What’s wrong with using (DIY) data recovery software to recover data from an ‘unstable drive’? By unstable drive, I mean a drive that has problems delivering the data due to underlying physical problems. Physical problems that potentially get worse due to stressing the drive.
Reduce stress on drive
So, first goal is to reduce stress. Problem is that using data recovery software you can not control the amount of stress. Even worse, the OS itsself, which is required to even run the software, will put quite a bit of stress on the drive as soon as it ‘sees’ the patient drive.
Below is a log captured of the mounting process by Windows 10 of an almost empty drive. If there would be more data on the drive the log would be much larger due to many more sectors being read.
Note that failed reads would cause the OS to re-read sectors several times, and if those attempts fail, to start the process all over again. This is causes undesired stress on the drive and will cause the OS to freeze and eventually ‘drop’ the drive. More importantly there’s a significant risk the drive’s condition will further deteriorate.
Log of Windows only detecting and mounting a drive (LBA address[no. sectors]):
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 7[4]
Successful Read: 2[1]
Successful Read: 2048[1]
Successful Read: 2048[32]
Successful Read: 3907027119[1]
Successful Read: 6293504[8]
Successful Read: 5912104[24]
Successful Read: 5912128[24]
Write Attempt 35: 5912136[8] – RCRD $LogFile
Successful Read: 6043168[8]
Successful Read: 6293504[64]
Write Attempt 36: 5912112[8] – RSTR $LogFile
Write Attempt 37: 5912104[8] – RSTR $LogFile
Write Attempt 38: 5912120[8] – RCRD $LogFile
Write Attempt 39: 5912112[8] – RSTR $LogFile
Successful Read: 2072[256]
Successful Read: 6174248[4096]
Successful Read: 6178344[6144]
Successful Read: 0[16]
Successful Read: 6184488[16384]
Successful Read: 0[1]
Successful Read: 6200872[16384]
Successful Read: 12734209[1]
Successful Read: 6217256[16384]
Successful Read: 12734209[1]
Successful Read: 6233640[16384]
Successful Read: 0[16]
Successful Read: 6250024[2048]
Successful Read: 6252072[2048]
Successful Read: 6254120[10240]
Successful Read: 6264360[6144]
Successful Read: 6270504[8192]
Successful Read: 6278696[8192]
Successful Read: 6286888[6593]
Successful Read: 4836864[9]
Successful Read: 4967952[5]
Successful Read: 2328[8]
Successful Read: 2400[8]
Successful Read: 4965200[8]
Successful Read: 4869960[40]
Successful Read: 4890408[32]
Successful Read: 4931400[40]
Successful Read: 4939560[32]
Successful Read: 6293576[8]
Successful Read: 4967944[8]
Successful Read: 6293488[8]
Successful Read: 6293568[8]
Successful Read: 4967352[126]
Successful Read: 4967478[2]
Successful Read: 4911936[8]
Successful Read: 4910920[512]
Write Attempt 40: 5912128[8] – RCRD $LogFile
Write Attempt 41: 5912120[8] – RCRD $LogFile
Write Attempt 42: 5912128[8] – RCRD $LogFile
Successful Read: 0[16]
Successful Read: 6293584[8]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Write Attempt 43: 5912136[8] – RCRD $LogFile
Write Attempt 44: 5912120[8] – RCRD $LogFile
Write Attempt 45: 5912104[8] – RSTR $LogFile
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Write Attempt 46: 2400[8] – INDX (MFT ‘\’ – Root Directory)
Write Attempt 47: 5912128[8] – RCRD $LogFile
Write Attempt 48: 5912112[8] – RSTR $LogFile
Write Attempt 49: 6293560[8] – MFT 28: ‘$Repair’
Write Attempt 50: 5912120[8] – RCRD $LogFile
Write Attempt 51: 5912104[8] – RSTR $LogFile
Only half the story!
Above example is only half the story! In case a drive can not read a sector it will perform multiple error correction procedures which include re-reads. Eventually it will return an error to the host. In response Windows will try to read the sector again, the whole procedure starts again.
Now say you try to use a file recovery tool to recover your data. Each bad sector it reads will automatically trigger this process of re-reads and error recovery, there is no way to stop this! This is why professional data recovery hardware is so important as is provides to ability to limit re-reads and error recovery. And thus reducing stress on the drive.
Moral of the story
Moral of the story is to be very careful with recovering drives that are potentially physically damaged. A drive that was accidentally dropped falls into this category by definition. To recover data from a drive you need to access it, there is no way around that. So, to a degree data recovery always implies taking a risk: The risk of the drive dying completely. A professional data recovery service however uses specialized, professional hardware that isolates the patient drive from the OS. It also allows for tweaking drive access parameters so that the drive is stressed as little as possible.