Mechanical versus software problems

Mechanical (physical) damage

Hard drives are classified as a "mechanical type of thing", because they have moving parts. Hence, they are prone to the corresponding class of "mechanical problems". Typical symptoms associated with a mechanical failure of the hard drive are

  • Repeated loud clicking sounds.
  • Sound of the drive spinning up and down continuously.
  • Warning messages based on the S.M.A.R.T. diagnostics.

In case of the mechanical damage, keep in mind that just trying to read data from the drive puts a certain stress upon the drive and can thus worsen the damage to the drive. If the data is really important, consider sending the drive into the lab for recovery without even trying to recover data yourself.

A cheaper option is to make a sector-by-sector copy of the entire drive (or whatever parts of it are still readable). Such a copy is called the "image of the drive", and the file containing the copy is called the "image file" or "disk image file". The file size is equal to the capacity of the drive. Once the image is created, the recovery is then performed using the image, rather than the actual physically damaged drive. This reduces the risk of further damage to the data.

Our data recovery software, ZAR, has a built-in disk imaging function. Download ZAR, install it, and you can right-click any disk or volume and save an image of it to a file. The resulting image file is a plain sector-by-sector copy and it is accepted by most of the data recovery utilities available. ZAR would also handle bad sectors better than most of the others, especially if you configure the timeouts properly.

Software-related (logical) damage

In this case, the data is perfectly readable but makes no sense. Logical damage can result from

  • Operator errors, like deleting a wrong file by mistake.
  • Bugs in programs, e.g. a filesystem or a disk driver malfunction can corrupt the filesystem contents.
  • Computer viruses or other malware destroying data either intentionally or due to the programming bugs.

During the recovery one tries to rebuild the missing part of the information relying on the filesystem redundancy. This may or may be not successful depending on the extent of the damage.

Determining a physical damage from a software damage

In some cases, mechanical nature of the problem would be obvious. You drop the external drive on the carpet floor. Or, the system clicks and hangs while you work; you power cycle it, and it just goes "bang, bang" instead of starting Windows.

In other cases, the cause and effect of the software damage are obvious (as in "Oops, I have just formatted the wrong volume.").

In yet another cases, the cause for the trouble is not readily apparent. You plug the external drive in, and it is not readable. Or you turn the system on in the morning, but it won't start properly. If this is the case, take the appropriate steps to determine the nature of the problem. Consider

  • Running CHKDSK in read-only mode (without the /F switch)
  • Using Microsoft Windows Memory Diagnostics tool to confirm the system memory is functional if the system does not start properly.

Using the hard drive diagnostic tool, either S.M.A.R.T.-based, like HDDlife, or the tool provided by your hard drive vendor. You need to be careful with vendor-provided diagnostic tools because some tests used in them destroy all the data on the disk during testing. Always read all the warning messages.

Cabling and connectors

Movement (e.g. during transportation) can cause connectors to become loose, especially if they were not seated properly when the system was assembled.

This may cause devices to disappear, or the system may refuse to start. For example, if you disconnect the power cable from the IDE drive, but leave the data cable in, you get the black screen upon startup with certain motherboard models.

Open the case and inspect all the connections to see if something hangs loose. If nothing is obviously wrong, remove and then reseat all the connectors one by one. Avoid removing more than one connector at a time because you want them back exactly as they were when you started.

Mixed cases

If you pull the plug on the external drive while the drive still did not complete its buffered writes, and by bad luck it falls down on the carpet, you get a mixed case. There are now bad sectors on the drive, and also there is a problem with a filesystem structure because buffered writes were not completed as they are supposed to.

In mixed cases, go for a hardware part of the problem first. Typically, you need to create an image of the disk to ensure it would not degrade, and then try to work out the logical-level filesystem issues using the image file.

Continue to Common data recovery scenarios.