Solved Randomlyish-occurring BSOD after installing hardware from another PC.

[Nofew]

I got fancy new stuff! Specifically, I got an Aorus 1080 Ti and a Samsung 840 Pro! Huzzah!

I put both in, and my system started crashing at strange times. I'll cut to the chase first and explain what's going on, then what I've already tried.

So, I get 0x000000D1 that points to either storport.sys or IaStorA.sys (or however it's spelled, I can never remember x.x), IRQL_NOT_LESS_OR_EQUAL. Gah. That error drives me nuts. Anyway, it happens with no overt pattern /except/ that it tends to happen shortly after I run Unigine Heaven's benchmark.

Wait! Don't start making assumptions yet! It's not an overheating issue! Read my methodology first!

My first instinct was that it has to do with the GPU /somehow/, but indirectly. Maybe I had a SATA wire positioned too close to it and EMI or heat was messing with data transmission, so I worked on fan curves and stuff to try and get it to run cooler to partially eliminate heat as a possible cause, and tied the wires to the hard drive cages and other similar points further away from the GPU. I also unplugged the SSD from the 6G SATA port it was in before and put it in a 3G port, both in case the 6G port (or controller!) was bad and so if there /is/ EMI, it's less likely to actually cause a significant issue. Finally, all my other drives are in the 3G ports, so I figured they've /got/ to be reasonably okay.

So off I go, run Heaven again, crash a few seconds after I quit out. Gah. That's usually a sign that the GPU suddenly not needing as much power is throwing something out of whack somewhere. Tried it again a bit later, seemed stable, but crashed nine hours later. What the heck? Okay, odd. This time when the system booted I left it alone, no Heaven, and had no crashes for 72 continuous hours.

Ran Heaven, no crashes. Closed Heaven. Half an hour later, bang, crashed again.

This pattern maintains consistency; the only time I seem to crash is when I run very particular programs, and it's like it sets a countdown to doom where even if my system is under no stress, at some point within half an hour, it goes down. Heaven is the easiest to access, but other programs do it too. I don't remember which ones /do/ do it, but I can verify that the ones that definitely don't do it are Skype, Steam, 3Dmark (What the heck?), Oculus Home, Elite: Dangerous, MSI Afterburner, Aorus Graphics Engine, Hwinfo64, and many others.

The fact that really specific things, like Heaven /but not 3Dmark/, cause eventual BSODs is what's really confusing me. It's definitely not an over-stress issue, and I'm not even (at least knowingly) accessing data on the SSD when the system goes down.


Some concerns I'd like to raise:

My primary hard drive has had to use some of its reserve blocks, and I know I have some bad sectors. This has been the case for years. It hasn't gotten worse and I believe them to be the result of me literally tripping over my computer while it was turned on at one point, so I don't think it's in an ongoing getting-worse-and-failing state. Besides, literally the day before I installed the new hardware I was running for almost 24 days straight without any issues. This is a 24/7 system, and these BSODs are exceptionally unusual. I think overall it's been running since about 2014. All this said, it's conceivably possible that the drive happened to get significantly worse just as I installed the GPU, so I figured I'd raise the point in case the logs mention thousands of bad sectors.

To be clear, the last number of reserved sectors in use was around 200-290 as of a few months ago. It hasn't changed for years. If you're reading thousands or something, please tell me, that's probably the issue.

I do have up-to-date backups.

The SSD was pulled from another system, and although it hasn't even seen 1TB of writes, it has been sitting outside of any protective casing for a few years. I don't know if that'd cause problems.

My drivers are absolutely outdated; I'm sure on that. I can't figure out how to update them. I tried to install a new version of Intel RST, but it claims my system isn't supported by RST.. Yet I already have another version installed! Weird. It identifies its self as "Intel® Rapid Storage Technology enterprise", offers me almost zero control over anything, and I can't find another "enterprise" version for the life of me on Intel's website. I think this was included with Asus' "AI Suite", which does have an update available for it, but that thing was a pain to install and I'd like to rule out actual failing hardware if possible before I start messing around with trying to update AI Suite.

All drives are plugged into the 3G ports on my motherboard. They're controlled by an Intel controller; I don't know which one.

AHCI is enabled, BIOS is up to date (excluding beta updates), graphics drivers are up to date, OS is up to date (Except for MSRT and KB2952664, because CompatTelRunner was using nearly 100% of my disk and making my computer almost unusable), and all benchmarks run optimally, be them for the GPU or CrystalDiskMark.


So there. Support .zip is attached. Can anyone tell me if this looks like a hardware or a driver issue, and if driver, which sites to go to to try and get the latest stuff? Asus' things are all from 2014-2015. Any help is appreciated!



EDIT: I forgot to mention, Heaven doesn't have to be currently running for me to crash, I just have had to run it at any point before last booting. I can start it up, run it for ten seconds, close it, and I'll crash within half an hour.

 

[MSClin]

You don't have any driver with the name "storport.sys" or "IsStor.sys". Can you exactly write what the problematic sys driver is? And if it happens that other sys drivers appear as problem, list them all.

 

[Nofew]

If I don't have a driver using these files, why does my system crash with those files explicitly listed?

That said, I meant "IaStorA.sys", not "IsStor.sys".

Also, please excuse my potential ignorance, but how do you know this about my system if my .zip file still has 0 views? Are you sure you grabbed the right one? I once had two tabs up and grabbed the same .zip twice by mistake. D:


Anyway, to answer your question: "storport.sys", "IaStorA.sys".

 

[MSClin]

The 0 views thing is maybe a bug from the side of SevenForums, I actually reviewed your zip. I am sure I grabbed the right zip, you better be sure that you uploaded the right zip. Let's get back to the topic:

Again, you don't have any driver with the name "storport.sys".
Don't ignore these details, I really need them. If you're sure there is "storport.sys" driver in your system, well, you're not right.

The other driver ("IaStorA.sys") belongs to Intel Rapid Storage Technology. So, update your Intel Rapid Storage Technology driver - Download Intel® Rapid Storage Technology (Intel® RST)

EDIT: Sorry for my incompetence, but I missed a detail that you can't install IRST. Um, well, perhaps you can try a driver updating program then?

DriverEasy - Driver Easy Free – 3,000,000+ Users Trusted Driver Updater
Driver Booster - Download Driver Booster - The best free Nvidia, AMD, Intel & Dell driver update software for Windows 7 & above.

Though there may be a other (but risky) thing you can try:
Notice: Try this at your own risk. A boot BSOD may happen (very unlikely though).

Find your "IaStorA.sys" driver and move it to folder which is outside of the Windows folder, then restart PC. See if things are going good.

 

[axe0]

Storport.sys is a by Windows default storage controller driver.

iaStor.sys, and any similar onces, are storage controller drivers of Intel chipset.

Which sata ports are you using?


MSClin, driver updaters are a bad idea with BSODs, they tend to make things worse!

 

[torchwood]

Hi

There are some very strange errors in your logs

There are many updates that are awaiting install possibly caused by the following,

You keep getting thrown out of server connections

The Terminal Server security layer detected an error in the protocol stream and has disconnected the client.
and
Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was forcibly terminated.



Your product code appears to be for an Educational establishment, if you have since left the college they may have revoked your usage, or you might have to reregister.
showing IP's from Brazil/Sweden and others ???


please run this tool, copy/paste the output

http://go.microsoft.com/fwlink/?LinkID=52012

This may also tell me if/why your IRST drivers will not load
note there are 2 versions depending on your Bios set-up

Roy

 

[Nofew]

MSClin: I'm so sorry that I came off like I was attacking you. x.x' Please forgive me!

I've gotten new drivers with DriverEasy (after buying Pro and backing them up!), currently going for about 8 hours after running Heaven, so maybe things are improving! I'm hesitant to actually call it unless I go for at least a week without seeing storport or IaStorA, though.


axe0: Thank you for believing me about storport. o____o I now have a feeling that storport was being used when I had my SSD plugged into my 6G port and now it's only IaStorA since I'm all on 3G, even though both have Intel controllers. I think. It's the only thing that makes sense and it only came to me when I was supposed to be asleep, so I didn't post this bit as soon as I would've liked. Sorry'bout that!

Anyway, to be clear, I'm using only 3G SATA ports at the moment. My manual says those are all connected to an Intel controller. See http://dlcdnet.asus.com/pub/ASUS/mb/LGA2011/SABERTOOTH-X79/E8040_SABERTOOTH_X79_V3_WEB.pdf?_ga=2.103010691.2037951041.1512274350-681870818.1507416295 for details, page 2-2 (bottom left corner has page numbers). If that link doesn't work, poke SABERTOOTH X79 Manual| Motherboards | ASUS USA
instead and click the appropriate language.

I'd like to stress that I am very purposely avoiding the Marvel controllers, as I've heard that those are *incredibly* buggy on this particular board no matter which drivers you use. Lots of data loss showing up for tons of people. The Marvel ports are very clearly labeled on the physical motherboard, so I'm sure I'm not using them.


torchwood: What the..? Okay, that's downright *weird*. Longish story here.

Let me get the known facts out of the way first: This is a real retail copy. I bought it from Best Buy in a physical box just before they stopped selling Win7 entirely. I do still have the box, and the key is printed legibly on it, though I really don't feel like trying to dig it out to take a picture of it unless I really need to for some reason. It's under a whole bunch of stuff, along with a few extra copies of Win7 that I stockpiled when 8 was coming out because I was afraid 8'd stink.

I ran the tool you suggested and it seems to verify my claims; I see "retail" printed in a few spots, no and mention of "education". You can view screenshots over at: Imgur: The most awesome images on the Internet . (Please let me know if I need to take any pictures out of that album, I'm not entirely sure how feasible it is that someone can get my specific key with the information that's been provided.)

My IP is static and I'm in America. For obvious reasons, I won't post that overly-publicly here. The string begins with "24.".

I have Remote Desktop enabled, and I actually do use it from outside my network. I have a decidedly random password that nobody's managed to crack yet, at least as far as I can tell. Is it possible that the errors you mentioned are coming because someone tried to log in with the wrong password?


Anyway, now for the weirder stuff!

There was a long period where nobody in this entire household could get updates from Windows Update. It lasted about 15 months. One day they just stopped coming in and Windows Update kept claiming we were up to date. This happened on multiple computers, some running Win7, some running Vista. After a long time, it just magically started working again and we were missing like 40 updates on each PC. Since then we've had no trouble (that we know of) with updates.

I can't install IRST drivers from Intel because Intel's installer tells me that my hardware isn't compatible, even though I have an older version of IRST installed already. I don't know why it's telling me these things, though. I did eventually get an update for it with the tool that MSClin mentioned and am seeing how things go with that, now. My computer seems to have gone down, religiously, at about 1-4 AM (it varies significantly) for the past three nights now. We'll see if that happens tonight or not!

 

[axe0]

Revert the driver installs from driver easy, as I said they only make things worse!!

 

[Nofew]

Short post in, short post out: "And then what?"

 

[axe0]

Update your drivers manually, manually is the safest way to prevent several issues and to keep control of what is being installed.

 

[Nofew]

...Er.. Didn't I tell you twice that I can't update this one manually, because the software provided by the vendor that makes it tells me it won't let me install it? DriverEasy was suggested to get around this, and as I stated in a previous post, things seem to be improving already.

Also, the advice you're giving me (and MSClin) seems very contradictory with yourself. "Don't update it'll make things worse! OH GOSH REVERT THE UPDATES! Please update your drivers now." -- Would you mind if we rebooted our conversation and started over from a more clear point, and preferably with more technical details instead of short little responses that make me feel like you're assuming I can't work with a computer at a basic level?

 

[axe0]

Didn't I tell you twice that I can't update this one manually, because the software provided by the vendor that makes it tells me it won't let me install it? DriverEasy was suggested to get around this, and as I stated in a previous post, things seem to be improving already.

What did you try to fix the driver install issue?
Driver easy is a very improper 'workaround', such programs are known to cause problems and have even caused BSODs in the past.
Your system may feel like it's improving now, but what about the next periods? It happens frequently that the next periods result in trouble thanks to the drivers from such programs.

Also, the advice you're giving me (and MSClin) seems very contradictory with yourself. "Don't update it'll make things worse! OH GOSH REVERT THE UPDATES! Please update your drivers now.

I can understand how my previous post was interpreted, however, my only statement is to do things manually. i have been saying, over and over again to many users, that a small mistake in such utilities can cause your driver installs to become corrupted, 1 tiny mistake could lead your system unbootable with the only solution being a clean install of Windows. It's a main reason why manual driver installs are the best and safest methods.

Many use the argument, 'they install newer drivers!!', I don't recall that installing newer drivers is always better. I can recall newer drivers giving trouble, for any kind of reason, whereas older drivers don't.
Yes, newer drivers can come with security updates, but they're useless if you can't get your system to boot thanks to a small bug that came with the security update.
Yes, it is generally speaking best if you keep your drivers up to date, but 'up to date' differs per situation with the supply from the laptop/motherboard vendor and/or Windows.

Also, the advice you're giving me (and MSClin) seems very contradictory with yourself. "Don't update it'll make things worse! OH GOSH REVERT THE UPDATES! Please update your drivers now."

How so? I've only been saying to not use drivereasy for updating drivers, nothing else. MSClin has only 1 post as a suggestion for updating drivers, not a proper one IMHO but it is only 1.

 

[MSClin]

It would be better to not revert the drivers. As you said, if you can't install the driver manually, the best way would be a program (or someone who can install the driver for you).

axe0: I know that programs are not a good way to update drivers, but in case that someone can't install driver manually or he isn't sure that he download the right driver or even downloaded a driver, a program would be good. The chance to find a bug in a driver updating program when it has more than a million users is so low that you should consider yourself lucky if you do find a bug.

Your system may feel like it's improving now, but what about the next periods? It happens frequently that the next periods result in trouble thanks to the drivers from such programs.

Would you mind explaining how that happens?

Though for the thing you said to me (updating drivers in BSOD will just make it worse), this may depend. I experienced many BSODs and in most of the times it was drivers. So, sometimes updating them fix the issue, but in other - old drivers would fix it. Updating or reverting driver to old version can't make anything worse than how it is now.

 

[axe0]

A program for such tasks is never good, it is something that shouldn't be done by a program.

I can call myself lucky for having found an issue with drivereasy that caused my system to become unbootable a few years ago?
I've been there where many people are, I had installed many useless (and malicious) programs because they looked 'cool' and thought they would make things easier whilst the opposite turned true.

The next periods = the next few months, just for clarification
In the next periods there will be a couple of update releases by Windows, dozens of driver updates, dozens of software updates, dozens of changes. Realistically spoken the chance that something goes wrong is very small, speaking for the millions of users that have no problem with it. Speaking from personal BSOD experience with driver updaters, they often create threads on forums a period after they installed drivers from it and reversal or overwriting with the right drivers resolves the problem. A few days after patch tuesday threads have been created, 1/2 weeks after the previous patch tuesday the drivers were installed.

Though for the thing you said to me (updating drivers in BSOD will just make it worse), this may depend. I experienced many BSODs and in most of the times it was drivers. So, sometimes updating them fix the issue, but in other - old drivers would fix it. Updating or reverting driver to old version can't make anything worse than how it is now.

Updating drivers using driver updaters will cause BSODs.

 

[torchwood]

Hi Nofew,

There is a known problem which you seem to have that causes the D1 BSOD.
As i said previously you seem to be using multiple IP's that are failing to correctly bind and this in turn creates the Race condition referred to here, with a fix.

http://support.microsoft.com/kb/2905412

As for your IRST drivers i did mention there are 2 versions
RST and AHCI Driver and GUI

Download Intel® Rapid Storage Technology (Intel® RST)
(use the bottom set iata.enu)


The tool i asked you to run comes back clean, so no worries there.

As for drivers my mantra
OEM use thiers
Custom Build Manfacturer only

note is your firmware upto date on your expansion drive.



Roy



Roy

 

[Layback Bear]

@ Nofew

Please listen to axe0 and tourchwood. Both are giving very good advice.

A long time age I use one of those so called update driver programs and ended up doing a Clean Install to fix my system.
I only used the program once. Never again on my systems.
I manually install drivers and only the ones I care to and when I want to.

Do keep in mind, if one wants to maintain their computer their are somethings one has to learn.

Jack

 

[Nofew]

torchwood: Since backing previous Windows Updates up is more difficult (as far as I know; if there's a way, *please* tell me!), I just want to ask for clarification before throwing that update on; how sure are you that it applies to me? I imagine that if that was causing my problems, I'd get BSODs pointing to my networking drivers instead of my disk drivers. Additionally, the page you linked to says that it happens in a multiprocessor environment, and I only have one processor.

As for the drivers you liked, the first one worked! Sort of! See, the first one you linked is from 2012 and what I originally used to install the first driver in the first place; installing it again will just throw me back to square one. At the top of the page there is a link to a newer version, made in 2015, which goes to Download Intel® Rapid Storage Technology (Intel® RST) . SetupRST.exe is the one I tried that claims I don't have any compatible hardware.

The other driver you linked is even older than the first one, though it has no later version.

The drive's firmware is up to date. I'm sorry I forgot to mention that, that's probably very relevant. It was one of the first things I checked when first put the drive in this system.

Normally I'd ask what suggestion you have for me from here, but keep reading.


Everyone (especially axe0 and Layback Bear): I am no novice when it comes to disaster recovery. At the moment my system isn't in a "disaster" state (at least due to software, next paragraph'll explain) because it's just crashing more than I'd like it to, but no data is being lost and I can still try different things. Now, if I suddenly can't boot to Windows because some program installs an audio driver where there should be a disk driver or something, that would be a disaster state, I actually know how to handle this particular one and can fix it. If this does come back to haunt me two months from now, so be it, I'll deal with it, and I have the original drivers anyway. I wouldn't have followed MSClint's suggestions so quickly or willingly if I wasn't sure that I could revert them if the worst happened.

Anyway, kinda important!: Drive's failing. <.< It really was just really crazy timing. Now my BIOS doesn't even detect the drive sometimes when I try to boot and I have to keep changing its priority. This definitely isn't something a driver update would cause, considering it happens before booting and thus before any drivers are loaded. Reallocated sector count is up to 1,168. The drive appears to have fun out of sectors to reallocate; other metrics are reporting rather worrying numbers. A new drive is already on the way, and I have working backups. I'm going to try to figure out specifically which files are affected by the bad sectors that already exist, and I have some strong suspicions that we'll see the original IaStorA.sys and storport.sys files are damaged and the new driver update didn't technically fix a bug; it just utterly restored the existence of some data.

Paranoia finally hit and budget allows it, so we're goin' RAID-1 this time! Whoo!

 

[axe0]

Multiprocessor = multiple cores, your processor has 6 cores. Windows sees each core as a processor.

Now I understand why you're having problems with IRST, the one you're trying to install hasn't been made compatible with your system.

I am no novice when it comes to disaster recovery. At the moment my system isn't in a "disaster" state (at least due to software, next paragraph'll explain) because it's just crashing more than I'd like it to, but no data is being lost and I can still try different things. Now, if I suddenly can't boot to Windows because some program installs an audio driver where there should be a disk driver or something, that would be a disaster state, I actually know how to handle this particular one and can fix it. If this does come back to haunt me two months from now, so be it, I'll deal with it, and I have the original drivers anyway. I wouldn't have followed MSClint's suggestions so quickly or willingly if I wasn't sure that I could revert them if the worst happened.

It's often difficult to see what level of expertise someone has. Users often don't share much of information, they don't know what is needed and since BSOD is usually a whole new level it's standard to treat them as users who don't know much about Windows*.

Over the years I have gotten a few complaints about users who feel like I'm treating them as a child. I find it difficult to write posts in a way that they don't feel like I'm treating them as such, everyone of them needed extra instructions to complete a step and those instructions are written in a way that even users who are totally new to Windows can follow them since they will also see my posts on the internet.
That said, I can't change my writing for them since there are so many more that need those kind of instructions to understand what I'm trying to accomplish + by the time I've figured out their level of expertise they have either abandoned me or the problem is already solved.


*With 'Windows' I refer to the recovery settings, device manager, pagefile configurations and other settings that are (indirectly) related to crashes.

 

[torchwood]

Hi Nofew,

Its ALLWAYS good to sort out problems,
but with a faling drive it actually makes it near enough impossible to fix it.
You first have to identify whats in those sectors/blocks, I dont even know if theres a tool that can.
Chkdsk /r will try to correct them.

As Axe0 confirmed you do have multiple processors, and all the other pieces in the jigsaw seem to fit, i would install the hotfix.
(If this was an old rig i would have said not, but you've just rebuilt)
Theres a heirachy within the system. High and low level, if a low level driver has a dependancy on a higher level being active, it would not throw a BSOD just an event entry
device-xyz failed to start as a service upon which it depends has not started

Removing any update is an easy job, one click and your done

Regarding IRST
The tool i asked you to run, 50212, throws up specific errors in it telling me its a bad install, and its the only one i know that does, it also makes the OS non-genuine.
The standard fix is the IATA.ENU update. Even tho its dated 2012, the newer versions i believe are more for the W8, W10 and UEFI Bios set-ups.
(its also a known fact that some older drivers work better, go figure!!!)
NOTE
when applying this type of update peripherals should NOT be attached and BIOS set to default values.


Disaster recovery = Macrium


Roy

 

[Nofew]

axe0: Thank you for taking the time to explain your position to me. It actually means a lot and really helped clear the air! I often forget how forums work and that other people who might not be as knowledgeable as me with regards to certain procedures might come along with the same problem I'm having, but not be able to interpret the solution if it isn't explained delicately.

torchwood: Once the new drives come in, if I'm still crashing, I'll follow your instructions with regards to the patch.


Everyone: Aight, casualty report!

No irreplaceable files are unrecoverable. The end! (You can stop reading here if you're busy. Keep going if you want to see all detective work.)

So, I booted up SystemRescueCD, a Linux distribution that has a bunch of tools baked into it to help in situations like these. First is ddrescue. I use it to copy a raw disk to a file on another disk. When first invoked it works sequentially, but if it encounters an Unrecoverable Read Error (I'll call that a "URE" from here on out) it skips ahead a megabyte to try and clear the problem area as fast as it can and read more data, in the event that the disk is actively breaking down and you want to rescue as much as possible. Whenever it hits a URE, it makes a note of it in a special "map file" that it stores next to the data file it's creating.

Once it's done reading what it can on the first go, it reads its map file and goes to the /end/ of the problem areas, then reads 512 bytes (or 4096, if your drive is one of those) backwards at a time until it finds the real end of the problem area. It puts this data where it's supposed to go in the copy it's making, and notes the real size of the problem areas in the map file.

Finally, one it's done doing that, it'll retry the bad sectors as much as the user allows it to, either until it gets data or the disk dies.

The big critical thing here, aside from how mind-blowingly useful this tool is, is that the map file it creates has a list of all the bad sectors and their sizes!

The contents of my map file are as follows:

# Mapfile. Created by GNU ddrescue version 1.21
# Command line: ddrescue -r3 /dev/sdc /mnt/rescuedrive/DDWolf/C_Drive.img /mnt/rescuedrive/DDWolf/C_Drive.map
# Start time:   2017-12-05 14:39:04
# Current time: 2017-12-05 14:58:56
# Retrying bad sectors... Retry 1 (forwards)
# current_pos  current_status
0x299A3E5EA00     -
#      pos        size  status
0x00000000  0x299A2BF4000  +
0x299A2BF4000  0x00005000  -
0x299A2BF9000  0x0121C000  +
0x299A3E15000  0x00009000  -
0x299A3E1E000  0x00004000  +
0x299A3E22000  0x00004000  -
0x299A3E26000  0x00001000  +
0x299A3E27000  0x00004000  -
0x299A3E2B000  0x00002000  +
0x299A3E2D000  0x00002000  -
0x299A3E2F000  0x00005000  +
0x299A3E34000  0x00002000  -
0x299A3E36000  0x00001000  +
0x299A3E37000  0x00004000  -
0x299A3E3B000  0x0000E000  +
0x299A3E49000  0x0001D000  -
0x299A3E66000  0x20FD610000  +

The lines consisting of two hex values and a + or - after them are the important ones here. The first value is a location on the disk, and the second is a size. The + means that data was read from that location and it's as big as the second column specifies, and - means that there's a bad sector there, as big as the second column specifies.

"Bad sector" in this context specifically means that ddrescue encountered an URE.

So, now we have a list of all the bad sectors, and how many sectors they go on for. None of the values in the second column are /massive/; it's not like any are reading out as gigabytes, though we do have some large ones around a megabyte in size. Obviously worrying; that could be entire files missing, but it's unlikely that my entire photo library is shot, for example.

Using the information in the map file, we can determine which specific files are affected. First we need to convert one of values on the left in a row that ends with a - to decimal. 0x299A2BF4000 in decimal is 2858883694592.

Okay, easy enough! Next, we take that value and divide it by our NTFS volume's "cluster size". That'll almost always be either 512 or 4096, and does not necessarily have to match up with the physical disk's sector sizes. System Rescue CD's "ntfsinfo" command can give us that. In my case it's 4096.

2858883694592 divided by 4096 is 697969652. This means "697969652" is the specific cluster in my NTFS volume where Windows decided to store the data in question that now happens to reside in a bad sector.

SRCD's "ntfscluster" command can take a given cluster and output the name of the file (and inode) that it's associated with. Bada-bing-bada-boom, we have our file!

Note: This does not magically show what data was in that sector; all it does is help you determine what you lost. It's helpful if you want to know if you lost part of a Steam game that you can just redownload or if you lost your TurboTax file and now need to recreate it from scratch before you get in trouble. While /technically/ if you deeply understand individual file structure you might be able to use the information we've gained so far to fill a picture with padding so a .jpg or .png still opens but has a hole missing or something, that is beyond the scope of what I know well enough to feel confident in explaining right here right now.

In my case, holy cow I got so blessed. o______o All of my sectors are in the same file, and it's a Steam game, and I can just redownload the data! WHOO!

HOWEVER! Hold your horses, we're not done here yet!

This is not the first time I have rescued this drive. The map file actually lists the exact same sectors and sizes as one of my previous runs! Okay, so, drive not failing, go cancel the shipment of those new drives, right? Weeeellllll...

While creating this copy, my drive kept making really weird noises and progress kept seizing up. Although it didn't hit any new UREs, it hung for *obscene* amounts of time while trying to read data. After listening closely, I believe that the arm on my hard drive is beginning to stick and having issues moving into the proper places. This is obviously unbelievably risky as it could write over incorrect data, and it explains why I was crashing at random; data doesn't come in when it's required, system needs it *now*, bang.

The longest reads that I measured to any reasonable degree of accuracy took around 25 seconds. The usual waiting period, even on a mechanical hard drive that's under heavy load, is probably closer to a few hundred milliseconds. That's going to mess with some things.

It also explains why I sporadically appeared to have no MBR; arm didn't move into place to actually /read/ the MBR, BIOS thought the disk just didn't have one after some timeout expired, and so the disk wasn't always listed in the boot menu.



For those looking for more information, or to accomplish these steps themselves, please read the following pages:

GNU ddrescue Manual Read this *thoroughly* when you get the chance, but if a drive is failing now-now-now, the bare minimum is "ddrescue /dev/failingdrive /mnt/gooddrive/data.rescue /mnt/gooddrive/map.rescue". IF YOU ARE NEW TO LINUX, DO NOT MESS WITH ANY OF THIS! IF YOU DON'T UNDERSTAND EXACTLY WHAT THAT COMMAND IS DOING AND HOW TO MAKE IT WORK ON YOUR PARTICULAR SYSTEM, YOU CAN MAKE THINGS INFINITELY WORSE! FOLLOWING ANY STEPS IS "AT YOUR OWN RISK".

http://www.radagast.ca/linux/how-to-find-the-ntfs-filename-associated-with-a-bad-block-using-linux.html These are the specific steps to find out which files are associated with which blocks after running ddrescue. It goes into more detail than I did and contains command line syntax, which I found especially helpful since nerves tend to make me mis-type otherwise simple things.

SystemRescueCd - System Rescue Cd Homepage System Rescue CD's homepage. Click "Download" on the left, along with "Bootable USB" if you don't have or can't use an optical drive.

I know this section of my post is fairly terse, but this is a BSOD forum, not a deep data recovery and forensic forum. This should be enough to get someone who's self-motivated going. All that said, if your drive is failing right now, do not try to figure out what to do based on my text here, but instead find another page that gives more direct help more quickly for emergency situations. The way I've written things here, it'll take an average person a few weeks to figure out how to do this with no further help. Someone good with computers might take a few days. Only someone with decent Linux experience is going to be able to follow this in a time short enough to actually have a chance at saving something. While it is a good idea to read up on how to do these things just in case the worst happens and you're caught with your pants down, again, this is not a step-by-step "do this and bam you're good" guide!



Anyway, right now I'm waiting on the new drives to come in. Gunna swap stuff out once they arrive since I'm afraid of data corruption at this point; computer ain't even gunna be turned on until that's complete. I'll let'cha guys know if there's more issues or not after I've made the swap, re-imaged my data, reverted the drivers, and so on, so we know for sure, just for sake of curiosity, if I just have a failing drive or if I have a failing drive /and/ driver issues. See'ya in a few weeks!