Home

Very often a drive will partially work, or work very slowly.  Thus areas of the drive will read, and others may have failed, or read extremely slowly. The solution is to use incremental imaging as described below.

A problem with a drive that has failed sectors is that attempts to read the physical drive are exteremly slow.  It could take days or weeks to read, or attempt to read all the sectors on such a drive.  It is a commonly seen problem for 2.5" drive to read very slowly, often due to head wear. However, often the drive does read valid sectors after many retries.

The solution to the above speed problem is described below.  It is fairly complex and does require some knowledge of disks, but can be a great help in recoverying data in hours rather than weeks.

A key point to note when using an image file for a disk is that sectors can be missing, but every sector must be in the correct location. This means that failed sectors can be padded. When an image file is created, the user can select the start location, and the end location (in sectors) that are to be imaged from the drive. These sectors are then added to the image file in the corect location.  If the sectors to be added are after the end of an existing image file, the file will be padded and then the sectors added.  An example of this is there could be an image file of the first 1,000,000 sectors  (500MB).  If is the  required to add an NTFS directory (MFT file) a typical location would be 0x60003F, or 6,291,519.  Thus a read starting at 6,291,519 and ending 7,000,000 would read in the MFT file (assuminmg it is not fragmented and the data between 1 and 6MB would be padded.

How to determine where to read on a disk

Tnere are several stages that should be followed to determine where a difficult to read disk should be imaged. It does also depend on the type of operating system and type of disk. The instructions below give guide lines for different operating systems.

One the steps below the user will typically be swapping between the physical disk, and the image file

NTFS

NTFS is probably one of the easier types of disk to recover in this fragmented mode as the main directory is stored in the MFT file which is often a long, unfragmented file.  CnW Recovery can also recover files with the necessity of using the Index files.

1. The first stage is to determine the location of the MFT.  As long as the boot sector can be read then an indication of the start of the NTFS partition will be seen.  For a single partition drive this is often sector 63 (0x3f).  This sector will then indicate the location of the MFT.  So stage one is to read the boot sector (sector 0) and the first few sectors at the start of the partition.
2. The second stage is to run the Recover function (using the image file) and then see the location of start of the MFT.  One then needs to image from the start of the MFT for it's possible length.  Each entry is 1024 bytes long, so normally 2 sectors.  Therefore, if the MFT entries field looks valid, one will need to read twice the  number of sectors
3. The third stage is to determine where the files for recovery are. This is done using the recover function, and Recover from File entries.  Make sure that you select the 'Select Files' function.  At this point the program will scan the disk for all files and most importantly create a log entry. The log can then be used to determine where a specific file is stored, or a group of required files is stored.  It maybe that required files are stored in the 30GB area.  This region of the disk can then be imaged.
4. The final stage is to repeat stage 3, but this time, one the directory has been display, select the files to be recovered, and recover them.

The adavantage of using the above sequence is that a failing sector is only read once, and all sectors in the image file will be read at high speed, irrespective of whether the sector is good or bad. An image may then be built up to contain just the areas of required files.  A real life example of this technique was a 60GB disk that imaged upto about 30 GB, and then went very slow.  By using stage 3 above, it was possible to determine that only a few areas beyond 30Gb were required and these could be targetted, and large areas safely omitted.

FAT

On a FAT disk, directories are stored in all areas of the disk.  This has the advantage that a failure of one area of the disk will not necessarilly kill the complete directory and file information, as could happen with NTFS, or HFS+.  It does make looking for directory areas much harder.

MAC

As with NTFS, the MAC HFS+ does store directory entries in a file and the recover options menu will give locations of this catalog file.  The important part is to recover enough of the data at the start of the disk to display the catalog file