Sunday, June 28, 2009

How to copy Windows from a bad hard drive

If a hard drive starts going bad, and read errors and bad sectors start appearing, what do you do? It's best to have a recent backup, and if you don't, it's best to recover your files and settings and reinstall Windows on a new hard drive. However, if there aren't too many bad sectors, it's possible to copy Windows from an a bad hard drive to a good one. Here's what I did.

First, I considered the requirements. I did not want to run chkdsk or otherwise attempt to fix things on the bad drive, because that could make things worse. I wanted to transfer the entire filesystem, not copy individual files. I wanted to know which files have read errors, so I could see the extent of damage and then either replace individual files or conclude that the situation is hopeless and reinstall. Finally, I wanted the process to be reasonably fast and automated.

Disk cloning software seems like the obvious choice. Unfortunately error recovery and logging features are lacking. After some research it seemed that no disk cloning program will create a log of files with errors. The only promising program was DiyDataRecovery Diskpatch, but it was ridiculously slow.

I decided on another approach: ddrescue. I downloaded the Ubuntu Rescue Remix, booted it and ran ddrescue, putting the log on a USB flash drive. The initial copy was fast and simple. Then, retries quickly read about half the bad sectors. I was left with 26 sectors which seemed totally unreadable. The ddrescue log gave offsets, which I divided by 512 in an automated way to give sector numbers.

Now I put the write protect jumper on the old hard drive and swapped the SCSI IDs. I wanted to be sure that the sector numbers I had remained valid. This was probably unnecessary and it complicated things. Windows started booting off the new drive, but then it mounted the partition from the old drive as C:, and I got a blue screen of death because of write protection. (Make sure you set up Windows to not automatically reboot after a BSOD. It's much easier to set that option in Windows than to edit the registry when Windows can't boot.) To fix the problem I used a disk editor to change the disk signature in the MBR of the new disk, and then I used Partition Saving to update which partition is mounted as C:.

Finally, I was able to boot Windows on the new drive. I used nfi.exe (from OEM Support Tools Phase 3 Service Release 2) to find which files those bad sectors corresponded to. The results were encouraging. Only one bad sector was in a real file, and Windows File Protection took care of that. The others were already marked as bad sectors or in unallocated space.

Since the filesystem on the new drive was directly copied from the old drive, it had sectors which were marked as bad. I needed to remove these. Again, I used Partition Saving. This was probably a mistake.

Now it was time to increase the size of the partition because the new drive is larger. Unfortunately, partition resizing programs refused to work. This wasted by far the most time of the whole operation. Eventually I tried ntfsresize, which told me I had hopelessly many bad sectors. (This is the sort of unprofessionalism found in open source software; it shouldn't be making an emotional comment. Commercial software handles the problem in a more professional way, such as cryptic error codes, generic error messages telling you to run chkdsk, or lockups.) Eventually I concluded that the bad sector file was corrupted in a way that chkdsk was unable to detect or fix. I suspect the problem was caused by Partition Saving, because Partition Magic started once before I reset the bad sector list and it always locked up after that.

Fixing the bad sector list was a problem. The /b option in Vista chkdsk didn't help. I read about a method using ntfstruncate, but a LiveCD with ntfstruncate was hard to find and ntfstruncate refused to work. Finally I recompiled ntfsresize, commenting out that check for hopelessly many bad sectors. (I used System Rescue CD. Besides rescue tools, it also has basic networking tools and gcc.) After a resize, chkdsk found some problems with the bad sector file, and after that everything was fine. Mission accomplished.

One interesting pattern here is that open source tools were far more useful than commercial software. For example, I used to think of Ghost and Partition Magic as important tools, but their poor error recovery and reporting made them useless here.


benshead said...

I'd love some guidance about how to recompile ntfsresize. I'm stuck in the same place you were. The ntfstruncate trick didn't work for me either. I am fairly comfortable using linux as a tool, but I have never compiled software.

Can you give me some direction? Thanks.

Boris Gjenero said...

Compiling things in Linux is usually very easy. Basically, you can just do the following:

tar xzf ntfsprogs-1.12.1.tar.gz
cd ntfsprogs-1.12.1

If any of these steps fail, that is probably because some software is missing or out of date. You can also do it in Windows using Cygwin. The ./configure and make steps are much slower in Cygwin, but they work.

If you edit a source file, just run make again. It will notice the change and do all that is necessary to bring the executable up to date.

I think you can just comment out the
if (NInoAttrList(resize->ni))
err_exit("Hopelessly many bad sectors! Not supported.");
part at line 691 of ntfsprogs-1.12.1/ntfsprogs/ntfsresize.c. However I'm not 100% sure. It's been a while and I used an older version of ntfsprogs.

benshead said...

Thanks! I'll try it tonight...

benshead said...

Thanks Boris. This worked great. I appreciate your help!