Windows Drive 'SuperBlock' Read/Write Error

DJNedly · 07-11-2016, 07:23 PM

I am working on a clients computer - wont power on. Assumed a motherboard problem after testing normal components. Removed drive to recover data. In my Linux system it will not mount, has no partitions, and is being listed as a 'superblock'.

I checked the SMART with a utility and it says it is fine.

If I try to run dd to make an image of the drive I get a read/write error.

Cannot mount the drive.

I am in Debian Linux, and the drive itself had Windows on it.

Any suggestions?

Emerson · 07-11-2016, 07:36 PM

Did you run SMART test?

rknichols · 07-11-2016, 07:43 PM

SMART won't consider a drive to be bad just because it has a few bad sectors. You can post the full output from "smartctl -A" (please wrap it in [CODE]...[/CODE] tags to preserve formatting), but it will presumably show some Current_Pending_Sectors (attribute 197). To image the drive you will need to use ddrescue, which will handle errors intelligently and make a best effort to recover bad sectors.

DJNedly · 07-11-2016, 08:17 PM

I did run SMART but I however did not get the full output. I will work on getting that up. I just tried ddrescue, it constantly reads:

dd_rescue: (warning): read /dev/sdb (653256.ok): input/output error!
Bad block reading /dev/sdb: 163314

DJNedly · 07-11-2016, 08:20 PM

Output of smartctl -A

Code:

=== START OF READ SMART DATA SECTION ===
SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000b   100   100   062    Pre-fail  Always       -       0
  2 Throughput_Performance  0x0005   100   100   040    Pre-fail  Offline      -       0
  3 Spin_Up_Time            0x0007   150   150   033    Pre-fail  Always       -       2
  4 Start_Stop_Count        0x0012   095   095   000    Old_age   Always       -       8202
  5 Reallocated_Sector_Ct   0x0033   100   100   005    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000b   100   100   067    Pre-fail  Always       -       0
  8 Seek_Time_Performance   0x0005   100   100   040    Pre-fail  Offline      -       0
  9 Power_On_Hours          0x0012   079   079   000    Old_age   Always       -       9527
 10 Spin_Retry_Count        0x0013   100   100   060    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   095   095   000    Old_age   Always       -       8094
191 G-Sense_Error_Rate      0x000a   100   100   000    Old_age   Always       -       0
192 Power-Off_Retract_Count 0x0032   099   099   000    Old_age   Always       -       245
193 Load_Cycle_Count        0x0012   093   093   000    Old_age   Always       -       71794
194 Temperature_Celsius     0x0002   189   189   000    Old_age   Always       -       29 (Min/Max -4/44)
196 Reallocated_Event_Count 0x0032   100   100   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0022   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0008   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x000a   200   200   000    Old_age   Always       -       0
223 Load_Retry_Count        0x000a   100   100   000    Old_age   Always       -       0

LukeRFI · 07-12-2016, 07:12 AM

What is the full model of the hard drive? Is it fully detecting with the correct model, serial and capacity? If my suspicions are correct, this is likely an issue that is best handled by a data recovery professional.

Emerson · 07-12-2016, 07:24 AM

Quote:

Originally Posted by DJNedly

Output of smartctl -A

Code:

=== START OF READ SMART DATA SECTION ===
SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000b   100   100   062    Pre-fail  Always       -       0
  2 Throughput_Performance  0x0005   100   100   040    Pre-fail  Offline      -       0
  3 Spin_Up_Time            0x0007   150   150   033    Pre-fail  Always       -       2
  4 Start_Stop_Count        0x0012   095   095   000    Old_age   Always       -       8202
  5 Reallocated_Sector_Ct   0x0033   100   100   005    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000b   100   100   067    Pre-fail  Always       -       0
  8 Seek_Time_Performance   0x0005   100   100   040    Pre-fail  Offline      -       0
  9 Power_On_Hours          0x0012   079   079   000    Old_age   Always       -       9527
 10 Spin_Retry_Count        0x0013   100   100   060    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   095   095   000    Old_age   Always       -       8094
191 G-Sense_Error_Rate      0x000a   100   100   000    Old_age   Always       -       0
192 Power-Off_Retract_Count 0x0032   099   099   000    Old_age   Always       -       245
193 Load_Cycle_Count        0x0012   093   093   000    Old_age   Always       -       71794
194 Temperature_Celsius     0x0002   189   189   000    Old_age   Always       -       29 (Min/Max -4/44)
196 Reallocated_Event_Count 0x0032   100   100   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0022   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0008   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x000a   200   200   000    Old_age   Always       -       0
223 Load_Retry_Count        0x000a   100   100   000    Old_age   Always       -       0

This output looks fine, it may change however after running SMART test.

LukeRFI · 07-12-2016, 07:50 AM

Quote:

Originally Posted by Emerson

This output looks fine, it may change however after running SMART test.

What is the objective of the OP? To test the drive or to recover the data from it? If you test the drive, which seems to be showing signs of failure and it comes back as being bad, are you any further ahead in getting the data off? No. It is more likely that if the drive is failing, the more the drive is powered on and tested, the more damage is being caused to the point of absolutely not chance of recovery. If the objective is to get the data off, the best thing to do is to clone the drive with gnu ddrescue. However, the read/write errors suggest that imaging the drive is not possible without fixing the underlying issues.

Once I know the full model of the drive, I will be better able to advise on what I think the root cause is. Either way, I'm quite positive that this is not a DIY recovery. It might still be a simple recovery for a data recovery professional with the right equipment, assuming that the data is worth a few hundred bucks.

rknichols · 07-12-2016, 09:35 AM

Quote:

Originally Posted by DJNedly

Output of smartctl -A

Code:

=== START OF READ SMART DATA SECTION ===
SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  5 Reallocated_Sector_Ct   0x0033   100   100   005    Pre-fail  Always       -       0
196 Reallocated_Event_Count 0x0032   100   100   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0022   100   100   000    Old_age   Always       -       0

Very interesting. The drive is not showing any bad sectors at all. It would seem that the I/O errors are a problem with the interface and not with the disk itself. There should be some sysem error messages logged at the time of those events. What are they? ("journalctl -n 20" or "tail -20 /var/log/messages").

Emerson · 07-12-2016, 10:24 AM

Interface errors usually show up on 199 UDMA_CRC_Error_Count, but there is none. I agree with LukeFRI it is not the time to run tests on it, however it would be interesting to see how far it gets with the long test and if reallocated count is still 0 after that.

rknichols · 07-12-2016, 10:54 AM

Quote:

Originally Posted by Emerson

Interface errors usually show up on 199 UDMA_CRC_Error_Count, but there is none.

Whether the drive sees it or not, something is causing the OS to report an I/O error. We need details of the error report in order to assess what is going on. All indications are that the drive is fine internally.

DJNedly · 07-12-2016, 02:12 PM

Quote:

Originally Posted by LukeRFI

What is the objective of the OP?

It is to recover the data.

Quote:

Originally Posted by LukeRFI

What is the full model of the hard drive? Is it fully detecting with the correct model, serial and capacity? If my suspicions are correct, this is likely an issue that is best handled by a data recovery professional.

The drive is a Hitachi 2.5" 320gb. I am no recovery professional but I am however a Jr. in CIS/ISS so I am not noobish either.

Quote:

Originally Posted by rknichols

Whether the drive sees it or not, something is causing the OS to report an I/O error. We need details of the error report in order to assess what is going on. All indications are that the drive is fine internally.

I am using a HD enclosure to try and access the data via USB. I had pondered the thought that there were an error in the enclosure, yet I did test it with another drive and it were functional. Although, this enclosure is a multi use (3.5" / 2.5" PATA/SATA) and in my experiments I were working with a 3.5" PATA, where this drive is a 2.5" SATA. It is possible my enclosure is malfunctioning.

Quote:

Originally Posted by rknichols

There should be some sysem error messages logged at the time of those events. What are they? ("journalctl -n 20" or "tail -20 /var/log/messages").

I will run this script later and paste the output.

Quote:

Originally Posted by LukeRFI

It is more likely that if the drive is failing, the more the drive is powered on and tested, the more damage is being caused to the point of absolutely not chance of recovery. If the objective is to get the data off, the best thing to do is to clone the drive with gnu ddrescue.

As I posted above, ddrescue was unsuccessful. It gave me read/write errors. I have only powered on the drive twice, once to launch SMART, second to run SMART command above and test ddrescue, then the drive was powered off. I let ddrescue run for only a few seconds before I stopped it upon seeing the read/write error..

Emerson · 07-12-2016, 02:18 PM

ddrescue is still your best bet, it will try and skip if it cannot read, but it will read all the data possible.

DJNedly · 07-12-2016, 02:20 PM

Quote:

Originally Posted by Emerson

ddrescue is still your best bet, it will try and skip if it cannot read, but it will read all the data possible.

Quote:

Originally Posted by DJNedly

I just tried ddrescue, it constantly reads:

dd_rescue: (warning): read /dev/sdb (653256.ok): input/output error!
Bad block reading /dev/sdb: 163314

I constantly get this on each block, each read, it does not build the image file what so ever, the file is there but has no bytes.

LukeRFI · 07-12-2016, 02:33 PM

Quote:

Originally Posted by DJNedly

The drive is a Hitachi 2.5" 320gb. I am no recovery professional but I am however a Jr. in CIS/ISS so I am not noobish either.

If that means you have professional data recovery tools such as PC3000, a clean room and working knowledge of the ins and outs of how a hard drive works, then you probably don't need a data recovery professional.

Quote:

It is possible my enclosure is malfunctioning.

Possibly. If not, I'd go with the typical issues of a Hitachi 2.5" hard drive and say that the heads are failing to read and load the firmware modules from the service tracks.

Quote:

As I posted above, ddrescue was unsuccessful. It gave me read/write errors. I have only powered on the drive twice, once to launch SMART, second to run SMART command above and test ddrescue, then the drive was powered off. I let ddrescue run for only a few seconds before I stopped it upon seeing the read/write error..

Stopping was probably a good idea. It is your data and completely up to you what you do from here. However, if your data is worth professional data recovery services, it is best to seek their assistance before the drive dies from DIY attempts. There isn't any going back after a drive is completely killed.