAR for data recovery only or I can recover applications/programs too? If not, any suggestions how?
The hard Drive is not accessible, and not booting up, so taking the current HD image maybe won't help me.
Please help.

[Alexey V. Gubin]

What kind of problem do you have?

ZAR will not recover programs for you; all the programs need to be reinstalled. ZAR is only useful for data files.