OTish: Fixing NTFS drive with bad blocks

[[e-mail]]

Hi All,

I am running Ubuntu on my file server and noticed in dmesg a load of the following errors (there are a lot of other lines per instance but this seems to be the main one)

blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0

The line is always the same so assumed there is one sector which is giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847

They are contiguous so thought this seemed to align with the previous error found. Looking online people seem to say that the linux tools are poor and to use Windows chkdsk. So...I found an old Win 7 rescue CD so booted it with this and tried running chkdsk. This gave me loads of "attribute list for file x is corrupt" (where x is a different number each time).

Now unsure whether the disk is actually in worse state than I thought or maybe the chkdsk errors are because the ntfs disk is accessed only via Ubuntu and there is some sort of "compatibility" issue between them or something.

Anyone have any ideas?

thanks

Lee.

[NY]

Post by ***@yahoo.co.uk
Hi All,
I am running Ubuntu on my file server and noticed in dmesg a load of the
following errors (there are a lot of other lines per instance but this
seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ)
flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is giving
a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847
They are contiguous so thought this seemed to align with the previous
error found. Looking online people seem to say that the linux tools are
poor and to use Windows chkdsk. So...I found an old Win 7 rescue CD so
booted it with this and tried running chkdsk. This gave me loads of
"attribute list for file x is corrupt" (where x is a different number each
time).
Now unsure whether the disk is actually in worse state than I thought or
maybe the chkdsk errors are because the ntfs disk is accessed only via
Ubuntu and there is some sort of "compatibility" issue between them or
something.
Anyone have any ideas?

I have an external USB HDD that was formatted with NTFS on Windows, which
I've used extensively on both Ubuntu and Raspberry PiOS. Both Linuxes have
been able to read *and write* perfectly and I've never had any bad blocks in
about 3 years of daily usage (the Pi runs TVHeadend video-recorder software
which writes all its recordings to the NTFS drive). But even with NTFS,
errors can occur. Almost always, when "chkdsk" does report errors, "chkdsk
/f" repairs them, no errors are reported on a subsequent chkdsk (without
/f), and files all seem to be intact. But I may just have been very lucky...

I'm inclined to trust Windows chkdsk more than a Linux equivalent, because
NTFS is native to Windows. If you don't have confidence in the HDD's
filesystem, I suggest you bite the bullet and copy everything off it onto
another drive on a Windows computer, do a full (not "quick") format of the
drive and then copy everything back again. You may manage with just "chkdsk
/f" to repair the filesystem, but you may want to play it safe and reformat.

The question is: is it better to copy the contents and *then* do "chkdsk /f"
or to do the chkdsk first and then copy the data? Depends whether chkdsk /f
will make things any worse. My gut feeling is copy first then try to repair.
Then if you are real glutton for punishment, copy again to another folder
structure and compare file for file ;-)

[Rod Speed]

Post by NY

Post by ***@yahoo.co.uk
I am running Ubuntu on my file server and noticed in dmesg a load of the
following errors (there are a lot of other lines per instance but this
seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ)
flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is
giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847
They are contiguous so thought this seemed to align with the previous
error found. Looking online people seem to say that the linux tools are
poor and to use Windows chkdsk. So...I found an old Win 7 rescue CD so
booted it with this and tried running chkdsk. This gave me loads of
"attribute list for file x is corrupt" (where x is a different number
each time).
Now unsure whether the disk is actually in worse state than I thought or
maybe the chkdsk errors are because the ntfs disk is accessed only via
Ubuntu and there is some sort of "compatibility" issue between them or
something.
Anyone have any ideas?

I have an external USB HDD that was formatted with NTFS on Windows, which
I've used extensively on both Ubuntu and Raspberry PiOS. Both Linuxes have
been able to read *and write* perfectly and I've never had any bad blocks
in about 3 years of daily usage (the Pi runs TVHeadend video-recorder
software which writes all its recordings to the NTFS drive). But even with
NTFS, errors can occur. Almost always, when "chkdsk" does report errors,
"chkdsk /f" repairs them, no errors are reported on a subsequent chkdsk
(without /f), and files all seem to be intact. But I may just have been
very lucky...
I'm inclined to trust Windows chkdsk more than a Linux equivalent, because
NTFS is native to Windows. If you don't have confidence in the HDD's
filesystem, I suggest you bite the bullet and copy everything off it onto
another drive on a Windows computer, do a full (not "quick") format of the
drive and then copy everything back again. You may manage with just
"chkdsk /f" to repair the filesystem, but you may want to play it safe and
reformat.
The question is: is it better to copy the contents and *then* do "chkdsk
/f" or to do the chkdsk first and then copy the data? Depends whether
chkdsk /f will make things any worse. My gut feeling is copy first then
try to repair. Then if you are real glutton for punishment, copy again to
another folder structure and compare file for file ;-)

The drive has some bad sectors.

[Rod Speed]

Post by Rod Speed

Post by NY
The question is: is it better to copy the contents and *then* do "chkdsk
/f" or to do the chkdsk first and then copy the data? Depends whether
chkdsk /f will make things any worse. My gut feeling is copy first then
try to repair. Then if you are real glutton for punishment, copy again
to another folder structure and compare file for file ;-)

The drive has some bad sectors.

Yes. So there may be irrecoverable file corruption at those points. But at
least reformatting the drive should map out those sectors (any others that
are starting to fail) so they don't get used in future.

With modern drives all you have to do is copy the file which
has the bad sector in it to see the bad sector reallocated.

But the fact that there is a bad sector usually means that the drive is
dying.

Not always, a few drives will produce a bad sector if the supply to the
drive fails while it is being written, but that isn't common at all anymore.

The safest option with a drive that is getting bad blocks is to copy all
the data off, hoping that the data loss is negligible, and copy it onto a
*new* drive - and then destroy (*) and discard the old one.

That’s not what you proposed previously.

Hopefully the new drive is not a very expensive large-capacity one. The
other month I accidentally dropped a 4 TB USB drive that I use as a backup
drive. It still spins (surprisingly) but the shock must have damaged the
head-tracking mechanism because it shuts down a few seconds later. I
didn't lose any data, but I lost £80 to buy a new copy, and many hours
(unattended) to create a new full backup from the SATA drives in my
"server" PC.
(*) Hammering a 6" nail through the platters, slightly off-centre, is a
pretty sure-fire way of making sure that nobody will ever read the data
again ;-)

You don’t need to go that far with a drive with a bad sector, just wipe the
drive.

And it's *so* satisfying, especially if the patters are ceramic and you
can hear the tinkling of broken platters when you shake the drive ;-)

I'd have you publicly flogged if you hadn't so
obviously enjoyed that so much the last time.
{-(

[Peeler]

On Sun, 9 Jan 2022 09:30:29 +1100, cantankerous trolling geezer Rodent
Speed, the auto-contradicting senile sociopath, blabbered, again:

<FLUSH the abnormal trolling senile cretin's latest trollshit unread>

[Peeler]

On Sun, 9 Jan 2022 08:37:08 +1100, cantankerous trolling geezer Rodent
Speed, the auto-contradicting senile sociopath, blabbered, again:

<FLUSH the abnormal trolling senile cretin's latest trollshit unread>

[Adrian Caspersz]

Post by ***@yahoo.co.uk
Hi All,
I am running Ubuntu on my file server and noticed in dmesg a load of the following errors (there are a lot of other lines per instance but this seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847

Before that, what is the drive SMART health say?

Plenty of tools for that, like https://www.smartmontools.org/

For a spinning drive if you see, 'reallocated sector count' anything but
zero, or a silly 'head load count' I would not trust the drive with
anything.

[The Natural Philosopher]

but as far as I can see there are no reallocated sectors and SMART is not registering any errors.
1 Raw_Read_Error_Rate 0x002f 200 200 051 Pre-fail Always - 20699

That is a FUCK of a lot of errors
from this machines ssd


Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE
UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x0032 100 100 050 Old_age Always
- 0


You should be able to strip the data off though fairly well.

[Rod Speed]

Post by ***@yahoo.co.uk

Post by Adrian Caspersz

Post by ***@yahoo.co.uk
I am running Ubuntu on my file server and noticed in dmesg a load of
the following errors (there are a lot of other lines per instance but
this seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ)
flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is
giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847

Before that, what is the drive SMART health say?
Plenty of tools for that, like https://www.smartmontools.org/
For a spinning drive if you see, 'reallocated sector count' anything but
zero, or a silly 'head load count' I would not trust the drive with
anything.

Hi All,
Thanks for all the suggestions. I have run smartctl (output
below) but as far as I can see there are no reallocated
sectors and SMART is not registering any errors.

It is showing a single pending sector reallocation
see below in the SMART report.

Post by ***@yahoo.co.uk
How would I determine which file has the bad blocks
in it to force the reallocation as some have suggested?

Paul listed a ute that will do that.

Post by ***@yahoo.co.uk
Only other info I can add is that I have noticed a file I can't
seem to delete. If you do a "ls -l" on the directory I get
-????????? ? ? ? ? ? 20160913_110018.jpg.tmp

Likely that is just the funny name that prevents that.

Post by ***@yahoo.co.uk
Wonder if this is the file in question?
This is the output from "smartctl -a"
smartctl 7.1 2019-12-30 r5022 [x86_64-linux-5.4.0-92-generic] (local
build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke,
www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Family: Western Digital Red
Device Model: WDC WD30EFRX-68EUZN0
Serial Number: WD-WCC4N1002037
LU WWN Device Id: 5 0014ee 20a0f3b81
Firmware Version: 80.00A80
User Capacity: 3,000,592,982,016 bytes [3.00 TB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: 5400 rpm
Device is: In smartctl database [for details use: -P show]
ATA Version is: ACS-2 (minor revision not indicated)
SATA Version is: SATA 3.0, 6.0 Gb/s (current: 3.0 Gb/s)
Local Time is: Sun Jan 9 17:37:14 2022 GMT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
Offline data collection status: (0x00) Offline data collection activity
was never started.
Auto Offline Data Collection: Disabled.
Self-test execution status: ( 0) The previous self-test routine
completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: (39900) seconds.
Offline data collection
capabilities: (0x7b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 2) minutes.
Extended self-test routine
recommended polling time: ( 400) minutes.
Conveyance self-test routine
recommended polling time: ( 5) minutes.
SCT capabilities: (0x703d) SCT Status supported.
SCT Error Recovery Control supported.
SCT Feature Control supported.
SCT Data Table supported.
SMART Attributes Data Structure revision number: 16
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED
WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x002f 200 200 051 Pre-fail
s - 20699
3 Spin_Up_Time 0x0027 176 171 021 Pre-fail
s - 6183
4 Start_Stop_Count 0x0032 100 100 000 Old_age
ys - 418
5 Reallocated_Sector_Ct 0x0033 200 200 140 Pre-fail
s - 0
7 Seek_Error_Rate 0x002e 100 253 000 Old_age
ys - 0
9 Power_On_Hours 0x0032 023 023 000 Old_age
ys - 56704
10 Spin_Retry_Count 0x0032 100 100 000 Old_age
ys - 0
11 Calibration_Retry_Count 0x0032 100 100 000 Old_age
ys - 0
12 Power_Cycle_Count 0x0032 100 100 000 Old_age
ys - 415
192 Power-Off_Retract_Count 0x0032 200 200 000 Old_age
ys - 219
193 Load_Cycle_Count 0x0032 195 195 000 Old_age
ys - 17353
194 Temperature_Celsius 0x0022 119 102 000 Old_age
ys - 31
196 Reallocated_Event_Count 0x0032 200 200 000 Old_age
ys - 0
197 Current_Pending_Sector 0x0032 200 200 000 Old_age
ys - 1

That’s the problem, that’s the bad sector which won't
be reallocated until you attempt to write to it.

Post by ***@yahoo.co.uk
198 Offline_Uncorrectable 0x0030 100 253 000 Old_age
line - 0
199 UDMA_CRC_Error_Count 0x0032 200 200 000 Old_age
ys - 0
200 Multi_Zone_Error_Rate 0x0008 100 253 000 Old_age
line - 0
SMART Error Log Version: 1
No Errors Logged
SMART Self-test log structure revision number 1
Num Test_Description Status Remaining
LifeTime(hours) LBA_of_first_error
# 1 Conveyance offline Completed without error 00%
0 -
# 2 Short offline Completed without error 00%
0 -
SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute
delay.
Thanks again for all your help

[Peeler]

On Mon, 10 Jan 2022 06:03:47 +1100, cantankerous trolling geezer Rodent
Speed, the auto-contradicting senile sociopath, blabbered, again:

<FLUSH the abnormal trolling senile cretin's latest trollshit unread>

[[e-mail]]

<snip>

Post by Rod Speed

Post by ***@yahoo.co.uk
Only other info I can add is that I have noticed a file I can't
seem to delete. If you do a "ls -l" on the directory I get
-????????? ? ? ? ? ? 20160913_110018.jpg.tmp

Likely that is just the funny name that prevents that.

The filename is "20160913_110018.jpg.tmp" the '?'s are where the date and ownership etc should be. When I try to do anything to the file (e.g. stat 20160913_110018.jpg.tmp results in an I/O error) so there is something very dodgy about this file.

<snip>

Post by Rod Speed

Post by ***@yahoo.co.uk
ys - 0
197 Current_Pending_Sector 0x0032 200 200 000 Old_age
ys - 1

That’s the problem, that’s the bad sector which won't
be reallocated until you attempt to write to it.

Any idea how I would do that?

In terms of the utilities Paul mentioned in his post, I cant see one that will enable me to find out which file is allocated to the dodgy blocks in question. Am I being dozy? Is there any way of correlating these blocks with the "Current_Pending_Sector" one to check it is all the same problem? The dodgy file above was created by an old android app I use to auto backup my phone photos to my server so maybe there is a bug in that that caused the problem?

[Rod Speed]

Post by ***@yahoo.co.uk

Post by Rod Speed

Post by ***@yahoo.co.uk
Only other info I can add is that I have noticed a file I can't
seem to delete. If you do a "ls -l" on the directory I get
-????????? ? ? ? ? ? 20160913_110018.jpg.tmp

Likely that is just the funny name that prevents that.

The filename is "20160913_110018.jpg.tmp"

Yeah, that’s the one I meant, with two . in it.

Post by ***@yahoo.co.uk
the '?'s are where the date and ownership etc should be.

Yeah, that was obvious.

Post by ***@yahoo.co.uk
When I try to do anything to the file (e.g. stat 20160913_110018.jpg.tmp
results in an I/O error) so there is something very dodgy about this file.

Likely with copys etc, but that shouldn’t prevent it being deleted.

Post by ***@yahoo.co.uk
<snip>

Post by Rod Speed

Post by ***@yahoo.co.uk
ys - 0
197 Current_Pending_Sector 0x0032 200 200 000 Old_age
ys - 1

That’s the problem, that’s the bad sector which won't
be reallocated until you attempt to write to it.

Any idea how I would do that?

Delete the file that uses it and it will be reallocated when it
attempts to write a new file to that sector and fails to do that.

One of the utes that wipes free space should write to
that sector once you have deleted the file that uses it.

Post by ***@yahoo.co.uk
In terms of the utilities Paul mentioned in his post,
I cant see one that will enable me to find out which
file is allocated to the dodgy blocks in question.
Am I being dozy?

No, I was saying that from memory and meant to check
Paul's post again before I posted. He used the rescue log
with you don’t have.

I'd try deleting the file that you initially was getting
the error report about and see if that sees the sector
get reallocated when you wipe the free space.

Post by ***@yahoo.co.uk
Is there any way of correlating these blocks with the
"Current_Pending_Sector" one to check it is all the
same problem?

Yes, you already know the bad block numbers but
its suspicious that you have 4 of them and only one
pending sector. There are multiple sectors per block.

I'd try the delete and wipe first.

Post by ***@yahoo.co.uk
The dodgy file above was created by an old android app
I use to auto backup my phone photos to my server so
maybe there is a bug in that that caused the problem?

Yeah that’s quite possible and it may well not have anything
at all to do with the current problem of a pending sector.

[Peeler]

On Mon, 10 Jan 2022 08:38:25 +1100, cantankerous trolling geezer Rodent
Speed, the auto-contradicting senile sociopath, blabbered, again:

<FLUSH the abnormal trolling senile cretin's latest trollshit unread>

[John Walliker]

On Sunday, 9 January 2022 at 21:58:51 UTC, Peeler wrote:


One of the earlier posters recommended copying the drive before attempting
any kind of repair. The GNU version of ddrescue was mentioned. It really
is a good idea to copy the drive using gnu ddrescue and then try to repair a
duplicate of that copy rather than trying to repair the original. I have learned
this the hard way.

John

[The Natural Philosopher]

Post by ***@yahoo.co.uk
The filename is "20160913_110018.jpg.tmp" the '?'s are where the date
and ownership etc should be. When I try to do anything to the file
(e.g. stat 20160913_110018.jpg.tmp results in an I/O error) so there
is something very dodgy about this file.

Yes.
Well the answer becomes very simple. Copy every other file off, onto a
shiny new drive.

If you want to recover that file you probably need to use something like
DD and a third drive to copy the dead one to, but honestly, do you care?
If you totted up the time you and others here have already spent on this
we could all have donated 50p and you would have the cost of two new
drives covered.

Trust the collected experience of IT professionalsand ex professionals -
once a modern drive shows any errors at all that chkdsk and friends
cannot fix, its time to bin the drive.

I think you have had a head crash - disk powered off while spinning with
head over a sector, and its gouged out some material. Where that has
ended up is the problem. Once you have trash inside a drive it will get
worse

[Rod Speed]

Post by The Natural Philosopher

Post by ***@yahoo.co.uk
The filename is "20160913_110018.jpg.tmp" the '?'s are where the date
and ownership etc should be. When I try to do anything to the file
(e.g. stat 20160913_110018.jpg.tmp results in an I/O error) so there
is something very dodgy about this file.

Yes.
Well the answer becomes very simple. Copy every other file off, onto a
shiny new drive.
If you want to recover that file you probably need to use something like
DD and a third drive to copy the dead one to, but honestly, do you care?
If you totted up the time you and others here have already spent on this
we could all have donated 50p and you would have the cost of two new
drives covered.
Trust the collected experience of IT professionalsand ex professionals -
once a modern drive shows any errors at all that chkdsk and friends cannot
fix, its time to bin the drive.
I think you have had a head crash - disk powered off while spinning with
head over a sector, and its gouged out some material.

I don’t. You would have a lot more than one pending sector in that case.

And modern drives retract the heads on a power failure
so you don’t get a head crash on a power failure.

A few drives will produce a bad sector if the power
fails when writing to a sector, but most don’t do that.

Post by The Natural Philosopher
Where that has ended up is the problem. Once you have trash inside a drive
it will get worse

You haven't established that there is trash inside the drive.

[Peeler]

On Tue, 11 Jan 2022 04:05:42 +1100, cantankerous trolling geezer Rodent
Speed, the auto-contradicting senile sociopath, blabbered, again:

<FLUSH the abnormal trolling senile cretin's latest trollshit unread>

[Paul]

Post by ***@yahoo.co.uk

Post by Adrian Caspersz

Post by ***@yahoo.co.uk
Hi All,
I am running Ubuntu on my file server and noticed in dmesg a load of the following errors (there are a lot of other lines per instance but this seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847

Before that, what is the drive SMART health say?
Plenty of tools for that, like https://www.smartmontools.org/
For a spinning drive if you see, 'reallocated sector count' anything but
zero, or a silly 'head load count' I would not trust the drive with
anything.
--
Adrian C

Hi All,
Thanks for all the suggestions. I have run smartctl (output below) but as far as I can see there are no reallocated sectors and SMART is not registering any errors. How would I determine which file has the bad blocks in it to force the reallocation as some have suggested? Only other info I can add is that I have noticed a file I can't seem to delete. If you do a "ls -l" on the directory I get
-????????? ? ? ? ? ? 20160913_110018.jpg.tmp
Wonder if this is the file in question?
This is the output from "smartctl -a"
smartctl 7.1 2019-12-30 r5022 [x86_64-linux-5.4.0-92-generic] (local build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Family: Western Digital Red
Device Model: WDC WD30EFRX-68EUZN0
Serial Number: WD-WCC4N1002037
LU WWN Device Id: 5 0014ee 20a0f3b81
Firmware Version: 80.00A80
User Capacity: 3,000,592,982,016 bytes [3.00 TB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: 5400 rpm
Device is: In smartctl database [for details use: -P show]
ATA Version is: ACS-2 (minor revision not indicated)
SATA Version is: SATA 3.0, 6.0 Gb/s (current: 3.0 Gb/s)
Local Time is: Sun Jan 9 17:37:14 2022 GMT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
Offline data collection status: (0x00) Offline data collection activity
was never started.
Auto Offline Data Collection: Disabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: (39900) seconds.
Offline data collection
capabilities: (0x7b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 2) minutes.
Extended self-test routine
recommended polling time: ( 400) minutes.
Conveyance self-test routine
recommended polling time: ( 5) minutes.
SCT capabilities: (0x703d) SCT Status supported.
SCT Error Recovery Control supported.
SCT Feature Control supported.
SCT Data Table supported.
SMART Attributes Data Structure revision number: 16
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x002f 200 200 051 Pre-fail Always - 20699
3 Spin_Up_Time 0x0027 176 171 021 Pre-fail Always - 6183
4 Start_Stop_Count 0x0032 100 100 000 Old_age Always - 418
5 Reallocated_Sector_Ct 0x0033 200 200 140 Pre-fail Always - 0
7 Seek_Error_Rate 0x002e 100 253 000 Old_age Always - 0
9 Power_On_Hours 0x0032 023 023 000 Old_age Always - 56704
10 Spin_Retry_Count 0x0032 100 100 000 Old_age Always - 0
11 Calibration_Retry_Count 0x0032 100 100 000 Old_age Always - 0
12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 415
192 Power-Off_Retract_Count 0x0032 200 200 000 Old_age Always - 219
193 Load_Cycle_Count 0x0032 195 195 000 Old_age Always - 17353
194 Temperature_Celsius 0x0022 119 102 000 Old_age Always - 31
196 Reallocated_Event_Count 0x0032 200 200 000 Old_age Always - 0
197 Current_Pending_Sector 0x0032 200 200 000 Old_age Always - 1
198 Offline_Uncorrectable 0x0030 100 253 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x0032 200 200 000 Old_age Always - 0
200 Multi_Zone_Error_Rate 0x0008 100 253 000 Old_age Offline - 0
SMART Error Log Version: 1
No Errors Logged
SMART Self-test log structure revision number 1
Num Test_Description Status Remaining LifeTime(hours) LBA_of_first_error
# 1 Conveyance offline Completed without error 00% 0 -
# 2 Short offline Completed without error 00% 0 -
SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.
Thanks again for all your help
Lee.

First of all, your SMART Data isn't the end of the world.

I would still make a copy of the data now, using ddrescue,
awaiting "resolution" of the drive status. You should copy the
data off the drive now, either file-by-file or as an image/clone
with ddrescue.

Duff ------- Good # No third drive needed in this picture.
Drive DD copy # We will try to fix Duff Drive.

I try to research these hard drive terms as best I can. However,
by observing the behavior over a long period of time (twenty years),
it would appear Seagate behavior does not match just about
all the "information" web pages I can find.

The information online says that first a Current_Pending is logged.
It gets resolved, and the Reallocated_Sector_Count gets incremented
if the problem was resolved by Reallocation.

The first problem is, the Reallocated_Sector_Count (which is zero on
yours at the moment), is a thresholded count. They don't show you
the real count, because if the manufacturer did that, you would
"cherry-pick" new drives, until you "got one with a low count".
You would keep returning brand new hard drives to the store, until
the counter was as close to zero as you could make it. Obviously, this
is bad for business.

It was considered acceptable at one time, to ship drives with 100,000
reallocations on them. The 100,000 number is subtracted from the
real count. Only if the result is a positive integer, does a count
show for the drive. So when Reallocated shows 1 in the Raw_Data field,
it's really 100,001 (or some other large integer representing the
acceptance criterion for new drives).

This means when the drive is in the prime of life and full of vigor,
that counter stays at zero. It stays at zero, even if sectors are
being spared out and reallocated. You cannot watch the drive burn
through its "life", as the counter won't let you watch.

Then, one day, out of the blue, the Reallocated starts to increase from
zero. Typically, you might see them come in "bunches", depending
on the write activity level of the drive.

OK, so while you are watching this going on, you look at Current_Pending.
What do you notice ? Well, the damn thing is not coming off the pegs
and is staying at zero. Somebody lied to us!

My observation is, Yes, Current_Pending does go non-zero. But it picks
a particular time to go non-zero. It's when the drive is headed for
trouble, and a section of the disk doesn't have any spares left.
SOMETHING, some resource is running low. That is when Current_Pending
goes non-zero. The Internet description of the behavior, then works
in the expected manner. Items decremented from Current_Pending,
show up in Reallocated.

What can we conclude about your drive. The drive is Seagate (so
Current_Pending sense is "altered"). You have no Reallocated
(raw_data is zero). That is good. But the fact you have a Current_Pending
showing, means there is probably more to the problem you are
showing us, than meets the eye.

This is NOT the time to have a big grin on your face, delete the
file and move on.

The drive needs to be flushed and restored. The flushing allows
the "true nature" of the drive to shine through. When to stop
using a drive is a judgment call. For example, of the drives
that I have purchased and managed here myself, no drive has failed
here in more than 20 years. I have three failures total from
before that. Two Maxtors (probably motor controller failures), and
a Seagate 32550N that died in spectacular fashion (head assembly
jammed in head lock solenoid). Even the unhealthy Seagate 500GB
drives I have here, some with as few as 8000 hours on them, they
show bad counts, but the drives still aren't dead. I use these as
scratch drives -- the "only copy" of data never goes on those drives.

*******

So here's the deal.

You can:

1) Copy the files off, in a file-by-file fashion, to a second drive.
But now, you don't really know whether the files have good integrity
or not. It's a copy, but it might not be the best, sweetest copy.

Zero the drive out with "dd" in Linux. For example, if fdisk or gdisk
tells you the drive size rounds to cylinders, perhaps this is enough.
What is magic about that number ? 63 divides into it.

sudo dd if=/dev/zero of=/dev/sdb bs=221184 # DESTRUCTIVE cleaning...

Now, scan the clean drive with ddrescue and build a log of unreadable sectors.
Since the write operation attempted by the "dd" has given a chance
for Pending items to be removed, any new Current_Pending we see now
are bad news. The Current_Pending "grow" as this command progresses
to completion.

sudo ddrescue -f -n /dev/sdb /dev/null /root/rescue.log # Generate log only

That scans the disk, and gives an idea how many sectors cannot be read.
At the same time, it allows the drive to "grow" the Current_Pending.
If the drive was perfectly healthy, the Current_Pending after this
run would be zero Raw_Data.

mkfs.ntfs and copy the files back, assuming nothing you see during the
cleaning in this section, showed worrying signs.

You could also dd_copy the disk back, instead of file by file, if you
want. Then CHKDSK etc.

OR

2) Do nothing. Use file system level tools. Make the file go away.
Delete the directory. Create the directory. Copy the single directory
of files in it back.

But now, you should enhance your backup procedures. The problem is,
at least a few utilities, they will "bail" on the backup, if more
CHKDSK-style errors show up. Backups are intolerant of health problems.
You cannot have "100% adequate" backups, on a drive that is screwing itself
into the ground. The backup software won't let you. To make backups of
unhealthy drives, that is a HELL of a job, and your time is important
to you.

One thing you're going to learn about hard drives is, the
bigger the drives are that you buy, the longer and longer
these attempted-repair procedures take. Something I was doing
with a 6TB the other day (not really a big drive), it took
12 hours. You tend to lose track of what step you're at, when
things are that slow. It is not uncommon for people doing RAID
recovery, for a single step to take a whole week! This tends
to make people avoid maintenance and rely on "Prayer" for
their protection.

HTH,
Paul

[Rod Speed]

Post by Paul

Post by ***@yahoo.co.uk

Post by Adrian Caspersz

Post by ***@yahoo.co.uk
I am running Ubuntu on my file server and noticed in dmesg a load of
the following errors (there are a lot of other lines per instance but
this seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ)
flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is
giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847

Before that, what is the drive SMART health say?
Plenty of tools for that, like https://www.smartmontools.org/
For a spinning drive if you see, 'reallocated sector count' anything but
zero, or a silly 'head load count' I would not trust the drive with
anything.

Thanks for all the suggestions. I have run smartctl (output below) but
as far as I can see there are no reallocated sectors and SMART is not
registering any errors. How would I determine which file has the bad
blocks in it to force the reallocation as some have suggested? Only
other info I can add is that I have noticed a file I can't seem to
delete. If you do a "ls -l" on the directory I get
-????????? ? ? ? ? ?
20160913_110018.jpg.tmp
Wonder if this is the file in question?
This is the output from "smartctl -a"
smartctl 7.1 2019-12-30 r5022 [x86_64-linux-5.4.0-92-generic] (local build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke,
www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Family: Western Digital Red
Device Model: WDC WD30EFRX-68EUZN0
Serial Number: WD-WCC4N1002037
LU WWN Device Id: 5 0014ee 20a0f3b81
Firmware Version: 80.00A80
User Capacity: 3,000,592,982,016 bytes [3.00 TB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: 5400 rpm
Device is: In smartctl database [for details use: -P show]
ATA Version is: ACS-2 (minor revision not indicated)
SATA Version is: SATA 3.0, 6.0 Gb/s (current: 3.0 Gb/s)
Local Time is: Sun Jan 9 17:37:14 2022 GMT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
Offline data collection status: (0x00) Offline data collection activity
was never started.
Auto Offline Data Collection: Disabled.
Self-test execution status: ( 0) The previous self-test routine
completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: (39900) seconds.
Offline data collection
capabilities: (0x7b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 2) minutes.
Extended self-test routine
recommended polling time: ( 400) minutes.
Conveyance self-test routine
recommended polling time: ( 5) minutes.
SCT capabilities: (0x703d) SCT Status supported.
SCT Error Recovery Control supported.
SCT Feature Control supported.
SCT Data Table supported.
SMART Attributes Data Structure revision number: 16
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED
WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x002f 200 200 051 Pre-fail
s - 20699
3 Spin_Up_Time 0x0027 176 171 021 Pre-fail
s - 6183
4 Start_Stop_Count 0x0032 100 100 000 Old_age
ys - 418
5 Reallocated_Sector_Ct 0x0033 200 200 140 Pre-fail
s - 0
7 Seek_Error_Rate 0x002e 100 253 000 Old_age
ys - 0
9 Power_On_Hours 0x0032 023 023 000 Old_age
ys - 56704
10 Spin_Retry_Count 0x0032 100 100 000 Old_age
ys - 0
11 Calibration_Retry_Count 0x0032 100 100 000 Old_age
ys - 0
12 Power_Cycle_Count 0x0032 100 100 000 Old_age
ys - 415
192 Power-Off_Retract_Count 0x0032 200 200 000 Old_age
ys - 219
193 Load_Cycle_Count 0x0032 195 195 000 Old_age
ys - 17353
194 Temperature_Celsius 0x0022 119 102 000 Old_age
ys - 31
196 Reallocated_Event_Count 0x0032 200 200 000 Old_age
ys - 0
197 Current_Pending_Sector 0x0032 200 200 000 Old_age
ys - 1
198 Offline_Uncorrectable 0x0030 100 253 000 Old_age
line - 0
199 UDMA_CRC_Error_Count 0x0032 200 200 000 Old_age
ys - 0
200 Multi_Zone_Error_Rate 0x0008 100 253 000 Old_age
line - 0
SMART Error Log Version: 1
No Errors Logged
SMART Self-test log structure revision number 1
Num Test_Description Status Remaining
LifeTime(hours) LBA_of_first_error
# 1 Conveyance offline Completed without error 00%
0 -
# 2 Short offline Completed without error 00%
0 -
SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Not_testing
4 0 0 Not_testing
5 0 0 Not_testing
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.
Thanks again for all your help

First of all, your SMART Data isn't the end of the world.
I would still make a copy of the data now, using ddrescue,
awaiting "resolution" of the drive status. You should copy the data off
the drive now, either file-by-file or as an image/clone with ddrescue.
Duff ------- Good # No third drive needed in this picture.
Drive DD copy # We will try to fix Duff Drive.
I try to research these hard drive terms as best I can. However,
by observing the behavior over a long period of time (twenty years), it
would appear Seagate behavior does not match just about all the
"information" web pages I can find.

His drive is a Western Digital Red.

Post by Paul
The information online says that first a Current_Pending is logged.
It gets resolved, and the Reallocated_Sector_Count gets incremented
if the problem was resolved by Reallocation.
The first problem is, the Reallocated_Sector_Count (which is zero on yours
at the moment), is a thresholded count.

It is more accurate to say that the Reallocated_Sector_Count
is set to zero after the factory setup of the drive.

Post by Paul
They don't show you the real count, because if the manufacturer did that,
you would "cherry-pick" new drives, until you "got one with a low count".
You would keep returning brand new hard drives to the store, until the
counter was as close to zero as you could make it. Obviously, this is bad
for business.
It was considered acceptable at one time, to ship drives with 100,000
reallocations on them. The 100,000 number is subtracted from the real
count. Only if the result is a positive integer, does a count show for the
drive. So when Reallocated shows 1 in the Raw_Data field,

The Raw_Data field doesn’t show reallocated sectors at all.

And Seagate drives show that differently to the rest,
but his isn't a Seagate, it’s a Western Digital Red.

Post by Paul
it's really 100,001 (or some other large integer representing the
acceptance criterion for new drives).

That’s confusing reallocated sectors with Raw_Data_Errors.

Post by Paul
This means when the drive is in the prime of life and full of vigor, that
counter stays at zero. It stays at zero, even if sectors are being spared
out and reallocated.

No it does not.

Post by Paul
You cannot watch the drive burn through its "life", as the counter won't
let you watch.

Not clear what this is about.

Post by Paul
Then, one day, out of the blue, the Reallocated starts to increase from
zero. Typically, you might see them come in "bunches", depending on the
write activity level of the drive.
OK, so while you are watching this going on, you look at Current_Pending.
What do you notice ? Well, the damn thing is not coming off the pegs
and is staying at zero. Somebody lied to us!

Nope.

Post by Paul
My observation is, Yes, Current_Pending does go non-zero. But it picks a
particular time to go non-zero. It's when the drive is headed for trouble,
and a section of the disk doesn't have any spares left.

That’s not right either. That’s the Offline_Uncorrectable

Post by Paul
SOMETHING, some resource is running low. That is when Current_Pending goes
non-zero.

No.

Post by Paul
The Internet description of the behavior, then works
in the expected manner. Items decremented from Current_Pending, show up in
Reallocated.
What can we conclude about your drive. The drive is Seagate

No it is not, it is a Western Digital Red.

Post by Paul
(so Current_Pending sense is "altered").

No it is not.

Post by Paul
You have no Reallocated (raw_data is zero).

Raw_Read_Error_Rate is in fact very
non zero for a Western Digital drive.

Post by Paul
That is good. But the fact you have a Current_Pending
showing, means there is probably more to the problem you are showing us,
than meets the eye.
This is NOT the time to have a big grin on your face, delete the file and
move on.
The drive needs to be flushed and restored. The flushing allows
the "true nature" of the drive to shine through. When to stop
using a drive is a judgment call. For example, of the drives
that I have purchased and managed here myself, no drive has failed here in
more than 20 years. I have three failures total from
before that. Two Maxtors (probably motor controller failures), and
a Seagate 32550N that died in spectacular fashion (head assembly
jammed in head lock solenoid). Even the unhealthy Seagate 500GB
drives I have here, some with as few as 8000 hours on them, they
show bad counts, but the drives still aren't dead. I use these as
scratch drives -- the "only copy" of data never goes on those drives.
*******
So here's the deal.
1) Copy the files off, in a file-by-file fashion, to a second drive.
But now, you don't really know whether the files have good integrity
or not. It's a copy, but it might not be the best, sweetest copy.
Zero the drive out with "dd" in Linux. For example, if fdisk or gdisk
tells you the drive size rounds to cylinders, perhaps this is enough.
What is magic about that number ? 63 divides into it.
sudo dd if=/dev/zero of=/dev/sdb bs=221184 # DESTRUCTIVE cleaning...
Now, scan the clean drive with ddrescue and build a log of unreadable
sectors. Since the write operation attempted by the "dd" has given a
chance for Pending items to be removed, any new Current_Pending we see now
are bad news. The Current_Pending "grow" as this command progresses to
completion.
sudo ddrescue -f -n /dev/sdb /dev/null /root/rescue.log # Generate log only
That scans the disk, and gives an idea how many sectors cannot be read.
At the same time, it allows the drive to "grow" the Current_Pending.
If the drive was perfectly healthy, the Current_Pending after this
run would be zero Raw_Data.
mkfs.ntfs and copy the files back, assuming nothing you see during the
cleaning in this section, showed worrying signs.
You could also dd_copy the disk back, instead of file by file, if you
want. Then CHKDSK etc.
OR
2) Do nothing. Use file system level tools. Make the file go away.
Delete the directory. Create the directory. Copy the single directory
of files in it back.
But now, you should enhance your backup procedures. The problem is,
at least a few utilities, they will "bail" on the backup, if more
CHKDSK-style errors show up. Backups are intolerant of health problems.
You cannot have "100% adequate" backups, on a drive that is screwing itself
into the ground. The backup software won't let you. To make backups of
unhealthy drives, that is a HELL of a job, and your time is important
to you.
One thing you're going to learn about hard drives is, the
bigger the drives are that you buy, the longer and longer
these attempted-repair procedures take. Something I was doing with a 6TB
the other day (not really a big drive), it took
12 hours. You tend to lose track of what step you're at, when
things are that slow. It is not uncommon for people doing RAID
recovery, for a single step to take a whole week! This tends
to make people avoid maintenance and rely on "Prayer" for
their protection.

[Peeler]

On Tue, 11 Jan 2022 03:51:19 +1100, cantankerous trolling geezer Rodent
Speed, the auto-contradicting senile sociopath, blabbered, again:

<FLUSH the abnormal trolling senile cretin's latest trollshit unread>

[Andrew Gabriel]

Post by ***@yahoo.co.uk
Hi All,
I am running Ubuntu on my file server and noticed in dmesg a load of the following errors (there are a lot of other lines per instance but this seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847
They are contiguous so thought this seemed to align with the previous error found. Looking online people seem to say that the linux tools are poor and to use Windows chkdsk. So...I found an old Win 7 rescue CD so booted it with this and tried running chkdsk. This gave me loads of "attribute list for file x is corrupt" (where x is a different number each time).
Now unsure whether the disk is actually in worse state than I thought or maybe the chkdsk errors are because the ntfs disk is accessed only via Ubuntu and there is some sort of "compatibility" issue between them or something.
Anyone have any ideas?

This could be one physical 4k block which contains several logical
512byte sectors, particularly as they're all in the same 4k block
number, if the disk is formatted like this.

The block will stay bad until it's rewritten which will generate a good
checksum, possibly remapping it if the disk media is bad at that point.

If it was a ZFS filesystem, it would tell you which file is corrupt, or
it would have corrected it if in the metadata or if RAID level provided
redundancy.

Andrew Gabriel

[Paul]

Post by ***@yahoo.co.uk
Hi All,
I am running Ubuntu on my file server and noticed in dmesg a load of the following errors (there are a lot of other lines per instance but this seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847
They are contiguous so thought this seemed to align with the previous error found. Looking online people seem to say that the linux tools are poor and to use Windows chkdsk. So...I found an old Win 7 rescue CD so booted it with this and tried running chkdsk. This gave me loads of "attribute list for file x is corrupt" (where x is a different number each time).
Now unsure whether the disk is actually in worse state than I thought or maybe the chkdsk errors are because the ntfs disk is accessed only via Ubuntu and there is some sort of "compatibility" issue between them or something.
Anyone have any ideas?
thanks
Lee.

CHKDSK is a repair-in-place utility. This is dangerous to the health
of the data.

You definitely do not want to run CHKDSK on any drive which is weak.
For example, one person discovered (the hard way), that the ribbon
cable on their IDE drive was loose and not all the pins were making
proper contact. A run of CHKDSK concluded "everything was damaged"
and it then attempts to write the disk to make corrections, and of
course every write attempt causes further corruption (because the
cable isn't touching). That's an example where "non-functional storage",
an inability to do a write properly, leads to destruction.

You need "safety backups" to proceed, and known-good drives that
are not themselves a hazard to life and limb.

duff ----- safety ---- candidate
drive backup new storage
with corrected
content

The transfer from the left to the center, captures all the
good sectors it can.

Once the data is on the center drive, we expect that media to be
"reliable while making copies". We can copy, as many times as we like,
from center to right disk. (Center to right, you can use ddrescue
if you want, because if you use ntfsclone of partclone fame, it might
become wobbly if encountering bad NTFS structures. It should only
take one pass, with an empty log for output.)

Once the data is on the right-hand disk, we apply

chkdsk /f RightHandDiskLetter

If it goes poorly, if you think you've lost files, you may have
to change strategies. But since the center drive still has
a copy, you can use as many questionable techniques on the
right hand drive, as you could wish. Just keep cloning from
center to right, before each attempt.

*******

https://linux.die.net/man/1/ddrescue

From my notes, with notes.

sudo apt install gddrescue # [ perhaps this installs ddrescue in /sbin or /usr/bin ??? ]

# If the left disk is 500GB, the center disk, whether storing the result as a file
# or cloning to the disk and making an exact copy, that's going to need 500GB
# The following three commands illustrate various options with ddrescue.
# The destination must be intelligently selected -- the suggestion of /root here
# is silly, and it might be /mnt/media/somedisk/sdb_rescue.img .

sudo ddrescue -f -n /dev/sdb /root/sdb_rescue.img /root/rescue.log # Disk to file (500GB file)
sudo ddrescue -f -n /dev/sdb /dev/sdc /root/rescue.log # Disk to disk (populate 500GB disk)
sudo ddrescue -f -n /dev/sdb /dev/null /root/rescue.log # Generate log only

# The -n option means no attempt is made on the fast first pass, to get everything
# The first transfer is a quick survey of the disk, getting most of the
# easy to get materials.

# Examine the LOG file for details. A large log file means
# there are many CRC errors.

gedit /root/rescue.log

# Now, the second pass reads the log, and concentrates only on the
# not-yet-captured sectors. The -n option is removed, because now the
# utility will be focusing on recovery techniques. Note that even *bad*
# blocks can be recovered, with bad data in them, leading to CHKDSK doing
# weird things. The error detection polynomial on the disk is only so good.
# Because this operation will rely on 10 to 15 second timeouts per sector,
# this can take hours and hours, depending on how sick the drive is. The size
# of the damage as seen in rescue.log, hints at the potential wait. You use the
# same "flavor" of command, as you selected from the above two possibilities.
# You could recover to a 500GB file, and you would name the file you used
# from the first step, to receive overwrites of recovered material (that did not
# receive a write on the first pass.

sudo ddrescue -d -f -r3 /dev/sdb /root/sdb_rescue.img /root/rescue.log # disk to file, etc.

*******

OK, so what other utilities might we need ?

There is a tiny utility in there, nfi.exe . It dumps information about where
the clusters are stored. With some arithmetic, it's possible to map the bad
addresses in your rescue.log, to file names. On my bad Dell disk, two bad blocks
were in "white space" so nothing harmed, two bad blocks were in the middle of files.

https://en.wikipedia.org/wiki/NTFS

https://web.archive.org/web/20150223112102/http://support.microsoft.com/kb/253066/en-us

https://web.archive.org/web/20150223112102/http://download.microsoft.com/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip

The command is then:

nfi.exe W: > nfi_w_out.txt

notepad nfi_w_out.txt

The file will be poorly spaced, with extra lines.

The $MFT has slots, and "filenum" are stuffed in them. After
a file is deleted, a filenum may no longer have a valid file,
and its filenum no longer appears in nfi_w_out.txt

filenum 100
filenum 101
filenum 102 <=== The next two slots not in use
filenum 105

Each filenum can either be a file or a directory. A directory
is just a file, with a $I30 entry. It is possible some sort
of attribute material is in the $130.

For severely fragmented files, a single file can use multiple
filenum as extensions. Don't panic if "windows.edb" had 100 similar
filenum entries. This is the usage of multiple slots, to hold
pointers to all the fragments in the file. Some defragmenter utilities,
only know how to reduce the frag list in a filenum to the one entry.
Those defragmenters aren't smart enough to "squash" a hundred filenum
down to just one, so the file has no true fragments. I solve this,
with careful "copying" of the file :-) Obviously, not in Windows, which
may fudge and not solve the problem. Linux can do that (correct the
problem), because it doesn't know any better.

*******

With a fresh copy on your right-most disk, you can try this.

http://web.archive.org/web/20070101070056/http://www.woundedmoon.org/win32/driverescue19d.html

driverescue19d.zip 1,007,764 bytes
MD5SUM = 63b7e1e8b1701593d5f52c7927d01558

The author of that program, had at that point just got the NTFS
version running. One person in the WinXP group, claims to have
recovered some data with it. I've never used it myself, to see
what kind of results it is capable of. You need the right kind of
damage, to give such a test.

You would still need storage space somewhere, for the
output from that program.

Paul

[Rod Speed]

Post by Paul

Post by ***@yahoo.co.uk
I am running Ubuntu on my file server and noticed in dmesg a load of the
following errors (there are a lot of other lines per instance but this
seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ)
flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is
giving a problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847
They are contiguous so thought this seemed to align with the previous
error found. Looking online people seem to say that the linux tools are
poor and to use Windows chkdsk. So...I found an old Win 7 rescue CD so
booted it with this and tried running chkdsk. This gave me loads of
"attribute list for file x is corrupt" (where x is a different number
each time).
Now unsure whether the disk is actually in worse state than I thought or
maybe the chkdsk errors are because the ntfs disk is accessed only via
Ubuntu and there is some sort of "compatibility" issue between them or
something.
Anyone have any ideas?
thanks
Lee.

CHKDSK is a repair-in-place utility. This is dangerous to the health
of the data.
You definitely do not want to run CHKDSK on any drive which is weak.
For example, one person discovered (the hard way), that the ribbon
cable on their IDE drive was loose and not all the pins were making
proper contact. A run of CHKDSK concluded "everything was damaged"
and it then attempts to write the disk to make corrections, and of
course every write attempt causes further corruption (because the
cable isn't touching). That's an example where "non-functional storage",
an inability to do a write properly, leads to destruction.
You need "safety backups" to proceed, and known-good drives that
are not themselves a hazard to life and limb.
duff ----- safety ---- candidate
drive backup new storage
with corrected
content
The transfer from the left to the center, captures all the
good sectors it can.
Once the data is on the center drive, we expect that media to be
"reliable while making copies". We can copy, as many times as we like,
from center to right disk. (Center to right, you can use ddrescue
if you want, because if you use ntfsclone of partclone fame, it might
become wobbly if encountering bad NTFS structures. It should only
take one pass, with an empty log for output.)
Once the data is on the right-hand disk, we apply
chkdsk /f RightHandDiskLetter
If it goes poorly, if you think you've lost files, you may have
to change strategies. But since the center drive still has
a copy, you can use as many questionable techniques on the
right hand drive, as you could wish. Just keep cloning from
center to right, before each attempt.
*******
https://linux.die.net/man/1/ddrescue
From my notes, with notes.
sudo apt install gddrescue # [ perhaps this installs ddrescue in
/sbin or /usr/bin ??? ]
# If the left disk is 500GB, the center disk, whether storing the result as a file
# or cloning to the disk and making an exact copy, that's going to need 500GB
# The following three commands illustrate various options with ddrescue.
# The destination must be intelligently selected -- the suggestion of /root here
# is silly, and it might be /mnt/media/somedisk/sdb_rescue.img .
sudo ddrescue -f -n /dev/sdb /root/sdb_rescue.img /root/rescue.log #
Disk to file (500GB file)
sudo ddrescue -f -n /dev/sdb /dev/sdc /root/rescue.log #
Disk to disk (populate 500GB disk)
sudo ddrescue -f -n /dev/sdb /dev/null /root/rescue.log # Generate log only
# The -n option means no attempt is made on the fast first pass, to get everything
# The first transfer is a quick survey of the disk, getting most of the
# easy to get materials.
# Examine the LOG file for details. A large log file means
# there are many CRC errors.
gedit /root/rescue.log
# Now, the second pass reads the log, and concentrates only on the
# not-yet-captured sectors. The -n option is removed, because now the
# utility will be focusing on recovery techniques. Note that even *bad*
# blocks can be recovered, with bad data in them, leading to CHKDSK doing
# weird things. The error detection polynomial on the disk is only so good.
# Because this operation will rely on 10 to 15 second timeouts per sector,
# this can take hours and hours, depending on how sick the drive is. The size
# of the damage as seen in rescue.log, hints at the potential wait. You use the
# same "flavor" of command, as you selected from the above two possibilities.
# You could recover to a 500GB file, and you would name the file you used
# from the first step, to receive overwrites of recovered material (that did not
# receive a write on the first pass.
sudo ddrescue -d -f -r3 /dev/sdb /root/sdb_rescue.img /root/rescue.log
# disk to file, etc.
*******
OK, so what other utilities might we need ?
There is a tiny utility in there, nfi.exe . It dumps information about where
the clusters are stored. With some arithmetic, it's possible to map the bad
addresses in your rescue.log, to file names. On my bad Dell disk, two bad blocks
were in "white space" so nothing harmed, two bad blocks were in the middle of files.
https://en.wikipedia.org/wiki/NTFS
https://web.archive.org/web/20150223112102/http://support.microsoft.com/kb/253066/en-us
https://web.archive.org/web/20150223112102/http://download.microsoft.com/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip
nfi.exe W: > nfi_w_out.txt
notepad nfi_w_out.txt
The file will be poorly spaced, with extra lines.
The $MFT has slots, and "filenum" are stuffed in them. After
a file is deleted, a filenum may no longer have a valid file,
and its filenum no longer appears in nfi_w_out.txt
filenum 100
filenum 101
filenum 102 <=== The next two slots not in use
filenum 105
Each filenum can either be a file or a directory. A directory
is just a file, with a $I30 entry. It is possible some sort
of attribute material is in the $130.
For severely fragmented files, a single file can use multiple
filenum as extensions. Don't panic if "windows.edb" had 100 similar
filenum entries. This is the usage of multiple slots, to hold
pointers to all the fragments in the file. Some defragmenter utilities,
only know how to reduce the frag list in a filenum to the one entry.
Those defragmenters aren't smart enough to "squash" a hundred filenum
down to just one, so the file has no true fragments. I solve this,
with careful "copying" of the file :-) Obviously, not in Windows, which
may fudge and not solve the problem. Linux can do that (correct the
problem), because it doesn't know any better.
*******
With a fresh copy on your right-most disk, you can try this.
http://web.archive.org/web/20070101070056/http://www.woundedmoon.org/win32/driverescue19d.html
driverescue19d.zip 1,007,764 bytes
MD5SUM = 63b7e1e8b1701593d5f52c7927d01558
The author of that program, had at that point just got the NTFS
version running. One person in the WinXP group, claims to have
recovered some data with it. I've never used it myself, to see
what kind of results it is capable of. You need the right kind of
damage, to give such a test.
You would still need storage space somewhere, for the
output from that program.

Much better to check the SMART stats and check the health of the drive.

If there is only one bad sector, copy that file and see if the drive
reallocates that sector.

Backup the drive if it isn't already backed up.

[Peeler]

On Sun, 9 Jan 2022 16:38:22 +1100, cantankerous trolling geezer Rodent
Speed, the auto-contradicting senile sociopath, blabbered, again:

<FLUSH the abnormal trolling senile cretin's latest trollshit unread>

[Brian Gaff (Sofa)]

Personally, I'd get a new drive first and back up stuff to that as the
working drive. Drives are pretty cheap these days.
Then you can play about with the dodgy one in Windoze and see if it
destroys the other operating system.
I do know that if the errors are hard then tend to spread its a warning
sign that all is not well and sooner or later it will very badly. Strangely,
SSDs seem to suffer a lot from this, so I can only think its some leakage in
the chip itself.
Brian
--
This newsgroup posting comes to you directly from...
The Sofa of Brian Gaff...
***@blueyonder.co.uk
Blind user, so no pictures please
Note this Signature is meaningless.!
"***@yahoo.co.uk" <***@yahoo.co.uk> wrote in message news:2ebc1c66-f938-484e-985b-***@googlegroups.com...
Hi All,

I am running Ubuntu on my file server and noticed in dmesg a load of the
following errors (there are a lot of other lines per instance but this seems
to be the main one)

blk_update_request: I/O error, dev sdb, sector 5621815688 op 0x0:(READ)
flags 0x0 phys_seg 1 prio class 0

The line is always the same so assumed there is one sector which is giving a
problem. I run badblocks and it found 4 bad blocks as follows
2810907844
2810907845
2810907846
2810907847

They are contiguous so thought this seemed to align with the previous error
found. Looking online people seem to say that the linux tools are poor and
to use Windows chkdsk. So...I found an old Win 7 rescue CD so booted it
with this and tried running chkdsk. This gave me loads of "attribute list
for file x is corrupt" (where x is a different number each time).

Now unsure whether the disk is actually in worse state than I thought or
maybe the chkdsk errors are because the ntfs disk is accessed only via
Ubuntu and there is some sort of "compatibility" issue between them or
something.

Anyone have any ideas?

thanks

Lee.

[The Natural Philosopher]

Post by ***@yahoo.co.uk
Hi All,
I am running Ubuntu on my file server and noticed in dmesg a load of
the following errors (there are a lot of other lines per instance but
this seems to be the main one)
blk_update_request: I/O error, dev sdb, sector 5621815688 op
0x0:(READ) flags 0x0 phys_seg 1 prio class 0
The line is always the same so assumed there is one sector which is
giving a problem. I run badblocks and it found 4 bad blocks as
follows 2810907844 2810907845 2810907846 2810907847

1k blocks 512byte sectors

Post by ***@yahoo.co.uk
They are contiguous so thought this seemed to align with the previous
error found. Looking online people seem to say that the linux tools
are poor and to use Windows chkdsk.

Bollox. Lix is pretty damned good on chkdsk even with NTFS


So...I found an old Win 7

Post by ***@yahoo.co.uk
rescue CD so booted it with this and tried running chkdsk. This gave
me loads of "attribute list for file x is corrupt" (where x is a
different number each time).
Now unsure whether the disk is actually in worse state than I thought
or maybe the chkdsk errors are because the ntfs disk is accessed only
via Ubuntu and there is some sort of "compatibility" issue between
them or something.

If its only ever accessed via Ubuntu, why is it NTFS?

Post by ***@yahoo.co.uk
Anyone have any ideas?

Yes. the disk is toast. Don't even think about trying to map out bad
blocks.
Get another one, format it EXT4 and start pulling the data over with
e,g. rsync.
At some point that will fail when it hits the bad blocks, but it will
tell you what they are part of file wise.

Post by ***@yahoo.co.uk
thanks
Lee.