My Hard Drive Died #10 – Listener Questions

My Hard Drive Died - Podnutz

Hosted by Steve Cherubino and Scott Moulton of MyHardDriveDied.com.

TOPICS DISCUSSED:

Now available for the very first time on Scott’s training labs DeepSpar Data Recovery Systems (Product: DeepSpar Disk Imager)

Scott Moulton at Tekzilla
MyHardDriveDied.com’s Scott Moulton talks hard drive recovery tools (Thursday, April 29th, 2010)

Email question from Stevo:

Q: Can you go into more depth exactly on how to use Victoria?

Victoria is a freeware program for low-level HDD diagnostics, supports these interfaces: IDE and Serial ATA.

Scott normally uses MHDD as a DOS version and Victoria as a Windows version.

USB connectors are horrible to do diagnostics; it uses a windows driver to communicate with the drive (not good).
It’s better to have the hard drive physically connected to the controller (motherboard) via SATA or PATA.

You could use an ESATA card (ExpressCard) on a laptop to run diagnostics on a drive as opposed to USB

Email question from Stevo:

Q: If you swap out slower sectors to the G-List (bad block list), can’t you just defrag the drive in order to get them back in line so you’re not flying all over the drive for data?

This has nothing to do with defragmentation. Defrag is more from a file aspect not a physical low level.

You can try to avoid every bad block and never use them but you don’t know what they are.

MHDD and Victoria can be used to turn off bad blocks.

Bonnie++ is a benchmark suite that is aimed at performing a number of simple tests of hard drive and file system performance.

The ZCAV program (Linux Tool) tests the performance of different zones of a hard drive. It does not write any data.

Hard drive defects table

The G-list table (Growth-LIST)
A table of hard disk sectors that have gone bad after the drive was placed in use.
It does reduce drive access speed and it may become necessary to replace the drive.

The P-list table
Bad sectors encountered during post-manufacture testing are contained within a defect table known as the P-list.
P-list sectors have no effect on drive access speed as they are automatically omitted by the drive electronics.

System Track Area:
The system track area of a hard drive is data that is written by the manufacturer and works in conjunction with the logic control circuitry.
If the system track becomes corrupted, the drive can show symptoms of physical failure on many levels.
It is an extremely complex area of the drive and often very difficult to diagnose and repair.

Email question from Stevo:
Q: What can you do with the data you get back from MHDD. What corrections can you make with the software?
Both Victoria and MHDD do the following things:
– A sector by sector analysis of your hard drive
– Remap and relocate bad sectors to a different section of the drive
– Display SMART data

Q: Is it better to clone a drive or to do a backup?
Backup normally connects the drive via a USB connector, the head trashes around across the entire disk (potential damage)
Using KNOPIXX does not read the entire drive (which is good)

NTFS Master File Table (MFT)
The Master File Table or MFT is the place where information about every file and directory on an NTFS volume is stored.
The MFT is in essence a relational database table that acts as the starting point and central management feature of an NTFS volume.

Ddrescue – Data recovery tool (Linux Utility)
Data recovery tool that copies data from one file or block device to another, trying to recover data in case of read errors.

Email question from Andrew:
Q: Not using USB interfaces, does that mean those adapters used to connect external hard drives via external USB connectors?
Using USB is not a good start for data recovery, there is no error control, it’s better to connect the drive to the motherboard instead.
Things may change with future USB 3.0 technology.

Q: Can you provide more information on MHDD and the error codes it gives back?
The forums is the best place to go for additional information on this particular utility

Shadow Copy
Is a technology included in Microsoft Windows that allows taking manual or automatic backup copies or snapshots of data.
It is implemented as a Windows service called the Volume Shadow Copy service.

DEF CON 18

Next Data Recovery Classes
San Diego May 10th-14^th
San Francisco June 14th-18^th
Atlanta July 12th-16^th
Chicago September 13th-17^th
Dallas October 11th-15^th
Washington DC December 6th-10^th

Notes by Jorge Hernandez of 123ComputerRepair.com