A failing drive: copy it before you scan it

Is this a hardware problem or a file system problem?

The two need opposite responses, so it is worth being sure. A file system problem is a drive that reads perfectly but describes itself wrongly. A hardware problem is a drive that cannot answer.

Signs of a hardware fault

• Clicking, ticking, beeping or grinding, especially in a rhythm.
• The drive takes thirty seconds or a minute to appear, or appears and vanishes.
• Copying files stalls completely on particular files, then resumes or fails.
• Windows logs read errors, or the drive gets noticeably hot.
• SMART reports reallocated or pending sectors climbing.

Signs it is only the file system

• The drive is instantly recognised, spins up quietly, and reads at normal speed.
• Windows says it needs formatting, shows the volume as RAW, or shows the disk as unallocated — see the RAW drive guide and the missing drive guide.
• Files are missing but everything else about the drive behaves normally.

SMART reporting "OK" is not a clean bill of health, incidentally. It reports the thresholds the manufacturer chose, and drives fail with a clean SMART record often enough that it cannot be used to overrule what you can hear.

Why one sequential pass beats a scan

A recovery scan is not gentle. It reads the file table at the front, then jumps to wherever each file's data lives, then sweeps the whole medium looking for file headers. On healthy hardware that is fine. On a drive with a failing head or a dying flash controller, every seek and every retry costs something from a budget nobody can measure, and each minute powered on is a minute it can get worse.

Copying the drive front to back in one pass is the least demanding thing you can ask of it: no seeking, no re-reading, no going back. When the pass finishes you have an ordinary file on a healthy disk that behaves exactly like the drive did, and every subsequent search costs the failing drive nothing at all. It can be unplugged and left alone.

What a good copy does that a plain file copy does not

Dragging the visible files off in Explorer stops at the first read error, and it only copies files the file system still admits to having — not the deleted ones you are trying to recover. A sector-by-sector image copies the whole medium, including the deleted data and the structures recovery needs.

Three things separate an image worth having from a file full of surprises. Unlost enforces all three in the recovery engine rather than in the interface:

• Damage is expected, not fatal. A stretch that will not read is filled with zeros, its address is written down, and the copy carries on. A copier that aborts at the first bad sector is useless on the drives that need copying most.
• The unreadable stretches are logged beside the image. That log is what lets a later search say "this file sits partly on a stretch that would not read" at the moment it finds the file — rather than letting you discover it when a photograph opens grey.
• An image file that exists is a finished one. A copy that was stopped or that failed leaves a .part file behind, never something that looks complete. And the image is never written to the drive it is being read from; nothing starts until the destination has room for the whole drive.

What to do

1. Stop using the drive. Close anything reading from it. Do not run chkdsk, do not defragment, do not let a backup tool crawl it.
2. Decide whether it is safe to power on at all. A drive that clicks or grinds may be damaging its own platters every second it runs. If the data is irreplaceable, unplug it now and speak to a lab before doing anything else.
3. Get a destination with room for the whole drive. An image of a 1 TB drive is 1 TB, whatever the drive claims is used. There is no compression and no skipping.
4. Connect the failing drive directly if you can. A drive that disconnects intermittently through a USB enclosure is often steadier on an internal port, and a shorter, better cable is worth trying before a long copy.
5. Take the image in one pass and leave the machine alone while it runs. Expect hours for a large drive, and longer if it stalls on damage.
6. Unplug the drive and search the image. From here on the failing hardware is out of the loop entirely, and you can scan the copy repeatedly, try different approaches, and take your time.

When software is the wrong tool

Some situations cannot be solved by any program, and the sooner that is recognised the more likely the data survives:

• Mechanical noise — clicking, grinding, a head that will not park. Continuing to power the drive can turn a recoverable fault into scratched platters.
• The drive is not detected at all, in any machine, with any cable. Software needs something to read.
• Physical damage — dropped, flooded, burnt, or a snapped connector.
• An SSD whose controller has failed, where the flash is intact but nothing can address it.

A professional lab opens drives in a clean room and works on the hardware itself. It is expensive — quoted per case, and typically far beyond the price of any software — so it is a decision about what the data is worth. What matters here is that everything you try before calling them can reduce what they are able to do, which is the strongest argument for stopping early rather than late.

Questions about failing drives

Is imaging safe for the drive?

It is the least demanding read pattern there is, but it is not free — it still reads every sector once. On a drive that is audibly failing, even that carries risk, which is why the mechanical-noise case belongs to a lab rather than to software.

How much space do I need for a disk image?

The full size of the source drive, on a different disk. An image of a 500 GB drive occupies 500 GB even if only 40 GB was in use, because the deleted data you are trying to recover lives in the space the file system calls free.

Can I image a drive that has bad sectors?

Yes — that is precisely what an image is for. Unreadable stretches are zeroed and recorded, the copy completes, and the log tells you afterwards which recovered files are affected instead of leaving you to find out.

Should I put the drive in the freezer?

No. It is an old piece of folklore that occasionally seemed to work on drives of a different era, and on modern hardware it mostly adds condensation and thermal shock to an already damaged mechanism. If a drive is bad enough that this is being considered, it is bad enough for a lab.

My drive works but is slow and stalls. Is it dying?

Possibly, and the response is the same either way: image it now, while it still reads, and investigate afterwards. An image taken from a drive that turns out to be healthy has cost you a few hours and some disk space.