Spinrite is not Data Recovery software

By | January 5, 2017

Why Spinrite is not Data Recovery software.

I am not on a crusade against Spinrite. However every so often I get tangled up in discussions where I feel the need to explain that Spinrite is not data recovery software and that the perceived magic Spinrite performs is not magic. I often encounter fanatic resistance. It is not my intention to change the fanatic’s opinion but I hope you will think twice before using Spinrite for the purpose of data recovery.

Using Spinrite for the purpose of data recovery is bad practice. What it actually can do can be done faster and safer using other, sometimes free, software.

I am mainly interested in the data recovery portion of Spinrite. All over the web you will find people who unfortunately suggest to run Spinrite for the purpose of recovery of data from ‘dead’ disks. I decided to do this post after having a yet another discussion here: http://www.fact-reviews.com/info/Spinrite.aspx.

Firstly it is important to stress that Spinrite is not file recovery software. If you need to undelete or recover files from a corrupt file system, a formatted or deleted partition you’ll be wasting your time using Spinrite. In that case you need file recovery software.

What the heck is Spinrite and what does it do?

If you understand how disk error management works, Spinrite’s miracles are easily explained by sector reallocation. Nothing Magical about that.

It is hard to get a quick and easy written description from the Gibson Research website what Spinrite actually is and does. On the main Spinrite page you will see a video that supposedly explains what Spinrite does, and also  an URL to testimonials. In essence you could describe Spinrite, it’s use, and methodology in a few sentences.

Two minutes into the video and I still don’t know what it does (yeah, ‘magic’). The ‘word of mouth’ link to testimonials does not explain at any point what it is that Spinrite does. What it does remind me of is one of those ‘get rich in 3 easy steps’ type websites. Where they continue feeding you testimonials and drag you in bit by bit. Promise by promise. Miracle by miracle. Keep claims vague so you can easily claim success or dismiss criticism.

The hocus-pocus works for a lot of people: “SpinRite gets as close to the physical media as it is possible to get – the level of raw device access”. – user comment, obviously clueless, INT13h is what Spinrite uses to read/write.

At the main Spinrite page (https://www.grc.com/sr/spinrite.htm) nowhere can I find the beginning of a description what it is that Spinrite does. Or what kind of problems I can use it for. The page header simply says ‘Spinrite, it works’. Nowhere is a list of issues or problems that you can supposedly fix using Spinrite. Also, there is no user guide for Spinrite 6 (ten years after release!).

The testimonials page lists lots of rather vague and diffuse problems that were ‘fixed’ after running Spinrite. Many of the fixes can be explained by ‘sector reallocation’ which I will explain later. Just the mere fact of software reading from and writing to a sector triggers this behavior in hard disks to replace defective sectors by spares. The vague, magic and miracle fixes are however attributed to Spinrite.

Data loss is not actually … data loss

Most testimonials do not mainly describe data loss, instead they describe some vague issue that is attributed to hard disk related problems by the user.

Because it is based on solid science and proven engineering, SpinRite routinely performs miracles of data recovery for 1/100th the cost of independent third-party data recovery services. You just run it and SpinRite fixes everything that’s wrong. Sometimes it will warn of more serious impending trouble. – GRC Website

Common reasoning among Spinrite believers appears to be: Disk is magically fixed from a rather vague, ill defined problem: Spinrite did it. Or, disk is not magically fixed: If Spinrite can’t fix it, nothing can. The latter is simply not true, however, the disk is simply given up on.

Yes, drives have error correcting built in – but Spinrite is much more thorough then any drives built in error correcting diagnostics. It’s not necessarily because Steve Gibson is a genius (although I do think he is brilliant) and hard drive makers are stupid (sometimes I wonder) it’s just that people wouldn’t tolerate the speed delays that the intensive algorithm’s that Spinrite uses in the day to day usage of their drives – user comment.

By keeping the claims vague, it easy to attribute any desired outcome to Spinrite. This is just a modest quote from the Spinrite 5 pages:

SpinRite is the most capable, thorough, and reliable utility that has ever been created for the long term maintenance, recovery, and repair of mass storage systems. – GRC website

In my own words and simply put: Spinrite is a DOS utility for hard disk maintenance and ‘data recovery’. The data recovery portion is basically nothing more than a read/write disk surface scanner: Sectors are read from and written to.

Spinrite surface scan

What can Spinrite do to recover data

What happens inside a bad disk?

It has been documented that Spinrite ‘uses’ INT13h software interrupts to read from and write to hard disks. INT13h software interrupts are an API offered by the system BIOS to access individual sectors on a hard disk. To talk to the disk on an even lower level you’d need to issue ATA commands to the disk directly. For SMART data Spinrite uses ATA commands. Reading the disk using INT13h commands and getting SMART Data through ATA isn’t anything magical. And yet, Spinrite believers will make ridiculous claims that nothing can talk to a hard disk at the low level that Spinrite does.

 …. WHY SPINRITE is better than any hard drive tool out there. Its written in ASSEMBLY because he couldn’t otherwise use his knowledge of hard drive controllers. … – user comment.

Even when ‘talking’ to a hard disk on low level, there is a lot of things you can not influence. For example, a disk’s internal software (the firmware) is equipped to deal with lot’s of different situations it might run into. Such as errors. If a disk runs into a sector it can not initially read it will employ a number of error recovery techniques to try to get the data from the sector. All that the software that requests the data can do is wait until the disk is done.

The disk then either delivers the data, or it reports and error. Up on error the requesting software can issue a new read command to force the disk to retry the whole procedure.

Bad, bad sector!

A sector that can not be read from is commonly referred to as a bad sector. Sometimes re-reading the sector multiple times results in a successful read. In some cases the disk may reallocate this sector immediately: The contents of the sector are stored in a spare sector, and the bad sector is taken out of service. The disk itself keeps track of these sectors.

If a sector can not be read at all, the sector will only be reallocated once the sector is written to. By using software, mostly specialized hard disk diagnostic and repair software, the sector is written to, signaling to the disk that it is okay to reallocate the sector and give up on the original sector data. And essentially, this is what Spinrite does when it repairs hard disks. And it accounts for many of the supposedly ‘magical’ disk repairs.

If you understand how disk error management works, Spinrite’s miracles are easily explained by sector reallocation. Nothing Magical about that.

Spinrite Data Recovery (Dynastat) and why it is a bad idea.

If a hard disk can not read a sector, basically all that the requesting software including Spinrite can do, is try to read the sector again. And it is exactly what Spinrite does when it switches to it’s data recovery mode: Dynastat mode. Spinrite will attempt to read the sector upto 1000 times (2000 even according to Wikepedia)! It will compare the successful reads and try to determine the correct, original data.

Spinrite is not data recovery software

Dynastat status window. It looks so cool!

Why this is a bad idea when we need to recover data from the disk: Often the disks that start showing bad sectors show multiple bad sectors. Sometimes ‘grouped’ and sometimes multiple groups of them. Often these disks will start showing alarming SMART data. The occurrence of multiple bad sectors is a good indication that there may be a more structural underlying cause for those sectors to go bad.

On a disk that is going bad, you do not want to force the disk to do thousands of reads on bad sectors. So, you do not want it to do what Spinrite does. The stress from the re-reads may very well be the last push the disk needs.

Also, based on this article, re-reading sectors over and over, and doing long reads over and over, does not result in reliable data at all. It produces random bytes. There is zero point to it. 2000 times zero, is still zero.

Better alternatives to get data from a bad disk.

We need to get as much data, as quickly as we can from a possibly dying disk. Why waste time (you don’t know how much time you still have) on hard to read sectors rather than getting the easy to read sectors first?

And, why not, rather than ‘fixing’ data on a possibly dying disk, a disk that can never be actually be physically repaired, copy all data we can get to another disk?

This is why all people that are serious about data recovery, including data recovery labs will try to clone a hard disk first. They will employ software, or a combination of specialized hardware and software that first gets the easy to read data. This is often the bulk of the data. Areas that are hard to read will be processed last. If needed such combinations of specialized hardware/software can even avoid using a specific disk head or avoid using corrupt firmware.

For the hard to read areas re-reads can be tried. Also the bad areas can be approached from different angles: reverse cloning.

Specialized hardware is expensive. If data is not valuable enough to sent the bad disk to a data recovery lab, the end user can use specialized cloning software. In essence this software ignores read errors. Also, as bad sectors sometimes tend to group, the software typically skips a number of sectors after a read error. This to avoid bad sectors and lengthy error recovery procedures from the hard disk itself. After the software gets all the easy to read sectors, it can turn it’s attention to the sectors it initially skipped.

Examples of such software are Ddrescue (free) and my own tool DiskPatch (commercial).

There is only one bad sector anyway. Can I fix that?

Under circumstances it is actually safe to ‘fix’ a few bad sectors. I know I am on thin ice here, but I had a few of those disks myself which turned out to be okay: For example, I had a RAID controller flagging a array member as ‘bad’. I took the disk from the array and examined it’s SMART data. The disk looked healthy apart from two sectors pending reallocation.

Such sectors could not be read but since no data could be recovered from them they are pending reallocation until data is written to them. In such a case you can run a DiskPatch read/write surface scan after which the sectors will be reallocated. You can use Spinrite for that purpose as well. Run some more surface scans to make sure the disk is stable. Monitor the disk closely over the next few weeks (SMART). To do this automatically you can install a SMART monitor.

Sources:
https://articles.forensicfocus.com/2013/01/21/bad-sector-recovery/
https://www.grc.com/groups/spinrite.dev:379
https://www.grc.com/files/sr5_lit.pdf
https://www.grc.com/groups/spinrite:10501
https://www.grc.com/x/news.exe?cmd=article&group=grc.spinrite&item=12688&utag=
https://www.grc.com/sr/spinrite.htm (Spinrite)
https://www.grc.com/sr/testimonials.htm
https://en.wikipedia.org/wiki/INT_13H
http://www.diydatarecovery.nl (DiskPatch)
https://www.gnu.org/software/ddrescue/ (Ddrescue)
http://www.linuxjournal.com/article/7684 – Comment section is hillarious

7 thoughts on “Spinrite is not Data Recovery software

  1. George Steele

    I think you are being too skeptical in your description. Yes, when a drive discovers that the ECC algorithm has been triggered in order to reconstruct data from a sector that has errors, it can automatically recover the data and relocate it. But it will not do so for error run lengths below the preset that triggers relocation. What Gibson is saying, correctly, is that only a surface scan – one that looks at all the sectors on the disk, done periodically, will catch failing sectors as they pass that preset, but before the ECC is no longer capable of reconstructing the original bit pattern. He is also correct that servos are imperfect, and that heads don’t always track perfectly. When an error area of the disk surface “grows” into a sector from, say, the right, by seeking left and then returning, the head will pass over the sector slightly skewed from its original trajectory – which may allow a signal improvement sufficient to allow the ECC to pick up bits formerly missed, recover the data, and then relocate it. That “wiggle” reading is one of the things Spinrite does, which may – in desperation – allow recovery of data. As for Dynastat, there’s no interaction between a head and the disk surface during a read – the read process is passive. So multiple passes over the same area won’t worsen a media surface unless the flaw is sufficient to displace the media coating and impact the head. If that’s the case, the drive would have crashed the first time you tried to read it. There are issues with respect to when you use Spinrite, relative to the nature of the problem you are encountering, but if you think a drive is at its “about to die” point and you have data not yet saved, the best approach is to save what you can, then Spinrite it, and try to get the rest. When Dynastat does its rewrite, of course, it does interact with a defect area. But if it does a multiple overwrite, the magnetic remanence and strength of the signal can increase sufficiently to return the sector to a readable condition. At that point, copy the data, and toss the drive is the appropriate action.

    Reply
  2. Joep Post author

    Hi George,

    Thanks for your comment!

    The most important point I am trying to make is that it’s a bad idea to use Spinrite for data recovery. Any reputable data recovery lab and technician will confirm this. Key is to do as little as possible to an ill behaving disk, and get the data off as quickly as possible. Spinrite does non of that, instead it ‘recovers’ data on the disk itself, and to do so it intensively reads the disk. It doesn’t matter if they’re reads or writes.

    The mechanisms you describe to recover data from hard to read sectors are already done by the disk itself (the wiggling and all) using error recovery procedures. There is zero added value in using Spinrite, only added risk. So, bad idea.

    The data ‘recovered’ by Spinrite using dynastat is unreliable data: there is no way of telling the data is actually correct. For critical data one could say that recovering no data at all is better than recovering potentially corrupt and unreliable data.

    For the disk repair part, it’s lots of smoke and mirrors and technical mumbo-jumbo to describe a read/write surface scan to trigger sector reallocation.

    Reply
  3. Thomas Adkins

    I comment your calling BS on the nebulous language used both in advertising and in so-called testimonials. Firstly, there is a huge emotional component in losing precious data. This leads, for better or worse, to an emotional response to a perceived success. That emotion has to be attributed to something, why not the software being used? That seems logical to the user.

    But beyond this is a desire to understand the workings of these every-day devices, computers. Even technicians can get suckered this way, because a person could conceivably have an A+ certificate and years of experience as a technician, yet still not have a grasp of the workings of magnetic media storage. The problems of computer workings therefore tend to go much farther into scary territory than other, more easily-imagined problems, like burglary or car accidents. There are nagging, unanswered questions.

    The marketing for SpinRite is a custom fit for these psychological issues. The language used is rife with nebulous benefits, inviting the unwary to see the product fits their need. Then, if the product seems to work, there might even be another testimonial inviting others to join the blue waters. But facts are facts!

    There are very good reasons that there are no detailed illustrations of how the product actually works, reasons that go way beyond proprietary or trade secrets. Giving details brings a person out of la-la land. Giving specifics encourages discernment; and allows the buyer to better apply reason to their purchase. Thanks for such a well-balanced article.

    Reply
  4. Taz

    (meh) You’re correct about Spinrite in that it really isn’t recovery software. That said, it’s still a useful tool for that purpose if you are in a hurry and willing to take the risk of performing recovery on a failing disk. Spinrite is the only easy method I know of to tap into the very sophisticated self maintaining firmware now present on all disk drives. It’s good for beating disks to do their job.

    My problem with Spinrite is that it is limited by the drive manufacturer. Who has a vested interest in making sure his disk never reallocates and permits warranty return. This is what leaves people with marginal disks…Failure to reallocate.

    Have come to accept this situation. All disk manufacturers cheat. So my real interest is finding an easy to use tool which will mark blocks as bad (allocated) within the filesystem. Say any block not capable of reliably delivering it’s content within some user selected time threshold. Sadly, no one really offers such software.

    SMART is so useless as to be a joke. Any potential for that ancient IBM system was lost when disk manufacturers gamed their failure thresholds. SMART = Big waste of time.

    Reply
    1. Joep Post author

      If you’re in a hurry use Spinrite? it’s slow as … Anyway, if you are in a hurry to get data from a failing disk then clone it. Do not potentially beat it to death using Spinrite.

      Spinrite does not tap into any firmware. It uses simple extended BIOS int13h interrupts to read and write sectors.

      Hard disks do not fail to reallocate, they only do it in specific situations and for good reason I think. A disk will reallocate if 1. it can get the data from the sector or 2. if user gives up on data by writing to sector. So it reallocates only on specific conditions and as far as I am concerned there is good logic behind this.

      IMO flagging clusters at the file system level is a bad idea, but if you really want to no additional software is needed as it is what file system checkers like chkdsk do.

      Reply
  5. Michael Duval

    Priceless, im not agains spinrite, but these are the reasons ?!

    SpinRite is hdd/sdd recovery software, not “user error: give me my data back” software.
    That being said, its proprietary software and by default closed source. But if you really want
    to know how it works, there are many podcasts on it. But you did not take the time to
    grep through the 600+ transcripts ?

    Having read the article, i find your technical knowledge and investigative effort lacking . There are many flaws in it.

    Spinrite is a solution for poorly written firmware by drive manufacturers (no exceptions) and
    the operational problems that arise from it. A situation where most people who use computers
    will eventually run into.

    And since there is no better alternative, i have this piece of software in my IT recovery arsenal.

    Thanks for the laugh, it was a real day brightener.

    Reply
    1. Joep Post author

      Selective reading is a talent too I guess.

      – It is advertised as data recovery software.
      – It makes extraordinary claims.
      – These are backed up by pseudo-scientific mumbo jumbo.

      I have no problem with closed source. Explaining how something works does not require open source. I should not have to go through 600 transcripts to find out how it works.

      In my post I explain I understand perfectly well how it works and that it does in fact nothing of the claimed low level stuff it claims it’s doing. It does nothing to circumvent or correct poorly written firmware, and in the end it depends entirely on this firmware.

      If you have this software in your IT recovery arsenal then I sure hope you do not provide services to others.

      Claiming errors in my technical knowledge or investigative efforts is meaningless without rebuttal. Where exactly am I wrong? I am not trying to start a pissing contest, I am actually curious. If you find factual errors I’ll be happy to update my blogpost.

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *