Bad Sector Errors
Data recovery - bad sectors
Data recovery from hard drives with bad sectors requires expert handling. Bad sectors can lead to a drive completely failing as the drive attempts to read and over-read individual or groups of bad sectors.
What is a bad sector?
A bad sector is a tiny amount of data that can not be read. In modern hard disk drives it is 512 bytes - the maximum amount of data that can be stored within a single sector of a hard disk. What happens is that when it fails, one of two states are encountered.
- The bad sector is 'hard'
This means that the sector is physically damaged due to a head crash, or it has completely lost it magnetic flux meaning that it is in a fixed magnetic state which can not be reversed.
- The bad sector is 'soft'
This term is where the correction codes on a sector do not match exactly what is found in the sector. At the end of each sector there are some extra bytes that are inaccessible to the user. These extra bytes contain information about the sector and most importantly it Error Correction Codes (ECC). These codes indicate to the host that the ECC code generated when the data is read into the drive's buffer memory matches the codes stored on the disk. If there is an error, then the data is attempted to be read again.
For data recovery purposes, it is vital to be able to differentiate between failure modes. The drive will have a different value in it's error register according to the failure type. A lot of imaging software does not differentiate - particularly windows based imaging software, and will attempt to re-read the sector - even if it doesn't exist anymore. This can cause serious problems, especially if the drive has suffered a head crash in this area, attempts to continuously read the sector can result in further damage to the platters meaning that the drive will either need a head stack replacement or it becomes unrecoverable as the extent of the damage increases.
It only takes a single bit of data in the sector to be bad in order for the whole sector to be flagged or mapped out. The reason for this is that the minimum amount of data that can be read from a drive is 512 bytes
What happens once a bad sector is found?
Depending on the hard disk and how it handles bad sectors, when a hard drive comes across a bad sector, it is recorded in a table stored in the firmware zone of the hard disk drive (typically this table is known as a g-list or a grown defect list) and a spare sector is used to replace the bad one. The drawback here, is that if that bad sector was in the middle of a critical file, then chances are that file will no longer open, will appear corrupt, or if it was a system file, then the computer may not even start. When the number of bad sectors exceed the spare sector pool the drive will eventually fail completely or run very sluggishly.
How is data recovered from drives with bad sectors
First we have to image the drive in such a way as to get at the existing data. This is done using specialist equipment that does not use a standard computer BIOS to read the drive. Some BIOS request the sector, if there is an error it resends the request and the drive attempts to re-read the sector. For data recovery, this is not acceptable, we do not want to attempt overreads, especially if the bad sectors are caused by a minor head crash
As a further safeguard, we turn off the SMART monitoring software built in to the drive to avoid any built-in sector reallocation methods.
The hardware uses advanced techniques that read the drive, completely ignoring any bad sectors. Once this stage is complete, we then attempt a single over-read of the bad sectors.
The next stage is to test the critical data using the clone drive on a live system. The imaging equipment we use creates a map of which files are stored where and if there are any bad sectors found within those files. If it is the case that the critical data contains bad sectors, we then use specialist proprietary hardware to access the firmware zone of the hard disk so we can examine the g-list and SMART logs of the drive and determine if they contain references to the sectors containing the critical files. If we find this to be the case, we then remove the marked sectors from the g-list and attempt to overread the specific sector(s) within that file - bearing in mind that sector reallocation is now turned off, we are only reading sectors that were previously part of the file.
As there may only be a single bit that is 'bad' within a bad sector we know that by reading the data ignoring ECC errors, we can get back the majority of the original data.
The final stage is to attempt to read the sectors containing the bad bit(s) again repeatedly until we can get an average response to calculate the probable data values of the errant bits. We then reconstitute the entire sector as best as possible and recover the data.
Recovering data from bad sectors sounds fast and easy, but it is neither. Over-reading bad sectors is the 'last resort' for this type of problem so all other avenues are explored first to get the maximum amount of data. Also, considering it can take from 30 seconds to 2 minutes to over-read a bad sector with any certainty of good data, for drives with multiple bad sectors it can take days or even weeks to complete the whole process.
It is the last stage that is the most destructive, as it attempts to read and read again the final bad sectors. However, we know that we already retrieved as much data as is physically possible before this final option is used.
For more information, please go to our main data recovery website at http://www.mjmdatarecovery.co.uk/
|