Failing Disks on a Dell Laptop
A friend was telling me the story of how her laptop (Dell Studio Laptop 1737) had failed and that she had taken it to a local computer store in Medicine Hat. I quizzed her and it began to sound like a hard disk failure. She said they were looking at it and I asked her if it was still under warranty but she wasn’t sure. After a few more days, we talked again and she brought me her laptop after paying $90 for its return. For a $40 diagnostic fee and $50 for attempted recovery there was no recovery of data and it was returned to her because the drive was bad.
A note to others going through this. When a computer fails to boot up, you have to default your thinking initially to a failing hard drive to protect yourself and give yourself a chance to pull as much data as possible from it. The reason for this is that a drive that starts to go bad cascades very quickly to broken and unrecoverable the more you muck around the file system before determining this. After a certain point you have removed most of your chances to retrieve any or all data off the disk without going to the $3000-$5000 route and using special equipment to pull data off the platters or hope its a control board should the drive fails to spin up. It’s fairly quick work to look at smart data on the drive or use other tools to boot up and quickly check the disk for excessive bad blocks, etc. That has to be the thought process in my opinion.
When I turned this laptop on for the first time, it found the MBR and stalled at the secondary boot image asking if I wanted to repair the file system. Danger… its a trap…. so don’t do it as we don’t know enough yet. Having seen that message, I turned off the computer and inserted a live-cd and booted up my system rescue cd. This gave me an operating system that was running in memory and I could quickly determine what I was dealing with and reducing my chances of causing addition problems for this disk drive.
The first thing I noticed was that there were two drives. Each was a seagate momentus 5400.4 320GB disk drive. I looked at the partition data first with fdisk and noticed that the primary disk was ‘bootable” and had 2 ntfs partitions. The second disk had a single large ntfs partition. So within 30 seconds, I now knew which disk was the potential problem disk and that we had a second disk. Given this partitioning for each disk, I knew this wasn’t a raid 1 configuration so my next step was to figure out what was on that second drive. I mounted the second drive read only and it showed that it was empty except a few vista file system recovery tools. Odd I thought at the time. Next, I attempted to mount the ‘problem drive” read only still hoping that it was some sort of file system corruption but the procedure failed with hard disk errors on the console. The next step is what should have happened at the local computer store. Turn off the computer and remove the bad drive. We need to stream as much data as fast as possible off that drive because we are on borrowed time. The 2.5 inch Sata drive was put into one of my external eSata enclosures and I started up my live cd and began to attempt recovery ignoring errors as it went.
My procedure was the following:
First you copy as much data as possible, without retrying or splitting sectors:
- ddrescue --no-split /dev/hda1 imagefile logfile
Now let it retry previous errors 3 times, using uncached reads:
- ddrescue --direct --max-retries=3 /dev/sdj imagefile logfile
If that fails you can try again but retrimmed, so it tries to reread full sectors:
- ddrescue --direct --retrim --max-retries=3 /dev/sdj imagefile logfile
Unfortunately, the drive was failing quickly and eventually became unreadable. When it hit a failed sector, it would disconnect itself from the bus and we would lose access to the disk. A bus reset and bus rescan would bring it back online but my estimation was that it would take 450hr to get through the first filesystem. Even with this problem, I was able to retrieve 10GB for the first ntfs partition and 288GB for the second ntfs partition of the problem drive.
I have a few unanswered questions.
1. Why did the computer store charge $40 when the dell laptop was still under warranty. Why not tell the customer that they could have a replacement drive within 24/hours which is the type of extended service this user had when I checked the service tag on the back of the computer. The entire process took me 60 seconds at most without knowing anything of how dell operates. I knew within 30 seconds that the drive was bad so why charge $40?
2. Who put those vista filesystem recovery tools on that second disk. I asked the owner and she said they had purchased a second disk but never used it. That is highly suspicious that someone might have been attempting to repair the NTFS file system thinking that initial boot message was about file system corruption.
3. If they attempted disk recovery then where is the raw disk dump? The customer paid $90 of which $50 was for recovery… where is the raw disk dump or fragments from it?
4. I know that someone pulled the bad drive out because a mounting screw had not been returned. Not knowing the history, I don’t know if that was the local computer store or from dell?
I have a fairly good idea of what I think went on given the forensic evidence left behind but it is circumstantial. The drive was in their possession about a week and the customer paid $90 and feels cheated given the lack of results.
As a footnote to other dell customers here is what you can do and what dell tech will tell you before they will send a replacement drive.
- Press ‘Fn’ while turning on the computer
- A diagnostic test will run… note the error code for the disk drive
- At some point, they will ask you to run extensive memory tests, choose no
- Choose the extended and custom tests and you can then have your dell to a quick test of your hard drive
