Recover Hard Drive Data

Topic

New Reply

I recently had the hard drive die in my laptop. I installed a new one, and everything is running smoothly, but I would like to recover some data (mainly pictures and videos) from the old hard drive. Right now I am thinking it was a mechanical failure, although there were no unusual noises before it died. I did some research on recovery methods, but didn’t find anything substantial to work from, for example, this video claims you can fix a hard drive by taking it apart and moving the arm. I would only try something like this if I knew there was little risk involved. There is also the freeze method (freeze the hard drive, then connect it to a computer to retrieve data while the metal parts are contracted).

Does anyone have any suggestions on procedures for doing this on my own? None of the data is valuable enough for me to pay for a professional recovery, unless it is reasonably cheap.

Thanks for any help!

Reply | Quote

Replies

I’d suggest that taking a drive apart is not likely to work out well, in the long run.

Have you heard of Spinrite, by Steve Gibson, GRC – it may be able to assist you:
https://www.grc.com/sr/spinrite.htm

Some previous entries on Spinrite:
https://www.askwoody.com/forums/search/spinrite/

2 users thanked author for this post.

MisterKevin, BobbyB

Reply | Quote

there was some controversy about using Spinrite mentioned on these sites:

https://www.reddit.com/r/sysadmin/comments/2rv5jk/anybody_actually_use_spinrite/

https://serverfault.com/questions/51681/does-spinrite-do-what-it-claims-to-do

https://www.disktuna.com/spinrite-is-not-data-recovery-software/

better use a professional data recovery service to recover any valuable data on a failing hard drive than using DIY methods

2 users thanked author for this post.

Kirsty, MisterKevin

Reply | Quote

Had a few die over the years, and recently slapped a couple of new HDD’s and 1 SSD in last Dec and all were in laptops. I have seen the freezing method but as your average HDD isn’t really happy below -20C and the fiddly nature of getting the HDD out of the freezer, slapping in a laptop, putting it back to a working state before the HDD warms up is, to say the least, fairly unrealistic. Might be in with a chance with a Desktop running with the side off. Taking apart a working HDD albeit not functioning is potentially a none starter as well they are sealed to keep even miniscule contaminents out and moving HDD pointers across a charged surface is nigh impossible as they are designed to “hover” Microns above the surface, its been the cause of many HDD failures with grounded pointers, as once they touch at speed it dislodges the magnetic coating on the surface and you get the amazing, as I call it, “floaties syndrome” where bad sectors seem to pop up in different parts of the drive every time you test the disks surface, That was the problem with one HDD last December. If its just a “gouge/scratch” and there’s nothing floating around in the HDD enclosure its possible to Partition around the affected area but only temporarily, just long enough to recover the missing files, so long as none of the missing files are in the affected Sectors, and the defect isn’t in the OS system files area in which case its a no go for your data because you would have to reinstall ergo wipe the lot! Best I can suggest if the HDD is a “spinner” and is still spinning, and the logical controller is still operational is to try Data recovery software that’s freely available out there, cant really in all conscience, recommend any as I have had no success at all with any of the utilities out there to 100% satisfaction as normally the recovered files are corrupted as a rule But by all means give them a try if your convinced the HDD is toast, nothing to lose. There’s lots of freeware out there to check HDD’s and make sure they really are toast before you try anything radicle. I suspect that you’ve done this already so I wont recommend if you know the Brand of HDD check the manufacturers web site Western Digital, for one, and Seagate have some excellent free utilities and Imaging software, to snag missing files and check the health of your HDD.

1 user thanked author for this post.

MisterKevin

Reply | Quote

I’ve been able to run WD’s Data Lifeguard Diagnostic for Windows – you need a WD drive to install it, but it checks all installed drives.

On the other hand, Seagate’s Seatools fails to install/work properly for me – checking gets stalled, and I’ve never been able to get it past that (yes, I gave up, but after a lot of patience and attempts!)

2 users thanked author for this post.

HiFlyer, MisterKevin

Reply | Quote

If you have a single drive and it’s an HGST (formerly Hitachi), the Western Digital utility will read the S.M.A.R.T. data or perform tests without displaying an error.

Reply | Quote

Thanks for the advice! For the freezer method, I would not have to install the HDD in my laptop, I can connect it via USB. Is there any risk involved in the freezing action, or any reason not to try?

Reply | Quote

There is a risk of condensation or frost forming while exposing the drive to humid air. Has anybody tried this using a small size space bag?

Reply | Quote

Yes, I’d also like to know. The place I saw the freeze method recommended said you put the HDD in a zip-lock bag, remove excess air, and freeze. It seems a sealed bag would eliminate condensation forming. I could easily leave it in the bag and in the freezer while trying to recover data by running my USB-to-SATA cable into the freezer. I’ll post what I try and what happens.

Reply | Quote

Without anything, like unusual noises/smells, to go on, anything you do is blind, a shot in the dark. You have shown no signs or symptoms at all. BIG RED FLAG!

All physical data recovery attempts have risks – one for the freezer ‘trick’* is that of internal condensation as hard drives aren’t physically airtight; dust/increased likelihood of foreign materials entering is just one risk when opening a drive. Such risks might make any subsequent attempts even more likely to reduce the chances of successful data recovery.

*it’s not a trick, if the diagnosis is accurate and heat-induced signs/symptoms are present then it has a chance of working, at least for a very short time until the critical temperature is reached again and if the correct software tools are used by someone who knows the likely file system location of the most useful/valuable files.

I’ve made two attempts at file recovery using this chilling method, both were successful; one was an old drive with ‘stiction’, on boot, it would attempt to spin up to operating speed but after just a second or two, speed would nose dive, to be picked up again a very short time later, eventually picking up speed for long enough to be detected by the hardware detection routine in the BIOS but never for long enough for the BIOS to be able to hand it on into the Boot process, indicating a probable gummed up and overheating spindle.

The second was a drive which would spin up normally, booting successfully into Windows for a few seconds before crashing with a BSOD that indicated the drive had become unreachable. On receiving the machine, the side was removed so we could check for any odd signs during the boot process and in the second or so before the inevitable crash, I spotted a tiny wisp of smoke that appeared from the underside of the drive. Further investigations showed an almost microscopic crater on the face of an IC on the drive’s electronic controller and a very quick test via USB connected to a notebook showed this was the smoke source and therefore at least part of the reason for the ‘disappearing’ drive.

Once you’ve made the call, you then need to hatch a plan to get straight to the most important data as fast as possible and copy it without any interruption; Windows/File Explorer is useless, one glitch and it aborts the copy process, meaning more hours chilling drives/freezer packs before the next attempt.

Each time the drive is booted/heated, the odds of it (or a component of it) causing further damage or completely failing increase. The more data there is that requires recovery, the longer it takes and the lower the chances of a ‘full’ data recovery become as the drive temp. rises.

Bottom line, get someone experienced to diagnose it before doing anything.

3 users thanked author for this post.

HiFlyer, Elly, MisterKevin

Reply | Quote

@satrow you mention that data recovery becomes increasingly difficult as the HDD warms up outside of the freezer. Is it necessary to take it our of the freezer? Like, is there any reason not to leave it in the freezer while trying to recover data using a USB cable?

Reply | Quote

I think you’re onto something with your idea of sealing the drive in a ziplok bag, leaving it in the freezer, then running a USB cable out to the computer. Hopefully the drive won’t freeze up just from the cold. If it does, take it out of the freezer and let it warm up, then try again to read it.

The reason you put it in the freezer and then take it out is so that the temperature will change. Since the drive is made of different types of materials, they will contract and expand differently when cooled/heated. This difference can loosen the drive internally, allowing a locked-up drive to start spinning. But the risk is that condensation can form in the drive, messing it up.

You can also drop the drive about a foot. The shock of it hitting the floor can loosen the drive, allowing it to spin. But it can also damage the drive.

Finally, if nothing else works, you can take the cover off of the drive and start it spinning manually. Years ago, my supervisor did just that – he connected a drive and got it all ready, then took the cover off and spun the platter by hand, touching only the edge of the platter. He then powered up the computer and successfully got the data off of it!

Keep in mind that once you pull the cover off, the drive will soon die from exposure to dust, so you have only a short time to try this one.

But before you try any of these tricks, try reading it in Linux. Linux sometimes is more successful reading drives than Windows is.

Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server

4 users thanked author for this post.

HiFlyer, MisterKevin, satrow, Elly

Reply | Quote

It’ll still warm up to some degree, whether inside or outside of the freezer. If you’ve convinced yourself that this is the only method you can afford, think of it as a one shot, last chance saloon. Still want to try it, even if a single failure might mean your data is gone forever?

I did it outside the freezer, in my first case, with my own drive/data, I’d spent hours going through the signs/symptoms and trying to figure out how much time I needed and whether I’d need to shift my PC to the kitchen to be next to the freezer, which software tools were best, etc. – I decided against that and worked with the drive sandwiched above and below with freezer packs (for cool boxes), all wrapped in plastic bags, and after all had spent several hours in the freezer. Similar for the second case a few years later, where the resident notebook/docking station was resident in the kitchen close to the freezer(s), though that was a team effort for better speed and efficiency. Yes, sealed bags are a must, silica gel bags should also be used (pop them into the bags just before attempting recovery)

It still takes me 4-12+ hours to decide on the initial method to use for data recovery, though I’ve rarely needed to do it in recent years.

If the drive is ‘dead’, ie doesn’t attempt to spin up, no noise/vibration etc., then you’ll need to consider swapping out the drive’s controller ‘board, not so ‘simple’ as it used to be when I used to do that apparently, controller types have changed a lot in the intervening decade or so.

Reply | Quote

satrow wrote:

It still takes me 4-12+ hours to decide on the initial method to use for data recovery

What are some other methods for data recovery?

Reply | Quote

That depends entirely upon the signs/symptoms and back story details from the user, whether the drive can be tested for SMART details and integrity, whether the drive/partition/any data can be ‘seen’ from testing with ‘standard’ tools/BIOS/Windows.

If you can find enough detail to figure out a likely scenario for the reason for the current drive state, you can then move software/hardware workarounds/tests and best recovery chance methods.

No idea what might have happened and less than $120 budget (software for DIY recovery + transfer or archival drive), it’s back to a shot in the dark and the least likely to cause further damage scenario.

Reply | Quote

How important are the data on the drive?
If critical, and worth the expense, have a professional data recovery service do the job.
If not worth that, then you can experiment. The flying height of a head over a disk is much less than the size of a particle of dust. I can’t comment on the freezer approach.

6 users thanked author for this post.

HiFlyer, MisterKevin, Bill C., BobbyB, satrow, MrJimPhelps

Reply | Quote

This! It is possible that the issue is not with the platters, or the pointers, but the IC board. As long as it did not damage the files as it failed, it can be recovered. However, you need to get a forensic data recovery pro to do it.

I have seen it doe for evidentiary purposes and to recover mission critical data that was not properly backed up. It is NOT cheap, so judge carefully the value of what you want to recover.

Good luck. At least get an estimate first. Most services will try not to work on opened HDD cases, unless it for evidence due to the costs.

3 users thanked author for this post.

HiFlyer, MisterKevin, satrow

Reply | Quote

Se also my closing paragraph.

1 user thanked author for this post.

Bill C.

Reply | Quote

Place the affected HDD in an external USB HDD casing. Boot into your OS and see if it picks up when plugged in. If that doesn’t work, try using a bootable linux usb flash drive to boot from so you can access files and transfer them.
(this is the cheapskate method which has worked for me in the past, if neither work, you still have a USB casing for the HDD)
The freezer method I’ve had limited success with but, only on old IDE drives for around 5 mins access before dying (setting to slave via jumpers), never had to do it for sata drives though.

Windows - commercial by definition and now function...

2 users thanked author for this post.

satrow, MisterKevin

Reply | Quote

I think I am going to try this (it is for a different drive than the one I’ve been asking about):

Microfix wrote:

using a bootable linux usb flash drive to boot from so you can access files and transfer them

Can someone recommend how to go about it (booting linux and transfering files)? I am not familiar with linux at all.

Reply | Quote

Interesting discussion!  Makes me glad to know that my efforts to take regular image backups of my drives are not in vain.  This is a good reminder to get with it if you are not already, as all drives will eventually fail.  An ounce of prevention …

Sorry for the OP’s difficulties though!

Windows 10 Pro 22H2

Reply | Quote

How very true… 🙂

1 user thanked author for this post.

JohnW

Reply | Quote

OK, so I put the dead HDD in a hard drive enclosure, plugged it into my computer, and turned it on. All I hear is a beeping, and I am pretty sure it is coming from my HDD. Does anyone know what it means?

Reply | Quote

I just found this, which says beeping indicates a head stuck to the platter (my HDD is the same as the one mentioned in the article). Any other ideas, or ways to fix this? (I am really hoping it is not a stuck head!)

Reply | Quote

This does not sound good for your beeping hard drive!
From the link you provided, I do not think using a linux bootable usb flash drive or any other means of access other than professional data recovery will help, as you may be doing further damage to the head/ platter by trying to retrieve data.

1 user thanked author for this post.

MisterKevin

Reply | Quote

Hey! Isn’t a stuck head what freezing is supposed to fix?

Reply | Quote

Sure, the freezer ‘trick’ might allow enough time to get important data off the drive but it depends on the damage; physical damage might lead to ‘recovered’ files being corrupt and unusable, how would you ‘fix’ that?

A short drop or tap with a rubber hammer might also ‘fix’ it.

But read the below section from your article:

As we usually see in these situations, the read/write heads had become mangled. The platters had also sustained some damage, spreading dust across their surfaces. To get this hard drive up and running and create a disk image of its contents, our engineers replaced the read/write heads with a compatible donor set and polished the platters clean with our special platter burnishing tools.

1 user thanked author for this post.

MisterKevin

Reply | Quote

I am currently trying to recover data from another HDD, this one was working when the Windows Vista laptop it was previously installed in physically broke. I connect it to my computer via a SATA to USB drive enclosure, and it spins and is detected in File Explorer. It is labeled as healthy in Disk Management, but cannot be accessed in File Explorer. I am not sure why this is, but I know there is software that can read drives that File Explorer refuses to (could someone recommend one?). I also posted earlier (with regards to the same drive):

MisterKevin wrote:

I think I am going to try this (it is for a different drive than the one I’ve been asking about):

Microfix wrote:

using a bootable linux usb flash drive to boot from so you can access files and transfer them

Can someone recommend how to go about it (booting linux and transfering files)? I am not familiar with linux at all.

Any help with getting files from this “working” drive would be appreciated! Attached are certain screenshots that might include helpful info for determining what is going on.

Reply | Quote

I believe the issue may lie in the RAW file system. This may be of some help:
https://www.easeus.com/resource/raw-file-system-to-ntfs.htm

Be warned, formatting the drive will destroy the data, so proceed with extreme caution 🙂

1 user thanked author for this post.

MisterKevin

Reply | Quote

Somehow only some of the partitions were RAW, the ones I needed to access were NTFS. I successfully retrieved them using PC Inspector File Recovery 4.x, then formatted the HDD, and it works fine now! Once (if :)) I get the beeping drive fixed, I will mark this entire thread as “resolved”.

Reply | Quote

I have been using a WD hard disk (WD80EFAX) for the last 6 months or so, with a house move and a lot of travelling, I have been unable to back it up. I was re-naming an existing folder last Sunday, and then found I couldn’t open any files. I checked Properties and found the disk was still recognising data but every 1st level directory appeared to be empty. The disk rotates happily with no bad sounds. As soon as this happened I dsconnected the drive and have not powered it up again. Is this a Boot Record problem ? I really need to recover all the information on the disk – can anyone please suggest a reliable method, please ?

Thanks TOM

Reply | Quote

Have you tried booting into safe-mode and accessing the drive from there?

Windows - commercial by definition and now function...

Reply | Quote

Is this your boot drive, or a secondary data storage drive? Sounds like it might be a corrupted MFT (NTFS Master File Table).

If it is your boot drive you could remove it and attach it to another computer using an external USB dock or enclosure as a data drive. That would limit write attempts to the drive. Normally I would say back up everything first, but in this case, it’s probably too late for that.

If the disk is in use as a data drive, it is probably safe to boot your system, as long as nothing tries to write to the drive.

Your data is only lost if it is overwritten with other files.

Run Chkdsk on the drive.

If you can’t boot the system, you can boot from the Windows recovery console or repair disk and run Chkdsk from there.

https://www.howtogeek.com/howto/windows-vista/guide-to-using-check-disk-in-windows-vista/

https://askleo.com/chkdsk_what_is_it_and_how_do_i_run_it/

Windows 10 Pro 22H2

Reply | Quote

JohnW wrote:

Is this your boot drive, or a secondary data storage drive? Sounds like it might be a corrupted MFT (NTFS Master File Table).

If it is your boot drive you could remove it and attach it to another computer using an external USB dock or enclosure as a data drive. That would limit write attempts to the drive. Normally I would say back up everything first, but in this case, it’s probably too late for that.

Never too late to try.

However, in this case I’d suggest booting the system with something that doesn’t even try to access NTFS drives automatically on bootup or plugin. (As in not standard Windows… I usually use Linux for this.) Then make a RAW copy of the disk to something else – like a portable USB drive, just get one that’s large enough. Raw because that copies also all the “empty” space, including anything deleted but not overwritten…

(Make more than one copy if the source drive is physically suspect… at least one for working on and one backup for restarting the work from the initial point if necessary.)

Then you can poke at the copy with all kinds of data recovery tools and try various things with less risk.

1 user thanked author for this post.

JohnW

Reply | Quote