Home

Many disk drives fail in a small area, or become very slow to read. For these drives it is best to create a disk drive image as soon as possible.  The tecnique below is designed to put as little stress on the drive as possible.  However, there is always a danger that the drive could fail totally at any time.  If the data is very critical it may be the time to consider a hardware drive repairer, rather than risk this software solution.

Stage 1

The first stage is to try and establish how valid the drive is.  A very simple approach is to select the drive and use the View function to look at areas of the disk.  Can it read sectors near the start? Can it read sectors near the end?  A sector that takes a long time to display indicates it is near failure point. A sector that displays 5A 5A  5A   ZZZZZZ   has failed, and connot be read.

Stage 2

Determine the type of disk.  Main disk types are FAT (normally external drive), NTFS (main Windows disks)  and HFS+ (Macintosh).  They all have slightly different optimum ways to be imaged.

Stage 3

Set up CnW to save the disk image.  For this you will require a logical drive with enough space for a file of the length of the disk to be imaged.  Thus to save the image of a 1TB drive, you will probably require a 1.5TB NTFS drive - or a network drive with adequate space.

Stage 4

The most useful sector to image is the boot sector, sector 0.  If this sector can be read, start a full image.

Stage 5

Watch the imaging and see if it goes slowly, or lots of errors are detected.  If so, it is the time to consider cancelling and working on incremental imaging.  Slow is when it can take several minutes to increment the sector number on the screen, this normally updates every few seconds

NTFS disks

The most important first section to image is the $MFT.  For single partition disk, this will start at 0x60003F for XP and 0x600800 for Vista and Windows7/8

Mac Disks

The typical starting point is 0x64028.  This is also the area where there is often much failure on Mac disks

Fat Disks

There is no typical directory space on a FAT disk, though stage 6 may help with the root.

Stage 6

How to find where the full directory is stored.  At this point in the process it is necessary to switch between reading the physical drive and the image file.  By reading the image file no stress will be put on the drive.

Select the image file as the input and then select Recover.  An options box will be displayed that will give the start of the directory / catalog.  For NTFS and MAC there is also an option to display the directory locations.  This will be the next area to attempt to image.

Stage 7

Finding the location of files.  This will indicate what area of the disk should be imaged.  For this process to give accurate results, the disk image should be the size of the actual disk (other wise attempts to read past the end of the disk will give meaningless start sector values in the log).  To pad the file, the final area of the disk should be imaged, even just the last 10 sectors will work.  The padding may take time on a large disk.