New
#1251
Paragon has an option to skip bad sectors, tho I haven't needed to use it. No idea if it is in the free version.
Paragon has an option to skip bad sectors, tho I haven't needed to use it. No idea if it is in the free version.
The presence or absence of VSS has absolutely no effect upon accessing a file that is stable and accessible and not "protected" by Windows.
There is a world of difference between :-
a corrupted file which has had some sectors totally over-written;
and a corrupted sector which has had a few '1' bits fade into '0' bits (or vice versa) and cause the HDD controller to detect a HDD CRC error.
Google gave 42,000 results for
e.g.HDD CRC error
CRC error on hard drive - is it toast? - AnandTech Forums
How to Fix a Cyclic Redundancy Check Error: 9 Steps - wikiHow
If your problem is CRC errors within sectors the "normal" best that you can hope for is to obtain the data with 30% worn out '1' bits and probable mistakes,
BUT you cannot save that data to a file or to a clone with similar 30% worn out bits - they will be saved as absolute zeros and ones and the Sector CRC's will validate the contents of the sector.
I do not know if by default an HDD controller will deliver data which it knows is corrupt.
You would probably need the special software and hardware of a Data Recovery specialist to access data which the controller knows as corrupt.
If Live Windows refuses to accept CRC corrupted data from the HDD, so would a bootable WinPE.
That makes sense. :)
I wouldn't expect cloning to duplicate a head crash on a HDD.
I used "CRC on floppies", as an example, because I have encountered that issue.
There were no error messages about CRC errors (only VSS).
Do SSDs even use CRC?
I would've expected them to use something better/different/newer.
What is interesting is that his Windows install still functions (apart from his Adobe software, System Restore and Windows Update).
I suspect that is true of SSDs too. :)
Two more reasons to consider Forensic worthless, and likely to make things worse not better.
1.
A forensic backup will attempt to read not only the sectors that hold existing files,
but also all "free space" which is the sectors that held files that have since been deleted plus the sectors that have never been written to.
My System C:\ has 41.9 GB free out of 55.7 GB.
To copy or clone non-forensic requires the reading of only 13.8 GB
To copy or clone forensic requires the reading of the entire 55.7 GB
If there are two bad sectors in 55.7 GB there is only a 50% chance of one error in 13.8 GB,
so a 50% chance of a perfect backup.
Putting it another way, I am four times as likely to suffer a CRC ERROR ABORT were I to use the forensic mode.
2.
If this is an SSD and TRIM is enabled then at some time after a file is deleted Windows will tell the SSD that the sectors that held it are no longer in use.
Either immediately or later ( I do not know and possibly depending upon each SSD vendor's design ),
if you attempt to read those sectors you just possibly might be lucky,
but it might simply give back random garbage or solid zero's or solid one's,
and at some time when the SSD has nothing better to do - or when it is desperately short of clean Flash Cells,
the SSD firmware will select a block of LBA designated Flash cells and relocate any live data to another block of Flash Cells and then erase the entire block of flash cells that now hold only deleted data or relocated data,
after which I predict that no data recovery utility will be able to access what was deleted
Conclusion :-
Capturing data from Free space on an SSD is as reliable at showing the past,
as Sacrificing a goat and studying its entrails to determine the future.
You are correct about SSD's not depending upon CRC which can only detect errors.
SSD's use ECC which incorporates significantly more overhead to facilitate correction on the fly
https://en.wikipedia.org/wiki/ECC_memory
I went into serious panic mode when looking at my SSD Smart data and :-
That caused my to start this topic :-I saw 25,000,000 UNCorrectable errors as the C:\ partition was imaged,
Errors in Flags and descriptions of Smart Data ? Hard Disk Monitoring
You may get very valuable information from posts that are on that forum,
and you will probably also get valuable answers to your own questions even if you only use a free trial.
I am sorry, but I in my previous posts I had not recognised that you were dealing with an SSD and not an HDD.
Regards
Alan
Not sure if it's relevant, but I wanted to restore to an earlier image the other other day when investigating an issue that seemed to be related to a recent update to my graphics driver. Last month I made two images of my (OS-containing) SSD, one just an image, the other, an entire clone of the disk. I haven't tried making, then restoring, an entire disk clone before, and when I tried, I just got an error, I can't remember what it said, and Macrium wouldn't restore the clone. Thankfully I'd made an image a few days later and that restored fine. I have now deleted the 230GB cloned image as it was sitting uselessly on my secondary drive so can't go back to see why it wouldn't restore. I wonder if there's a moral there for someone?
Accepting that some people want to use the Macrium clone capability, it may be useful to document any potential problems.