Solved Image your system with free Macrium

[lehnerus2000]

Failure to clone

Regardless of what you might be aware of,
You specifically ask
"should we be using "Forensic" imaging instead of "Intelligent" imaging?"
and I answered your ignorance of what you should be using by telling you that it will facilitate data recovery of what were "deleted files" at the time that you create the image.

My question wasn't related to the recovery of previously deleted files that may still be occupying "empty" sectors.
I am aware that "Forensic" imaging will allow this (hence the name).

It was specifically related to Macrium failing/refusing to clone my friend's SSD.

To put it another way, the question was:
"Does anyone think that using "Forensic" will overcome the problem I encountered (i.e. his broken Volume Shadow Copy Service)?"

It seems that the answer is "no" and I will need to use the PE disc to bypass this issue (assuming my friend sticks to his bizarre plan).

Maybe my friend will now accept my recommendation to partition his SSD, reinstall his OS and programs, and then image it (to avoid this issue in the future).
I'm not holding my breath, as he has a pathological fear of partitions.

 

[Britton30]

Tell your friend the drive IS a partition.

 

[Lady Fitzgerald]

With Macrium you need to manually do the validation before a restore. There is nothing automatic and there is no prompt to remind you. The Linux restore disk doesn't have that feature.

View attachment 289742

Actually, you can have Macrium Reflect automatically do the validation (technically, it's called verifying the image) immediately after an image has been created (it's in the Advanced Options). It takes almost as long to do as making the image in the first place but, besides providing the peace of mind that the image is valid, it also provides the opportunity to remake the image should it have gone pear shaped; finding out an image isn't valid after the original has gone south is not going to help one any.

 

[whs]

The PE disc does not depend on any 'outside' service because it carries it's own Windows system.. After all it has to work when no system is present at all or when the system is completely dead.

 

[kado897]

With Macrium you need to manually do the validation before a restore. There is nothing automatic and there is no prompt to remind you. The Linux restore disk doesn't have that feature.

View attachment 289742

Actually, you can have Macrium Reflect automatically do the validation (technically, it's called verifying the image) immediately after an image has been created (it's in the Advanced Options). It takes almost as long to do as making the image in the first place but, besides providing the peace of mind that the image is valid, it also provides the opportunity to remake the image should it have gone pear shaped; finding out an image isn't valid after the original has gone south is not going to help one any.

Ah yes. I had forgotten that option.

 

[Lady Fitzgerald]

With Macrium you need to manually do the validation before a restore. There is nothing automatic and there is no prompt to remind you. The Linux restore disk doesn't have that feature.

View attachment 289742

Actually, you can have Macrium Reflect automatically do the validation (technically, it's called verifying the image) immediately after an image has been created (it's in the Advanced Options). It takes almost as long to do as making the image in the first place but, besides providing the peace of mind that the image is valid, it also provides the opportunity to remake the image should it have gone pear shaped; finding out an image isn't valid after the original has gone south is not going to help one any.

Ah yes. I had forgotten that option.

No need to be embarrassed; 'tis well hidden. Fortunately for an absent minded old broad like me, it's a sticky setting; set it once and forget it (I have the forget part down pat!).

 

[kado897]

Actually, you can have Macrium Reflect automatically do the validation (technically, it's called verifying the image) immediately after an image has been created (it's in the Advanced Options). It takes almost as long to do as making the image in the first place but, besides providing the peace of mind that the image is valid, it also provides the opportunity to remake the image should it have gone pear shaped; finding out an image isn't valid after the original has gone south is not going to help one any.

Ah yes. I had forgotten that option.

No need to be embarrassed; 'tis well hidden. Fortunately for an absent minded old broad like me, it's a sticky setting; set it once and forget it (I have the forget part down pat!).

Even easier. I noticed that it was also in the Global settings.

 

[Lady Fitzgerald]

Ah yes. I had forgotten that option.

No need to be embarrassed; 'tis well hidden. Fortunately for an absent minded old broad like me, it's a sticky setting; set it once and forget it (I have the forget part down pat!).

Even easier. I noticed that it was also in the Global settings.

Hey, you're correct! Never checked there after I found it elsewhere.

 

[alan10]

To put it another way, the question was:
"Does anyone think that using "Forensic" will overcome the problem I encountered (i.e. his broken Volume Shadow Copy Service)?"

VSS has no relevance to the "Free Space" which contains the deleted files.
VSS is only needed for ensuring a consistent snapshot that captures at one instant in time all the current live undeleted files, even though Windows may shuffle those files around during the course of creating the image backup or clone.

VSS being broken only affects the ability to capture undeleted files regardless of how Windows might shift them or prohibit access during the course of the backup.

N.B.
I believe VSS creates temporary files, I think in System Volume Information, whilst imaging or cloning is in progress.
I would guess (never tried it) that if you kept Windows very busy with downloads and installations during the course of image/clone creation, the temporary files could become excessive and stop VSS.

 

[lehnerus2000]

Corrupt vs Deleted

Tell your friend the drive IS a partition.

He doesn't seem to grasp the fact that it is quicker to image a 40 GB partition than a 500 GB partition.

This should have been obvious, as we tried to image his SSD using the Macrium PE disk about a month ago (he had a profile issue).
We couldn't install a decent USB driver, so the imaging was proceeding at ~1 MB/s.
We gave up on that option, as neither of us was willing to wait ~5 days for that operation to finish.

If his SSD had at least two usable partitions, we would have had no problems imaging his OS partition.

Luckily the fix corrupted profiles tutorial solved the issue.

To put it another way, the question was:
"Does anyone think that using "Forensic" will overcome the problem I encountered (i.e. his broken Volume Shadow Copy Service)?"

VSS has no relevance to the "Free Space" which contains the deleted files.
VSS is only needed for ensuring a consistent snapshot that captures at one instant in time all the current live undeleted files, even though Windows may shuffle those files around during the course of creating the image backup or clone.

VSS being broken only affects the ability to capture undeleted files regardless of how Windows might shift them or prohibit access during the course of the backup.

N.B.
I believe VSS creates temporary files, I think in System Volume Information, whilst imaging or cloning is in progress.
I would guess (never tried it) that if you kept Windows very busy with downloads and installations during the course of image/clone creation, the temporary files could become excessive and stop VSS.

I didn't give a detailed explanation, so I suspect that is causing confusion.

It's not a deleted file issue; it's a corrupt file/sector issue.
The sectors that I'm concerned about aren't empty; they are corrupted.

In the "old days", floppies used a DRM scheme based on corrupt CRC information.
DOS copy functions (i.e. OS-based copying) could not copy any discs/files which had corrupt CRC information.

I have read comments that lead me to believe, "Forensic" imaging will duplicate a partition even if it contains corrupt files/sectors.
I assume that "Intelligent" imaging will fail, if it encounters corruption, because it relies on an operating system function (VSS).

Based on that assumption, I wanted to know if "Forensic" imaging would have succeeded where "Intelligent" imaging failed.

 

[SIW2]

Paragon has an option to skip bad sectors, tho I haven't needed to use it. No idea if it is in the free version.

 

[alan10]

The presence or absence of VSS has absolutely no effect upon accessing a file that is stable and accessible and not "protected" by Windows.

There is a world of difference between :-
a corrupted file which has had some sectors totally over-written;
and a corrupted sector which has had a few '1' bits fade into '0' bits (or vice versa) and cause the HDD controller to detect a HDD CRC error.

Google gave 42,000 results for

HDD CRC error

e.g.
CRC error on hard drive - is it toast? - AnandTech Forums
How to Fix a Cyclic Redundancy Check Error: 9 Steps - wikiHow

If your problem is CRC errors within sectors the "normal" best that you can hope for is to obtain the data with 30% worn out '1' bits and probable mistakes,
BUT you cannot save that data to a file or to a clone with similar 30% worn out bits - they will be saved as absolute zeros and ones and the Sector CRC's will validate the contents of the sector.

I do not know if by default an HDD controller will deliver data which it knows is corrupt.
You would probably need the special software and hardware of a Data Recovery specialist to access data which the controller knows as corrupt.

If Live Windows refuses to accept CRC corrupted data from the HDD, so would a bootable WinPE.

 

[lehnerus2000]

If your problem is CRC errors within sectors the "normal" best that you can hope for is to obtain the data with 30% worn out '1' bits and probable mistakes,
BUT you cannot save that data to a file or to a clone with similar 30% worn out bits - they will be saved as absolute zeros and ones and the Sector CRC's will validate the contents of the sector.

That makes sense.
I wouldn't expect cloning to duplicate a head crash on a HDD.

I used "CRC on floppies", as an example, because I have encountered that issue.
There were no error messages about CRC errors (only VSS).

Do SSDs even use CRC?
I would've expected them to use something better/different/newer.

What is interesting is that his Windows install still functions (apart from his Adobe software, System Restore and Windows Update).

I do not know if by default an HDD controller will deliver data which it knows is corrupt.
You would probably need the special software and hardware of a Data Recovery specialist to access data which the controller knows as corrupt.

I suspect that is true of SSDs too.

 

[alan10]

Two more reasons to consider Forensic worthless, and likely to make things worse not better.

1.
A forensic backup will attempt to read not only the sectors that hold existing files,
but also all "free space" which is the sectors that held files that have since been deleted plus the sectors that have never been written to.

My System C:\ has 41.9 GB free out of 55.7 GB.
To copy or clone non-forensic requires the reading of only 13.8 GB
To copy or clone forensic requires the reading of the entire 55.7 GB
If there are two bad sectors in 55.7 GB there is only a 50% chance of one error in 13.8 GB,
so a 50% chance of a perfect backup.

Putting it another way, I am four times as likely to suffer a CRC ERROR ABORT were I to use the forensic mode.

2.
If this is an SSD and TRIM is enabled then at some time after a file is deleted Windows will tell the SSD that the sectors that held it are no longer in use.
Either immediately or later ( I do not know and possibly depending upon each SSD vendor's design ),
if you attempt to read those sectors you just possibly might be lucky,
but it might simply give back random garbage or solid zero's or solid one's,
and at some time when the SSD has nothing better to do - or when it is desperately short of clean Flash Cells,
the SSD firmware will select a block of LBA designated Flash cells and relocate any live data to another block of Flash Cells and then erase the entire block of flash cells that now hold only deleted data or relocated data,
after which I predict that no data recovery utility will be able to access what was deleted

Conclusion :-
Capturing data from Free space on an SSD is as reliable at showing the past,
as Sacrificing a goat and studying its entrails to determine the future.

You are correct about SSD's not depending upon CRC which can only detect errors.
SSD's use ECC which incorporates significantly more overhead to facilitate correction on the fly
https://en.wikipedia.org/wiki/ECC_memory

I went into serious panic mode when looking at my SSD Smart data and :-

I saw 25,000,000 UNCorrectable errors as the C:\ partition was imaged,

That caused my to start this topic :-
Errors in Flags and descriptions of Smart Data ? Hard Disk Monitoring

You may get very valuable information from posts that are on that forum,
and you will probably also get valuable answers to your own questions even if you only use a free trial.

I am sorry, but I in my previous posts I had not recognised that you were dealing with an SSD and not an HDD.

Regards
Alan

 

[lehnerus2000]

No problems

I am sorry, but I in my previous posts I had not recognised that you were dealing with an SSD and not an HDD.

No problems (and thanks for that link).

I've missed information in people's posts before.

 

[Britton30]

I've missed information in people's posts before.

Now you've earned your stripes Peter.

 

[Diddlededum]

Not sure if it's relevant, but I wanted to restore to an earlier image the other other day when investigating an issue that seemed to be related to a recent update to my graphics driver. Last month I made two images of my (OS-containing) SSD, one just an image, the other, an entire clone of the disk. I haven't tried making, then restoring, an entire disk clone before, and when I tried, I just got an error, I can't remember what it said, and Macrium wouldn't restore the clone. Thankfully I'd made an image a few days later and that restored fine. I have now deleted the 230GB cloned image as it was sitting uselessly on my secondary drive so can't go back to see why it wouldn't restore. I wonder if there's a moral there for someone?

 

[Kaktussoft]

Not sure if it's relevant, but I wanted to restore to an earlier image the other other day when investigating an issue that seemed to be related to a recent update to my graphics driver. Last month I made two images of my (OS-containing) SSD, one just an image, the other, an entire clone of the disk. I haven't tried making, then restoring, an entire disk clone before, and when I tried, I just got an error, I can't remember what it said, and Macrium wouldn't restore the clone. Thankfully I'd made an image a few days later and that restored fine. I have now deleted the 230GB cloned image as it was sitting uselessly on my secondary drive so can't go back to see why it wouldn't restore. I wonder if there's a moral there for someone?

Strange story. Why are you talking about "image" and "restore". A disk or partition that you did clone can be imaged, or cloned again (for example back to original disk). It confuses people if you use the wrong words.

Without error message we can't help you I think

 

[mjf]

Accepting that some people want to use the Macrium clone capability, it may be useful to document any potential problems.

 

[Britton30]

I wasn't confused at all.