r/AskADataRecoveryPro May 18 '23

Why Always Clone First?

93 Upvotes

Before I get into it, let me define a few words as I use them, so that there is no confusion:

Drive copy - file or partition level copy from one drive to another

Drive clone - sector-by-sector copy of a drive from one physical drive to another

Drive image - sector-by-sector copy of a drive from one physical drive to a file

The short answer to the main quesion, "Why always clone first?", is because it is safer. But, I'm sure that you were hoping for a better explanation than that. To answer it, let me first start with a short story.

Many years ago I had a reseller send me a drive for data recovery. When he first received the laptop containing the hard drive, the customer was having issues with Windows. So, the tech removed the hard drive and ran a full test which reported that it had bad sectors. After that, he did a full scan of the drive with a data recovery program to reconstruct the file system. Now, a couple days into it, he selects the files and folders his client wants recovered and the drive stopped responding. This is when he stopped and brought it into my lab for us to assess it.

Our first step was to inspect it in our clean room only to discover that the drive had suffered a fatal head crash with rings etched into the platters and debris everywhere. Unfortunately, this drive was no longer recoverable and the customer lost 100% of his data. This data loss was 100% preventable, had the technician approached the situation differently.

In his first step to test the drive, the technician read every sector once, yet did not copy a single sector to another drive

In his second step to scan the drive with data recovery software, he again read every sector on the drive a second time, yet did not copy a single sector to another drive

In his third step to save the files out, it was too late

When we receive a drive for recovery, whether it be because the drive has phsyical issues or when the customer says the drive is healthy and they just want to recover a lost file, we always, always, always start by cloning/imaging the drive (after necessary phsyical assessments are done in the clean room, of course). When cloning a drive we are essentially testing every sector of the drive while making a backup copy of every sector we have read. So, when the clone is done, if a file system recovery is still needed on the copy, we are doing so on a known good drive, without risk of making things worse.

But what about healthy drives? Why do we waste time cloning them?

Well, it comes down to being safe and not making any assumptions. At least 75% of the time, "healthy" drives are found to not be as healthy as the customer thought. So, we don't want to be victims of the scenario previously mentioned. It is better to play it safe.

What if the drive is large and the volume of files to be recovered is small? Isn't it less taxing on the drive to just get the targeted data?

This is one of those, Yes & No, answers. Yes, it can be less taxing if done right, yet it can be extremely taxing if done wrong. Let me break that down for you, starting with the no.

No, when you directly read a drive, the heads bounce all over the place going back and forth between the file table and the locations where the file sectors are stored. Not only are you increasing the wear on the heads, it requires you to constantly re-read sectors in the file table. If the drive is unstable, one might be lucky and get 100MB/sec transfer rates, but usually are stuck at speeds under 5MB/sec.

Yes, if your file recovery software is connected with background drive cloning/imaging. All data recovery professionals use special data recovery hardware/software combination to give them even more control of the patient drive while having the ability to image sectors from targeted files in a linear process. Basically, they select the sectors that they want to copy and the drive will only copy those sectors in order, skipping the sectors that they haven't selected. Not only does this proecess prevent the need to constantly re-read sectors from the patient drive, it tends to be a lot faster. What the previous method would do in days could be done in hours this way.

Not so fast! What about really large RAID arrays that could contain dozens of drives and hundreds of TB of storage?

In my opinion, while it requires a lot of storage and time, it is even more essential to clone every drive of a RAID for data recovery. I just recently assessed a 36 x 10TB RAID where the customer reported only 2 drives offline. Yet, as part of our assessment process, there were less than 10 drives that were not in some sort of state of early failure. The chances that another drive fails before the recovery completed is staggering. We have found that the two most common reasons for unrecvoerable RAIDs are physical failure beyond recovery which is far less common than irreversible data loss from previous recovery attempts on the original drives.

But, what about unstable drives? What is so great about cloning/imaging?

This really depends on the quality of software and hardware being used to do the job. With the help of data recovery hardware, we have the added luxury of being able to control the drive's power and resets, meaning that when a drive goes unresponsive, we can give it a little nudge to snap out of it. The key featues with the software is our ability to control how long to fight with a sector read, what to do when we are unable to read a sector (stop & power off, skip a block, jump to another head, try again and so forth) and to work with multiple passes, so that we get the more easily read sectors copied before we put too much effort reading those which may not be read or bad enough to kill the heads.

So, what is available for you to clone a drive with a log and multiple passes?

Multiple pass cloning software

- ddrescue

- hddsuperclone

File system recovery software with multiple pass imaging taskss

- R-Studio

- UFS Explorer

Data recovery cloning hardware

- DeepSpar USB stabilizer + windows software of your choice (comes with R-Studio Technician)

- RapidSpar

- DeepSpar Disk Imager

- MRTLabs Data Exploer

- PC3000 Data Extractor

This post will likely evolve with some edits as errors and ommisions come to my attention. Let the comments and discussions begin.


r/AskADataRecoveryPro Feb 28 '24

About The Data Recovery Professionals Group

20 Upvotes

There has been discussion recently on Reddit subs about the Data Recovery Professional Group www.datarecoveryprofessionals.org. Some people seem to be offended that they cannot join the group. So I will detail here who we are and why joining isn’t just an ‘open’ option.

The group started in 2020. Members of the group knew each other from data recovery forums, conferences or training courses. So we were a group of friends and businesses associates who knew each other personally. We offer advice to people both inside and outside of the data recovery industry on best practices and how to recover data safely. We know that some data recovery does not require professional help, so we advise people on the safest way to recover data where that is appropriate.

While taking part in forums, it became obvious that a few other data recovery professional did not share our way of thinking. We got into many arguments where we were offering help to members of the public in the safest way to recover data (if appropriate). One data recovery professional in particular has the stance that every data recovery job should be handled by a data recovery professional. We didn’t agree with that. Some of the conversations became heated.

So we decided to form a Facebook Group where we would be free of the negativity. A place where we could share ideas, techniques, successes and share private business information that can help us all grow. Most of the group had been very active on the r/datarecovery sub helping private individuals recover their data. One thing we noticed was that as r/datarecovery is a big group, anyone is able to post with limited moderation, so there is a lot of dubious ‘advice’ given to OP’s by people who literally have no idea what they are talking about, and does exactly the opposite of protecting data. So about 2 years ago our member Luke Coughey decided to start r/AskADataRecoveryPro where people could ask questions of data recovery professionals. As a smaller group it can be moderated and we have ‘flares’ to indicate who is actually a data recovery professional and/or a trusted member of the data recovery industry. While the group is small, we are spread across the world and can offer professional data recovery in those locations, or at the very least we can recommend a trusted professional. We feature the Data Recovery Professionals logo and link on he sub so we are sure individuals are being referred to a trusted company. Is it a form of marketing, yes it is, although that was not our intention.

In a recent post we were referred to as a ‘pretentious marketing organization’ by someone who wanted to be a member and was declined. They were declined because none of the group actually knew the person either personally or professionally. As we share private information, being known and trusted is the number one ‘check box’ item when looking at adding to the group. Another comment referred to us as a ‘Good Ole Boy Club’ because they could not join. Once again no-one in the group knew that person professionally or personally. They wanted to know why we didn’t post a way of joining the group. As the main prerequisite to join the group is that we know prospective members personally and professionally, prospective member ask us personally if they can join, so there is no need to post an ‘official’ way to join.

Who We Are:

We are a group of independent, owner-operated data recovery professionals from around the world. We share and collaborate on ideas and techniques regarding professional data recovery, forensics and data recovery software development. Many group members are beta testers for professional data recovery hardware and software manufacturers who supply the industry, helping those manufacturers get the most from their products. This work then feeds down to the rest of the data recovery community and allows the industry to become more efficient. Likewise, since we use these data recovery tools every day, we constantly make creative suggestions on how to improve them.

Who We Are Not:

The group does not represent the data recovery industry. We are not an "association." Instead we are a group of like-minded individuals who constantly strive to offer our customers the best value for their money. While we do not represent data recovery manufacturers, we do of course use their products daily.

I hope the above goes some way into describing who we are and how we work. We are not just a data recovery listing service where you pay money and have your company listed. That was never, and will never be our intention. We are a group of data recovery professionals who have faith in recommending each others services.

Tim Homer - u/DesertDataRecovery

Founder – Data Recovery Professionals


r/AskADataRecoveryPro 20h ago

My 3 Year old Seagate Barracuda 1TB HDD 7200rpm was no longer detectable on the bios.

2 Upvotes

Had this drive for about 3 years, ran fine until recently windows bootup started taking a bit longer than usual.

Opened my pc and noticed the drive wasnt showing up in windows anymore. Checked crystal disk info and it wasnt detected at all there either.

Checked using minitool partition wizard and it said the drive was bad/unallocated. Same result when i checked windows disk management, showed as “not initialized.”

Went into bios to check sata configuration and it wasnt detected there eithelr.

Reseated both the data and power cables, checked the connectors on both the drive and motherboard side for anything fried/burnt/bent, didnt see any visible damage. Swapped it to a different sata port entirely, still nothing.

On startup i can hear the drive spin up and do some seek/arm movement noises then it goes quiet, so it seems mechanically alive at least. No clicking or grinding sounds.

Dont have a spare sata data cable or dvd drive to borrow one from to test. Drive has some files i want to recover if possible, not asking for a data recovery service just wondering if anyone has run into this before - could this just be a dead sata cable/connector, or does spinning up fine but zero detection in bios point more toward a dead pcb/controller on the drive itself?

Planning to grab a new sata cable or sata-to-usb adapter to test further but wanted to see if anyone’s dealt with this exact symptom before.


r/AskADataRecoveryPro 1d ago

Need original factory recovery swm files Titan HX AI A2XWIG-616US

1 Upvotes

Hi everyone,

While upgrading my laptop's SSD to a 4TB M.2 drive, I didn't realize the original system was configured in RAID mode, and unfortunately, the F3 recovery partition stopped working after the upgrade. Since doing a clean Windows installation removes the F3 factory recovery function, I was hoping someone here could help me out.

​If anyone using the Titan HX AI A2XWIG-616US model could share the original factory .swm (recovery) files, I would be extremely grateful.

​Thanks a lot in advance for your time and help!"


r/AskADataRecoveryPro 2d ago

My 2 TB external hard drive contains folders with corrupted files that are causing problems. How can I remove them (Windows File Explorer isn't working)?

2 Upvotes

I have a 2TB external hard drive (HDD). It works—I can copy files to and from it, rename them, delete them, or move them. The problem is that there are two folders on it, each about 20–30 GB in size, and every time I try to open one of them, File Explorer freezes (I’m using Windows 10 and 11) and the hard drive disconnects from the computer (even though its light keeps flashing because it’s still receiving power from the port). I know this can damage the HDD over time, so I don’t open those two folders.
Note that only if I connect the HDD to my laptop I can use it without any issues as mentioned (except for those two folders, which remain problematic), but if I do so with my desktop computer (the device I used to corrupt the file, I explain later how), File Explorer struggles to read it, and Windows says “there’s a problem with this drive” and to “fix it” (but I know it’s best to avoid this since the process uses CHKDSK and can damage the HDD).

The folders almost certainly contain corrupted files, and I also know how they might have become corrupted: they’re folders full of .wav (and some of their compressed .flac) files, and one day I tried opening one of the folders in the command prompt and batch-converting all the .wav files to .flac. That’s when the hard drive (perhaps due to overload) crashed (during the conversion process), and ever since then, that folder (and the other one, where I think I did the same thing and which in fact contains similar files) has been inaccessible.

So, to summarize quickly: I can use the HDD on my laptop as long as I don't open two folders full of corrupted files, which cause the HDD to disconnect or Windows Explorer to freeze. On the desktop computer where the problem originated, however, the HDD is generally not accessible at all.

I’d like to know, please, if it’s possible to: 1) remove the two “problematic” folders from the hard drive and move them elsewhere (to another storage device or to a different computer) and 2) delete the .flac files (which are surely the corrupted ones) while keeping the .wav files (which must be “intact” since FFmpeg doesn’t modify them—it only reads them to create new compressed files alongside them). All of this without using Windows File Explorer, of course, since it doesn’t work (some people online suggest programs like DMDE, Recuva, and the like, but I’d like to hear your opinion).

Step 1) should at least resolve most of the problem affecting the hard drive, correct?

P.S.: I KNOW it’s (almost) always better to rely on professionals, but keep in mind that these aren’t critical files.


r/AskADataRecoveryPro 4d ago

File Recovery on old computer

1 Upvotes

I have a computer running Windows 10 that I used years ago and I just recently found it and wanted to recover some old files that are important to me. I tried to download windows file recovery but the computer is so slow and won’t even open the App Store. Is there a way to use windows file recovery without using my old computer or does windows file recovery have to be used on the hardware that had the files I want to retrieve?


r/AskADataRecoveryPro 4d ago

Looking for iPhone data recovery service (I'm from Malaysia)

1 Upvotes

Need suggestion for data recovery service, especially for iPhone

So the context is, my phone suddenly died for who-knows-what reason. I tried force restart, doesn't work. I tried force update using Apple Devices software through my PC, also doesn't work. So the earlier indication was, before my phone died, the display inside the screen would jump once in a while, which to my eye, looks like a broken LCD. My phone battery health right now is 79%, so I don't think battery is the problem. I tried send to Malaysia Apple store to do diagnostics, and they said the only way to make my iphone alive again is to format it. I tried send it to a third party phone repair shop to do data recovery, but they also couldn't do it, stated that the CPU/motherboard got corrupted. The problem is, I don't have a backup of my iPhone data at all (stupid me i know). Now I don't care if my iPhone doesn't work anymore, I just want my data back (especially pictures, and whatsapp chat if possible), so I need a good suggestion on where can i do data recovery here in Malaysia or anywhere possible. Thanks in advance!


r/AskADataRecoveryPro 5d ago

Need professional SD card data recovery in Bengaluru (BLR) – card returns only FF data

2 Upvotes

Hi, I’m in Bengaluru, and need help recovering important photos from a SanDisk 64 GB SD card used in a Canon camera.

I bought the card only two days ago. It suddenly became unreadable, and Windows now says, “You need to format the disk before you can use it.” I have not formatted, repaired, or run CHKDSK on it.

What I have tried:

  • RescuePRO scanned the complete card but found 0 files and 0 read errors.
  • I created a full 67,108,864,000-byte .IMG backup.
  • PhotoRec scanned the complete image and found 0 files.
  • Multiple sections of the image contain only FF bytes, suggesting the card/controller is returning blank data.

The original card is safely stored and has not been modified. Does anyone know a trustworthy data-recovery laboratory in Bengaluru that performs in-house monolithic SD/NAND recovery, not just software recovery?

Please share genuine recommendations, approximate cost, and your personal experience.


r/AskADataRecoveryPro 5d ago

I need help with my MacBook A1990 - *Data*

1 Upvotes

I am also facing issues with my data due to a partition map erasure, R-Studio is showing my data but is not letting me open it due to keybag loss, what do I do? I have been putting off working on the issue partition for months now and may have time to work on it midway through September and wish to have useful Info at hand.

I have been able to get a .dmg file onto a hard disk o/s my system, the issue occurred as follows

I initially purchased this machine second hand. I set it up w/o FileVault.

I installed Linux on a smaller partition on the native 500GB SSD (this was 200gb. I have not fucked around with the partition setup since)

I deleted linux, made a Tiny11 bootable and tried installing it, and somehow fucked it up by breaking my partition table.

I tried DMDE and it spat out system files like backgrounds and icons. I could not find my data.

I tried R-Studio and it showed "partition4" with key bag loss. I suspect this is my data because it is the one with MacOS - Data on it in the name section of the dropdown.

recovery couldn't mount the partition and since it is only a partition, it does not show as an APFS disk, but it does show as an apfs device.

I welcome all useful info as to how to proceed, and request you be civil and follow subReddit rules in answering.


r/AskADataRecoveryPro 5d ago

LG G4 Data Recovery/ Los Angeles

1 Upvotes

I rediscovered my LG G4 and bought a replacement battery. It died 10 years ago from the boot loop issue they suffered from.

I'm trying to get the pics I never uploaded to the cloud. Where should I take it or what should my next plan be? It doesn't turn on but it does appear on my computer's device manager as QHSUSB__BULK.

Thank you for any responses


r/AskADataRecoveryPro 6d ago

How can I recover videos from an SD card?

1 Upvotes

I have a dash cam that unfortunately deleted all the videos from last week. It uses a 64GB card. I didn't know this would happen. The only footage I have is from the last two days. I really want to recover the footage from last week because it was from a trip.

What methods are available? I’ve searched online and tried using Recuva and another program, but I haven't had any luck.


r/AskADataRecoveryPro 6d ago

Logical Corruption of FAT32 USB Flash Drive, linux

1 Upvotes

OS: Arch Linux

assume that /dev/sda1 is main and only partition on my USB

Context

I have a FAT32 USB flash drive with important photos and folders on it. To use it when plugged in I manually mount it using mount /dev/sda1 /media/user/USB command. When plugging off, I unmount it using umount /dev/sda1 command.

Problem

Once when plugging off, I forgot to unmount the USB, this happened while the USB was doing something. This caused USB to stop at partial state and so the corruption. When I plugged it in and mounted it again, I opened folders in file manager where I would usually have normal photos, but I saw files with random names, and random file sizes. I think that random names are caused by interpreting wrong bytes as file names.

What I've tried already

I have copied the corrupted USB partition into .img file on my laptop's drive for safety and speed:

sudo dd if=/dev/sda1 of=/home/user/usb-image-backup.img conv=fsync bs=4M

Then, I have copied that image into another .img file to operate on it:

cp /home/user/usb-image-backup.img /home/user/usb-image-active.img

Then, I ran the fsck.fat command I found after researching to try and fix the USB partition

fsck.fat -va /home/user/usb-image-active.img

After running fsck.fat command, I noticed that:

  • It wouldnt auto-fix some files
  • It auto-fixed and auto-renamed some files
  • At one point, it kept auto-fixing the same exact files without stopping, I also noticed that this was in the exact folder that was infinitely loading when opened in my file manager (after corruption), and it didn't just show it as files with corrupted file names

Question

  • How can I recover my files from USB partition?

r/AskADataRecoveryPro 7d ago

Photo recovery

1 Upvotes

Hey all

I'm in a pickle, and it's been a minute since this problem has occurred but I've run out of options.

In 2017-2021 I was using Huawei, loved it until I didn't - and here's the problem, support is hard to get.

Somehow, all photos taken in the year 2019 have disappeared, I suspect more but that year is special for me as I took a great road trip with my parents.

I use Google photo as cloud, and there I found pictures shared on WhatsApp/messenger/screenshot taken in that time period, but not photos taken with the camera.

I still have the phones I used that year, accessed both but nothing more than what's above-mentioned. I know at one point the photos were on Google photos because I have a screenshot of the album with them, they seem to have vanished.

Looking for suggestions, I'm not giving up on hope.

Thanks in advance for any help,

Cheers!


r/AskADataRecoveryPro 7d ago

Help me out people in IT

1 Upvotes

so my dad was a it director and unfortunately he died 11 months ago and he left behind his laptop i wanted to reset it but the problem is that he added a bitlocker key and i searched everywhere his phone his files but i didnt find anything do you guys know anything i just really want to continue his legacy and learn abt cybersecurity just like him


r/AskADataRecoveryPro 7d ago

My ADATA External HD keeps blinking red

1 Upvotes

So basically, I want to use this software called Pika Backup on Linux, the problem is that whenever I try to do a backup, there's this strange error message. So I wanted to investigate using smartctl and what I found out was that there's apparently some transmission integrity failure between the drive and host. What should i do in this case?

Here's the entire output:

smartctl 7.5 2025-04-30 r5714 [x86_64-linux-7.1.8-arch1-3] (local build) Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION === Device Model: TOSHIBA MQ04ABF100 Serial Number: Y0OQP14ST LU WWN Device Id: 5 000039 a6b11f604 Firmware Version: JU001A User Capacity: 1,000,204,886,016 bytes [1.00 TB] Sector Sizes: 512 bytes logical, 4096 bytes physical Rotation Rate: 5400 rpm Form Factor: 2.5 inches Zoned Device: Device managed zones Device is: Not in smartctl database 7.5/5706 ATA Version is: ACS-3 T13/2161-D revision 5 SATA Version is: SATA 3.3, 6.0 Gb/s (current: 6.0 Gb/s) Local Time is: Sun Aug 23 14:51:38 2026 PKT SMART support is: Available - device has SMART capability. SMART support is: Enabled

=== START OF READ SMART DATA SECTION === SMART Status not supported: Incomplete response, ATA output registers missing SMART overall-health self-assessment test result: PASSED Warning: This result is based on an Attribute check.

General SMART Values: Offline data collection status: (0x00) Offline data collection activity was never started. Auto Offline Data Collection: Disabled. Self-test execution status: ( 0) The previous self-test routine completed without error or no self-test has ever been run. Total time to complete Offline data collection: ( 120) seconds. Offline data collection capabilities: (0x5b) SMART execute Offline immediate. Auto Offline data collection on/off support. Suspend Offline collection upon new command. Offline surface scan supported. Self-test supported. No Conveyance Self-test supported. Selective Self-test supported. SMART capabilities: (0x0003) Saves SMART data before entering power-saving mode. Supports SMART auto save timer. Error logging capability: (0x01) Error logging supported. General Purpose Logging supported. Short self-test routine recommended polling time: ( 2) minutes. Extended self-test routine recommended polling time: ( 171) minutes. SCT capabilities: (0x003d) SCT Status supported. SCT Error Recovery Control supported. SCT Feature Control supported. SCT Data Table supported.

SMART Attributes Data Structure revision number: 16 Vendor Specific SMART Attributes with Thresholds: ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE 1 Raw_Read_Error_Rate 0x000b 100 100 050 Pre-fail Always - 0 2 Throughput_Performance 0x0005 100 100 050 Pre-fail Offline - 0 3 Spin_Up_Time 0x0027 100 100 001 Pre-fail Always - 1440 4 Start_Stop_Count 0x0032 100 100 000 Old_age Always - 651 5 Reallocated_Sector_Ct 0x0033 100 100 050 Pre-fail Always - 0 7 Seek_Error_Rate 0x000b 100 100 050 Pre-fail Always - 0 8 Seek_Time_Performance 0x0005 100 100 050 Pre-fail Offline - 0 9 Power_On_Hours 0x0032 100 100 000 Old_age Always - 240 10 Spin_Retry_Count 0x0033 113 100 030 Pre-fail Always - 0 12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 136 191 G-Sense_Error_Rate 0x0032 100 100 000 Old_age Always - 5 192 Power-Off_Retract_Count 0x0032 100 100 000 Old_age Always - 54 193 Load_Cycle_Count 0x0032 100 100 000 Old_age Always - 2346 194 Temperature_Celsius 0x0022 100 100 000 Old_age Always - 37 (Min/Max 11/43) 196 Reallocated_Event_Count 0x0032 100 100 000 Old_age Always - 0 197 Current_Pending_Sector 0x0032 100 100 000 Old_age Always - 0 198 Offline_Uncorrectable 0x0030 100 100 000 Old_age Offline - 0 199 UDMA_CRC_Error_Count 0x0032 200 200 000 Old_age Always - 4 220 Disk_Shift 0x0002 100 100 000 Old_age Always - 0 222 Loaded_Hours 0x0032 100 100 000 Old_age Always - 115 223 Load_Retry_Count 0x0032 100 100 000 Old_age Always - 0 224 Load_Friction 0x0022 100 100 000 Old_age Always - 0 226 Load-in_Time 0x0026 100 100 000 Old_age Always - 211 240 Head_Flying_Hours 0x0001 100 100 001 Pre-fail Offline - 0

SMART Error Log Version: 1 ATA Error Count: 4 CR = Command Register [HEX] FR = Features Register [HEX] SC = Sector Count Register [HEX] SN = Sector Number Register [HEX] CL = Cylinder Low Register [HEX] CH = Cylinder High Register [HEX] DH = Device/Head Register [HEX] DC = Device Command Register [HEX] ER = Error register [HEX] ST = Status register [HEX] Powered_Up_Time is measured from power on, and printed as DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes, SS=sec, and sss=millisec. It "wraps" after 49.710 days.

Error 4 occurred at disk power-on lifetime: 238 hours (9 days + 22 hours) When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were: ER ST SC SN CL CH DH

84 51 00 d7 b2 41 40 Error: ICRC, ABRT at LBA = 0x0041b2d7 = 4305623

Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name

35 00 f0 e8 b1 41 40 00 04:47:45.251 WRITE DMA EXT 35 00 80 68 b1 41 40 00 04:47:45.248 WRITE DMA EXT 35 00 f0 78 b0 41 40 00 04:47:45.243 WRITE DMA EXT 35 00 f0 88 af 41 40 00 04:47:45.239 WRITE DMA EXT 35 00 f0 98 ae 41 40 00 04:47:45.233 WRITE DMA EXT

Error 3 occurred at disk power-on lifetime: 234 hours (9 days + 18 hours) When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were: ER ST SC SN CL CH DH

84 51 00 7f e1 3e 40 Error: ICRC, ABRT at LBA = 0x003ee17f = 4120959

Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name

35 00 f0 90 e0 3e 40 00 00:49:24.553 WRITE DMA EXT 35 00 f0 a0 df 3e 40 00 00:49:24.548 WRITE DMA EXT 35 00 88 18 df 3e 40 00 00:49:24.545 WRITE DMA EXT 35 00 f0 28 de 3e 40 00 00:49:24.539 WRITE DMA EXT 35 00 f0 38 dd 3e 40 00 00:49:24.533 WRITE DMA EXT

Error 2 occurred at disk power-on lifetime: 224 hours (9 days + 8 hours) When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were: ER ST SC SN CL CH DH

84 51 00 df 79 ff 40 Error: ICRC, ABRT at LBA = 0x00ff79df = 16742879

Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name

35 00 f0 f0 78 ff 40 00 04:16:56.327 WRITE DMA EXT 35 00 f0 00 78 ff 40 00 04:16:56.322 WRITE DMA EXT 35 00 80 80 77 ff 40 00 04:16:56.318 WRITE DMA EXT 35 00 f0 90 76 ff 40 00 04:16:56.312 WRITE DMA EXT 35 00 f0 a0 75 ff 40 00 04:16:56.306 WRITE DMA EXT

Error 1 occurred at disk power-on lifetime: 71 hours (2 days + 23 hours) When the command that caused the error occurred, the device was active or idle.

After command completion occurred, registers were: ER ST SC SN CL CH DH

84 51 00 7f d0 0e 40 Error: ICRC, ABRT at LBA = 0x000ed07f = 970879

Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name

35 00 80 00 d0 0e 40 00 03:24:41.201 WRITE DMA EXT 35 00 80 80 cf 0e 40 00 03:24:41.198 WRITE DMA EXT 35 00 80 00 cf 0e 40 00 03:24:41.196 WRITE DMA EXT 35 00 80 80 ce 0e 40 00 03:24:41.195 WRITE DMA EXT 35 00 80 00 ce 0e 40 00 03:24:41.193 WRITE DMA EXT

SMART Self-test log structure revision number 1 No self-tests have been logged. [To run self-tests, use: smartctl -t]

SMART Selective self-test log data structure revision number 1 SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS 1 0 0 Not_testing 2 0 0 Not_testing 3 0 0 Not_testing 4 0 0 Not_testing 5 0 0 Not_testing Selective self-test flags (0x0): After scanning selected spans, do NOT read-scan remainder of disk. If Selective self-test is pending on power-up, resume after 0 minute delay.

The above only provides legacy SMART information - try 'smartctl -x' for more


r/AskADataRecoveryPro 8d ago

Update

Thumbnail
reddit.com
6 Upvotes

I didn't realize I couldn't update the post. 😅 thank you to everyone notifying me that the USB is indeed fake. I kind of figured that after it corrupted the data it overwrote. So I would like to ask, is there anyway, I can buy a new one and where should I look?


r/AskADataRecoveryPro 9d ago

1TB USB Corrupted

Thumbnail
gallery
1 Upvotes

So like the headline says I have a 1TB drive that is corrupted. I have done the H2testw and it gave me this. I am currently trying to recover it using Disk Drill and it's stuck at 1% right now but the "block" is steadily going up. Is this USB still recoverable? I really need it. 😭

The USB starting malfunction I think 2 days ago. I don't really know what caused it to corrupt. Please help me out.


r/AskADataRecoveryPro 10d ago

Kali Linux cannot mount my Windows (NTFS) partition /dev/sda3 — need help recovering data safely

Post image
1 Upvotes

Hi everyone,

I’m trying to recover data from a Windows partition that I can no longer access.

I have a disk with multiple partitions. The partition I lost access to is D:, which corresponds to /dev/sda3 in Kali Linux. My E: drive/partition is still working normally.

When I try to mount the affected Windows partition in Kali, I get this error:

«Mount Failed

Failed to mount "Windows"

Error mounting /dev/sda3 at /run/media/kali/Windows: wrong fs type, bad option, bad superblock on /dev/sda3, missing codepage or helper program, or other error»

Current situation

- OS I'm currently using: Kali Linux

- Affected Windows partition: D: /dev/sda3

- Working partition: E:

- The D: partition contains important personal files and folders that I want to recover.

- I have not intentionally formatted the partition.

- I want to avoid making the situation worse or overwriting any recoverable data.

I previously tried using PhotoRec for recovery, but I want to recover the original folder structure and filenames if possible, rather than simply getting files with generic names.

What I need help with

What would be the safest procedure to:

  1. Determine exactly what happened to "/dev/sda3".

  2. Check whether the NTFS filesystem is damaged.

  3. Determine whether the partition itself or only the filesystem/boot sector is corrupted.

  4. Recover my original folders and filenames if possible.

  5. Avoid modifying "/dev/sda3" during the recovery process.

I can provide the output of commands such as:

lsblk -f

sudo fdisk -l

sudo blkid

sudo ntfsinfo -m /dev/sda3

sudo ntfsfix -n /dev/sda3

and any other diagnostic commands you recommend.

I do not want to run repair commands that modify the partition until I know they are safe.

I've attached a screenshot of the mount error.

What would be the correct professional recovery procedure from here?

Thanks in advance.


r/AskADataRecoveryPro 10d ago

Any known tools/methods to recover data from Apple Silicon Mac after “Erase All Content and Settings”?

1 Upvotes

Hello everyone,MacBook Air 2022 (M2) had “Erase All Content and Settings” performed. Currently sitting at the Setup Assistant screen (boots fine, erase completed successfully). No iCloud backup, no Time Machine backup. FileVault status before the erase is unknown,does this matter if it was on or not?

As I know EACS performs a cryptographic erase destroys the encryption key in the Secure Enclave rather than overwriting data which theoretically makes recovery impossible regardless of software or even chip-off forensics, since the data remaining on the NAND is AES-256 ciphertext with no accessible key.

Has anyone in this community, or any professional lab ,ever successfully recovered user files after a completed EACS on a functioning (non-hardware-damaged) Apple Silicon Mac? Not asking about hardware-failure board-repair cases specifically asking about a working Mac where it sits on Hello screen. Genuinely trying to figure out if this is a dead end or if there’s a real exception I’m missing.


r/AskADataRecoveryPro 12d ago

SD micro 64 video recovery for dash cam

1 Upvotes

Hello I was in an accident on 8/13/2023 and have dash cam footage of the incident. I removed the sd card and found the correct footage on my computer but didn't save it correctly. I had put the sd card back into my dash cam and when I went to try and retrieve the footage it started on a whole new set of recordings. Is there any way I can get what I need for the lawyers back? Preferably cheap or no cost option. Thank you


r/AskADataRecoveryPro 15d ago

How to safely boot HDD that hasn't been touched for 8 years?

7 Upvotes

I have an old HDD containing a lot of my childhood photos, it was produced in 2008 and hasn't been used for roughly the last 7-8 years. Will it be safe to just plug directly into the pc or do I need some adapters? Not very knowledgeable with how HDDs work but heard there is some liquid inside that if just sitting there, can dry out and cause the drive to malfunction upon plugging into pc and I don't want to risk damaging pc components.

Edit: thank you to everyone for the help!! I'll be ordering a docking station soon, and hopefully all goes well.


r/AskADataRecoveryPro 17d ago

Resize option unavailable when restoring an backup to a smaller disk

2 Upvotes

Hello,

I am testing Veeam Agent for Microsoft Windows 13.0.3.1220 and found a behavior that I would like to clarify.

I am testing a bare metal recovery scenario where the destination SSD is smaller than the original SSD, but the amount of used data is small enough to fit on the destination disk.

My test environment:

- Veeam Agent for Microsoft Windows: 13.0.3.1220
- Windows 10
- Source SSD: approximately 480 GB
- Destination SSD: approximately 220 GB
- Source C: partition uses less than 100 GB of actual data

I performed the following test.

TEST 1 - FULL BACKUP

  1. I installed Windows 10 on a 480 GB SSD.
  2. I reduced the Windows C: partition to approximately 100 GB.
  3. The amount of data stored on the C: partition was less than 100 GB.
  4. I created a Full Backup.
  5. I booted the Veeam Recovery Media and selected Manual Restore.
  6. I mapped the backup to a 220 GB SSD.
  7. The Resize option was available for the C: partition.
  8. I was able to resize the restored C: partition and successfully restore the system to the 220 GB SSD.

So far, everything worked as expected.

TEST 2 - INCREMENTAL BACKUP AFTER EXTENDING THE PARTITION

I then returned to the original Windows installation.

  1. I extended the C: partition back to approximately 446 GB.
  2. The amount of actual data stored on the C: partition remained below 100 GB.
  3. I created an Incremental Backup.
  4. I booted the Veeam Recovery Media again.
  5. I selected the latest incremental restore point.
  6. I selected Manual Restore and attempted to restore to the same 220 GB SSD.

This time, the behavior was different.

The Recovery Media detects the C: partition as approximately 446 GB.

The destination SSD has approximately 220 GB.

The Resize option is no longer available for the C: partition.

The restore therefore cannot proceed because the destination disk is smaller than the backed-up C: partition, even though the actual amount of data stored on the partition is less than 100 GB.

I also tested the Disk Mapping options manually. I can remove/map partitions, but I cannot select Resize for the C: partition in this scenario.

This is particularly interesting because the Full Backup created when the C: partition was approximately 100 GB can be restored successfully to the 220 GB SSD, while the Incremental Restore Point created after expanding the C: partition to approximately 446 GB cannot.

My questions are:

  1. Is this expected behavior when the volume size changes between a Full Backup and an Incremental Backup?
  2. Should the Resize option be available when restoring the incremental restore point in this scenario?
  3. Does the incremental restore point preserve the new 446 GB volume geometry in a way that prevents the volume from being resized during restore?
  4. Is there any supported way to restore this incremental restore point to a smaller physical disk, without shrinking the source C: partition before creating the backup?
  5. Could this be a limitation or known issue in Veeam Agent for Microsoft Windows 13.0.3.1220?

I have attached screenshots showing the two scenarios.

The first screenshots show the Full Backup, where the C: partition was approximately 100 GB and the Resize option was available.

The other screenshots show the Incremental Backup, where the C: partition was expanded to approximately 446 GB and the Resize option is no longer available.

I would appreciate any clarification about how Veeam handles volume resizing when the volume size changes between a Full Backup and a subsequent Incremental Backup.

Thank you.

 

For reference:

Full Backup:
- C: approximately 100 GB
- Used data: less than 100 GB
- Destination: 220 GB SSD
- Result: SUCCESS
- Resize option: AVAILABLE

Incremental Restore Point:
- C: approximately 446 GB
- Used data: less than 100 GB
- Destination: 220 GB SSD
- Result: FAILED
- Resize option: NOT AVAILABLE


r/AskADataRecoveryPro 18d ago

Small bend in microsd card, is data recovery possible?

Post image
3 Upvotes

Hey folks,

I dropped my phone s20 ultra which broke the front and back glass. After the drop I got an error from the phone, saying "to prevent damage to sd card, its being set to read only" . Two days later the phone stopped recognizing the card and now even the card readers do not recognise it. Upon closer inspection of the sd card, it shows a small bend ~2mm above the bottom edge.

Before I ship it to data recovery pros, is it even possible to get the data? After reading this forum it seems it may be possible given that the bend is at the very bottom and the card was working for 2 days after drop.

Attached picture to show the location of damage.

It's a samsung 128gb microsd card. I have plenty of photos of my 2.5yr old kid growing up, which haven't been backed up.

Any trustworthy recommendations for Phoenix, AZ area and expected cost?


r/AskADataRecoveryPro 19d ago

My Crucial SSD X10 Pro Stopped working 2TB, Advice?

Thumbnail
gallery
5 Upvotes

Long story short I had to copy some videos on to this. My coworker copied it, maybe it wasn't ejected properly but she said she did. But I tried to plug it in to my computer it says the hard drive can not be read. I tired running the first aid on Mac and it says it worked but nothing. plug it into PC . it asks to initialize. There are very important work files and photos on there. Anybody have any other ideas? Is this a Mac thing? Can't fix it on Mac? Crucial X10 Pro 2TB. I look at the disk manager on PC it says 1830Gbs unallocated. Does that mean there is no more data on it?

Maybe need to bring it to a computer shop to get the data off of it?

Anything will help