Page 1 of 2
Ugh, my boot drive crashed with no warning
Posted: Fri Oct 30, 2009 10:00 am
by DaMaN
I have a backup but it is about 3 weeks old and I need somethings that I recently have put on the drive (Monday).
Using Vista 64 Home premium & a 150GB SATA WD Raptor.
I am getting MasterBoot errors and corruption errors when I use windows to CHKDSK. Its been a long while since I have had to do something like this (repair a drive partition, I usually wipe drives clean for family / friends and reinstall.
So what is the latest and greatest utility to fix such errors?
Thanks,
David

lease:
Posted: Fri Oct 30, 2009 11:16 am
by canton_kid
I had really good luck with Diskpatch3 and Irecover from DIY.
Recently a drive got messed up by an old XP disk with no service packs install, messed up my partition and what ever else on my XP64 boot drive.
Seems that old XP did not know what large drives were and when I connected the large Sata it scrambled the partition.
Irecover seemed to find and save most my files, maybe all of them, I only checked a large handful and the ones I really needed and they all seemed fine.
Then I ran Diskpatch3 and got the drive working and bootable again, never seemed to have any data or boot problems either.
I wiped the drive and installed Win7 RC1 now though on a new format also just to be safe.
I would check out their site and forum, Both programs have demo.
Irecover demo lets you save 1 Folder so you can see if the data was correctly found, I think it also lets you save some types of files like all your pictures.
DiskPatch3 demo will save an analysis log you can upload to their forum, they will check it and let you know if it looks like the program can fix the drive and the best way to do it.
They seem to have a good guarantee for money back if you buy the programs and they can't save the data or fix the problem.
Posted: Fri Oct 30, 2009 12:44 pm
by FlyingPenguin
DO NOT run chkdsk or anything else that repairs the file or partition structure (sounds like it may be too late)!!!! The problem is almost certainly bad sectors and trying to repair file and partition errors on top of a bad sector is just asking to corrupt the entire partition.
Get yourself a copy of Spinrite, run level 2 for a quick recovery to just get the drive in a condition that you can copy the data off it. Be aware that this could take anywhere from 30 minutes to 30 hours. Do it on a PC you can afford to have side-lined for a while.
Whether or not Spinrite detects a bad sector, it will still have refreshed all the sectors and if the problem was a weak sector recording (as it often is) you may have fixed it. Even if Spinrite finds an unrecoverable bad block it will likely do enough of a partial recovery of the block to allow the files to be copied, but you still have to fix the file structure.
AFTER running Spinrite run CHKDSK /F on the partition to repair the file and partition structure. After that, see if you can see your data on the drive and if so, then copy it quickly while you can before the drive deteriorates again.
Now that you have your data copied you can see if the the drive is salvageable. Run Spinrite again on Level 4 to fully restore the drive. This will take much longer than a level 2. If Spinrite does not detect any unrecoverable or bad blocks then you probably got lucky and the drive just had soft sector damage. You might be able to boot it right back up and continue using it. HOWEVER I would watch the drive carefully and not fully trust it until it's proven itself. If the drive is under warranty, I would RMA it just to play safe.
Hope this helps...
Posted: Fri Oct 30, 2009 1:06 pm
by Nomad
Just watched a TechTV video with the creator of Spinrite. Some very cool stuff. I never had heard of this one. I will be grabbing a copy just to have it in my repertoire of utilities when their need arises.
Posted: Fri Oct 30, 2009 1:47 pm
by DaMaN
Thanks FP & Canton
Posted: Fri Oct 30, 2009 2:07 pm
by Executioner
Spinrite is excellent. I've used it several times to fix my boot drive. I never run any other utilities until Spinrite is run first. It has never failed me, and always works.
Posted: Fri Oct 30, 2009 5:08 pm
by FlyingPenguin
This probably warrants a bit of an explanation of how Spinrite works, because there's a lot of misconception. I've been meaning to type something like this for a while:
Spinrite costs $89 and there's no trial ware. They do give you a no questions asked refund if you feel the product didn't work for you, however. Trust me, just about everyone on this forum should own a copy just to bail yourself or a family member out of trouble in an emergency. Yes you can find it on torrents, and to be honest I used a torrents version for a long time until I realized how useful it was and that they deserved their money.
First off Spinrite is a DOS app. It's VERY small (it's written in assembler - a dying art). The whole program is a mere 170K. When you buy it you get an installer EXE that will create a bootable floppy or an ISO for a bootable CD. It also claims to be able to make a bootable USB flash drive, but I've never had any luck with that.
You can't run Spinrite from Windows unless you get VERY creative (I've heard of people creating a VMWare VM with Spinrite setup as a virtual CD-Rom ISO and by configuring VMWare to assign the drive you want to repair to the VM, but that's pretty techie and unreliable).
Anyway, since Spinrite runs from a DOS boot disc, the machine you'll be running Spinrite on will be unavailable for anything else while it's running and Spinrite can take several hours or even days depending on the hard drive's condition. My 750gb work bench hard drive takes 20+ hours to scan at level 4 for instance when I do it every 6 months for maintenance. The good thing is you can stop the process anytime and Spinrite gives you a percentage of the partition completed. You can restart Spinrite later and override the default start sector by entering that percentage number and Spinrite will continue from where it left off.
This is how it works: ALL hard drives today are so dense that they do on the fly error correction constantly. If you install a SMART utility that shows you the number of errors your drive has logged (Spinrite does this as well) you would be shocked.
Even though the data stored on the HDD is in binary, the recordings that the data is stored in on the hard drive platter are actually analog signals and they can be made weaker by the magnetic field of adjacent sectors encroaching on them (especially during write operations with sectors being packed so densely and if there's some slack in the head actuator). If the analog signal is made weak enough, then the drive may no longer reliably read the data from that sector and that's when you start getting read errors and Windows does a little pause as the drive has to repeatedly read the sector several times until it either succeeds or fails (and you'll see read errors in the Windows Event Log under "System" which is an early indicator of HDD problems).
The hard drive's onboard error correction system (a small onboard computer) is constantly refreshing weak sectors or swapping out bad sectors as it detects them. The drive's firmware uses some fancy algorithms (unique to each manufacturer) to check for bad sectors but basically the drive is never made aware of a bad sector unless it senses a problem when it reads or writes data to or from that sector and those problems trigger a threshold setting. It's very possible for a sector to get progressively worse and the drive never take notice of it until it's too late because that sector is not read often enough to trip the threshold for the error correction system to take notice (the sector gets "stale").
All Spinrite does is force the hard drive's error correction computer to do a read check of every single sector (Level 2 scan) or, more aggressively, force a refresh of every single sector: read it, write it back with all the binary data inverted, read it again, invert it to the original and write it back again. This is a Level 4 scan which is why a level 4 takes so much longer than a 2 but it will force all sectors to be freshly re-written at full strength.
At this point Spinrite itself is not doing any repairing - it's just forcing the drive's own error correction system to minutely examine each sector and look for problems.
Level 2 is for data recovery - to get the drive into some kind of readable condition (even if it's dying) so that you can at least copy some data off of it. It just reads each sector forcing the drive's error correction system to see errors and fix them automatically.
Level 4 is more aggressive and mainly intended for maintenance or to refresh a very stale drive, or to rejuvenate a drive with soft sector errors (no real physical damage, just badly demagnetized sectors).
So far, though, Spinrite (level 2 anyway) is doing nothing you couldn't do my yourself with a chkdsk /r (a sector scan), and this is why sometimes you run Spinrite and it seems to detect nothing wrong (no bad blocks or unrecoverable sectors displayed on the map), but when you try to boot the drive it's been fixed. Most of the time Spinrite itself never performs the repair itself, it just forced the drive's error correction system to see the errors and repair them.
However Spinrite does something that's rather unique among sector scanners. Normally if a the hard drive's error correction system detects an unrecoverable sector, it marks the sector bad and throws it out - you lose all the data in the sector, and sectors in large modern drives are VERY large. If most of that sector is part of some unimportant files like JPG files then it doesn't matter. However if that sector happens to be part of the file or partition structure then it could be a REAL disaster (and this is why you should never perform a chkdsk before a Spinrite scan otherwise you're making the disk operating system try to make repairs with corrupt data from a damaged sector).
When Spinrite detects an unrecoverable bad sector, however, it overrides the hard drive's normal error correction system and does it's own special thing. You'll see this goofy oscilloscope animation come up on the screen when this happens which is called "Dynastat" mode. What Spinrite tries to do is reconstruct most of the sector, unlike the drive error correction system which just throws out the whole sector. Spinrite will attempt to read the sector 2000 times using different tricks which forces the head to approach the sector at different velocities in the hope that (due to slack in the mechanism) sometimes the head will get a stronger signal of the analog recording than others. After reading it 2000 times it will do some statistical analysis and reconstruct as much of the sector as possible. Often you get back everything but a couple of bytes from that sector and that is often enough to make the data readable - even if it's partition info.
I've seen this many times myself. I've had drives with corrupt partitions that are reported "unknown" and that can't be read, but after Spinrite gets through with it, the partition is readable again.
Dynastat can take a REALLY LONG time. It can take several minutes to read a bad sector 2000 times. I've seen sectors so bad that they took an hour to read. In rare cases if you have several really bad sectors then the drive may take DAYS to repair. Gibson reported on his Security Now podcast one time that someone wrote him to say they had a drive that took A MONTH to scan and it was actually readable after that (it was totally unreadable before).
Now there are several restrictions to the use of Spinrite which aren't fully documented on the site:
- If the data on the drive is irreplaceable, you should ALWAYS try to copy the data FIRST before using Spinrite if at all possible. Sometimes you get a drive that may not boot but you can still see the data on it and copy it. Maybe some of the files will give you a CRC error during copy and fail, but get whatever you can from it first BEFORE working on the drive. The process of trying to repair the drive can itself be destructive. A sector scan puts a lot of wear and tear on a drive and if the drive is very close to total failure, just running Spinrite on it may push it over the edge. Spinrite (assuming it can access the SMART data from the drive) will even warn you if it thinks the drive is too far gone to be likely to survive a scan.
- Spinrite does not care how the drive is formatted. It never looks at the partition or files. It's working at the "bare metal" level of the drive dealing only with sectors. This is below the level of partition structure, files or operating system. Thus the drive can be from anything: A Linux install, A Mac, a Tivo, an XBox, a PS3, from an MP3 player. Doesn't matter. As long as you can connect it to a PC capable of booting Spinrite, it will work (you can't boot Spinrite on a Mac but you can connect the Mac's drive to another PC that can boot Spinrite).
- You ALWAYS want to try to connect the hard drive DIRECTLY to an onboard controller - preferably an IDE controller or a SATA controller in IDE emulation mode. Spinrite often can't see a drive on a SATA controller in AHCI mode so you just go into BIOS and change it to IDE emulation and then after running Spinrite, switch it back to AHCI (otherwise Windows won't boot). Even in IDE mode, Spinrite will not recognize drives on some controllers (I've had issues with some recent Dell PCs). This is why I have a bench PC specifically for this kind of work. It has two removable drive trays (one for SAT and one for IDE) and the controller is recognized by Spinrite. Most of the time when I work on a client's PC I bring it home anyway so I usually pull the drive and put it in my bench PC because I know it's a fast PC and fully compatible with all my utilities.
- Spinrite will work on USB external drives BUT is not recommended because it will not be able to perform the advanced Dynastat recovery. All it can do is just force the drive's own CRC checking to examine each sector. This is because the USB interface does not allow communication with the hard drive's onboard computer. You will also usually not get SMART data on a USB drive so Spinrite won't be able to tell if the drive is in too bad a condition for a scan and it can't detect if the drive is overheating which can happen sometimes during a scan (especially on laptop drives). When that happens Spinrite pauses the scan to let the drive cool down. Running Spinrite on a USB drive will also be VERY slow since DOS only supports USB 1.1 speeds not USB 2.0. So for all these reasons you should always take the drive out of the enclosure and connect it directly to the onboard controller in the PC. The trouble is that most retail USB drives can't easily be opened anymore without damaging the case or at least obviously voiding the warranty, which is why I usually buy my own drives and enclosures separately for myself and my clients. That way I can easily pull the drive out for maintenance and/or replacement.
- You CANNOT run Spinrite (or any sector utility for that matter) on a RAID array. If you think about it you'll understand why. Spinrite works at the BIOS level. BIOS sees a RAID array as a single drive and it never sees the underlying array. The drive that BIOS sees is a "virtualized" drive with no real existence or structure. Running a sector scan of any kind on a RAID array does absolutely nothing to the actual drives. You need to pull the individual drives and connect them to a regular non-RAID controller and have Spinrite scan each one individually. As mentioned above, Spinrite doesn't care what's on the drive so it doesn't matter if those drives are part of a RAID array. Spinrite fixes the sectors underlying the RAID information on top of it.
- You must NEVER run Spinrite (or ANY sector utility) on a solid state hard drive or flash drive. YOU WILL BURN IT OUT. SSD's and flash drives have a limited number of write cycles. Running a sector scan on one will use up a LOT of those write cycles prematurely ending it's life, and will do NOTHING for the drive anyway since there are no magnetic platters containing sectors to repair on them. You should only run Spinrite on a drive that contains an actual spinning platter.
- While I know of techs that will Spinrite a drive and give the PC back to the client and tell them it's good to go, I personally would never fully trust a hard drive that's failed and required Spinrite to fix it. Any drive that has actual physical damage (bad or unrecoverable blocks on the drive map in Spinrite) is probably dying and will only get worse in time. It may work for a few months, but it probably won't last long. Bad blocks are usually physical damage to the platter (head strikes) and once that happens the inside of the drive is contaminated by debris scrapped off the platter during the head strike. That debris will eventually get jammed between the head and the platter and cause even more damage stirring up even more debris, and so on ad nauseam. If the drive is under warranty it should be RMA'd. If not I would toss it. Now a drive with "soft" damage (no bad or unrecoverable blocks) might be good as new after Spinrite but I still wouldn't totally trust it. I would RMA it if it's under warranty. If not then don't trust it with anything irreplaceable until it's proven itself for a while. You have no way of knowing if that drive has a lot of slop in the armature and maybe it'll be full of soft errors again in a month.
- Spinrite CANNOT work on a hard drive that BIOS cannot detect. If the drive can't spin up, if BIOS can't detect it, if BIOS times out or locks up trying to initialize the drive, or if you have the dreaded "click of death" these are all mechanical or electronic issues and not sector damage and Spinrite cannot do anything. Sometimes you can coax a drive like this to work for a few minutes by repeatedly powering it on and off (I use a USB interface for this) and copy a few files off it at a time before it locks up. If it's mission critical data then your only choice is to send it to a data recovery lab and expect to pay over $800. If you have nothing to lose and can't afford the recovery lab fee, then in desperation you can try the freezer trick, but don't hold your breath. The freezer trick usually only works when you have a component that's sticking, like a bad bearing). The freezing can briefly make the bad part shrink a bit and allow it to work for a few seconds. Don't hold your breath though.
Spinrite's primary use (for me) is to recover data. Often I'll get a client's PC with a badly damaged drive that's unbootable. I'll try to run Spinrite 2 on it first and very often it recovers the drive enough that I can image the drive to a new drive saving myself some time and the client some money, instead of having to perform a fresh OS install. otherwise it may make the difference between getting no or some data, and all the data off the drive.
The secondary use for Spinrite (and the one that's often neglected) is preventative maintenance,although I admit this can be time consuming. The proactive approach is to run Spinrite level 4 on any mission critical drive on a regular basis just to strengthen the recording of any sectors that are are getting weak - long before they become unreadable. I would recommend at least once a year. I personally run Spinrite level 4 on my own computers once every 6 - 8 months, or whenever I do any major work on a PC. For instance I had to replace a bad CD-Rom in one of my media Center PCs the other day, so while I had it on the bench I went ahead and did a Level 4 scan on it since I don't do it regularly on the MCE systems. The workstation, laptop and work bench PC get scanned every 6 months like clockwork. Been doing that for years now and I have not personally had a hard drive failure since I started that. Doesn't mean I can't have a bearing or armature fail, but at least I've had no data losses.
Weak sectors will SLOW DOWN your hard drive access times. It's amazing how a modern drive can continue to run with REALLY weak sectors. You don't realize how bad it is until you look at the error correction stats in the SMART data. If the drive is spending 5% of it's time dealing with weak sectors that need to be read more than one time, that will cost you on read time performance. I've often sat down at a very slow client's PC, and found that the reason it's so slow is that the drive is constantly getting timeouts from the hard drive and the error log is full of hard disk read errors. In many of these cases the drive just had soft errors.
Posted: Fri Oct 30, 2009 6:01 pm
by Err
Great write up FP. You should copy it into a new thread and sticky it.
Posted: Sat Oct 31, 2009 12:14 am
by DaMaN
Err wrote:Great write up FP. You should copy it into a new thread and sticky it.
Agreed alot to learn from that post, thanks again.

mile
Posted: Sat Oct 31, 2009 3:26 am
by canton_kid
Wow. Love that write up.
I have Spinrite also but never knew THAT MUCH about it before

mile
I had also ran Spinrite on my drive I mentioned in my post. Although it made sure the drive was fine, my problem was an old XP changed the partition and it showed as unformatted in everything after.
Refreshing the drive refreshed the wrong partition info XP had set so it still was lost though working fine.
Irecover found the files on the drive for a backup save.
DiskPatch3 found and repaired the correct NTFS partition and also refreshed the MBR area.
I have all 3 programs and like them all, they seem to do good job in drives in various ways and handy to have.
I hadn't been running Spinrite level 4 but that is a good idea and I think I will start doing it also.
Posted: Sat Oct 31, 2009 8:36 am
by FlyingPenguin
That's all been hard won info over the years. There's no manual for Spinrite and the FAQ really doesn't tell you anything but the basics. A lot of that is from personal experience and detailed explanations that Steve Gibson has given on the Security Now podcast.
I know of IT departments that do a Spinrite 2 on every new drive just to certify it. A little tedious but if you're going through hundreds of drives with an expected number of bad drives from the factory, I guess it's a good way to weed them out. Any drive with any kind of error new out of the box should be rejected.
The problem they're going to run into with Spinrite is that it really doesn't like some modern controllers. I run into that a fair amount lately, which is why I mainly use my own bench PC for Spinrite jobs. I'm not sure there's any real fix for that other than bloating it up with a few dozen SATA DOS drivers.
Posted: Sat Oct 31, 2009 9:46 am
by wvjohn
great post Obi-Wan-Penguini!
It's saved me a couple of times, but just figured it was voodoo.
Posted: Sat Oct 31, 2009 10:51 am
by DaMaN
Awesome stuff FP, just an update, I bought the program last night, made an ISO and am running a lvl 2 on the WD 150GB Raptor drive now. It currently shows I have 13hrs to go and already has 2 unrecoverable items

. I am going to let it finish and then put the drive in an enclosure and pull all my needed data then I'll run a lvl 4 like FP suggests to see what happens for giggles because then I am going to format it (write 0's to it) regardless to the outcome of the lvl4 then RMA it. I am going to buy the new WD 2TB Black drive with 64MB Cache and it is supposed to be at velociraptor speed with the 2TB space(Articles I have read in Maximum PC Magazine). When I get the RMA back I'll use it elsewhere in my house in another PC in a non mission critical machine or sell it / trade it for something else I need. Hardware failure is an awesome excuse for HD upgrades.
I'll be sure to maintenance my drive 2X year with this program, it is awesome and worth every penny.
Posted: Sat Oct 31, 2009 12:01 pm
by DaMaN
Well, Spinrite just stopped and stalled for 35-40 minutes straight. Popped the drive into an enclosure and I cannot read it at all.Oh well I'll go forward and RMA the sucker and reformat a fresh OS Install. I was over due anyways.
Posted: Sat Oct 31, 2009 12:56 pm
by Executioner
Spinrite will do that - just stop and it can be for up to one hour. I had the same issue with my Raptor, but I just walked away and when coming back to the pc several hours later, it was trying to recover a bad sector.