Is this what a hard drive does when it's dying?

July 23, 2015 5:06 AM

All of a sudden since yesterday my computer has been practically unusable. I originally thought that Windows Defender was going crazy because everything had ground to a halt but I could still see it accessing files via the resource monitor. I eventually killed it, but nothing improved. I'm starting to think my hard drive is dying but I've never had a problem like this before.

I have a smallish ssd where windows is installed and a few other things, but everything else, including most program files are on a 2TB hard drive. I am not able to open any programs that live there and right clicking on any files causes explorer to freeze (and it can't be killed via the task manager-only restarting). Steam tries to start, for instance, but hangs endlessly trying to access a log file that can't be manually deleted or renamed. Occasionally I could get a program to start several minutes after trying initially, but everything is slow and will lock up.

Windows itself seems to be OK, except the explorer issue when trying to access files from that drive. I see entries in the event viewer that say "The IO operation at logical block address XXXXXXXX for Disk 1 was retired" with different values for XXXXXXX. I'm positive I don't have any kind of virus or malware because I do scans periodically and only install things I'm sure about, and this seems different.

I've had hard drives fail before, but they just stopped being visible to the OS or not even spin up, so I don't know if this is what's happening and just exhibiting different symptoms? This disk is about 2 or 3 years old. I can get a new one and probably reinstall windows and everything else just to make sure, but I don't want to waste money if that's not the issue. I googled the error but I don't see ppl experiencing the same kinds of behavior. Also I'm on a tablet for now...

I was able to boot into safe mode, and the system is apparently stable but I think only because most startup programs aren't trying to access that drive. I am running chkdsk, but it's being going all night and is only 5% done. There are several entries though that say "a disk read error occurredc0000185. The disk does not have enough space to replace the bad clusters detected in file", which seems wrong since the drive is only half full.

All I wanted to do was play Witcher and watch Netflix! Did I anger the computer gods?

posted by polywomp to Computers & Internet (6 answers total)

Best answer: Yes, this looks like the drive is dying. If you want to save any files on it, stop running chkdsk and anything else until you've backed up as much of the drive as possible.

A more thorough explanation of the 'bad clusters' aspect here: http://superuser.com/questions/265965/chkdsk-seatools-and-does-not-have-enough-space-to-replace-bad-clusters
posted by Ashlyth at 5:15 AM on July 23, 2015

Best answer: Yeah, it's toast. Backup and replace stat.
posted by Johnny Wallflower at 6:50 AM on July 23, 2015

Response by poster: Cruuud, well I went to work this morning and left chkdsk running. Ooops!
posted by polywomp at 7:10 AM on July 23, 2015

For the benefit of future googlers (probably too late to save polywomp's data): chkdsk is one of the worst things you can run against a drive suspected of being in the process of physically failing, or with substantial numbers of unreadable sectors from any cause.

Data recovery is not chkdsk's design purpose. Chkdsk is for fixing the kind of internal filesystem inconsistencies left behind by things like not shutting down your computer properly, which if left in place will tend to multiply and compromise future data integrity. On a drive whose surface is becoming progressively more unreadable, chkdsk will misinterpret unreadable sectors as various kinds of fixable filesytem damage, then lose an awful lot of otherwise perfectly recoverable files in a doomed attempt to perform that fixing. It also thrashes the crap out of the drive, which is not something you want to do to a drive that's already on its way out.

If you've got a drive with failing sectors and you want to recover as much as possible from it before it dies entirely, the correct steps are

1. Stop using it altogether until you can find somebody who knows how to

2. Block-by-block clone it onto a fresh drive with GNU ddrescue.

3. Recover your files from the clone onto yet another drive, either using another pass of GNU ddrescue followed by something chkdsk-like or, if that doesn't get you the results you're after, specialist file recovery tools like ZAR or PhotoRec.
posted by flabdablet at 8:26 AM on July 23, 2015 [6 favorites]

Flabdablet's post is good stuff. That said, if paying someone to recover this stuff isn't an option, i'd try testdisk at this point.

It's pretty much been magic and has worked 100% of the time at getting at least most of the files back for me with the big if being that i tried it IMMEDIATELY when i started getting symptoms like this.

You may have used up your dying breaths with chkdisk, but it's still worth a try.

It's similar to the steps mentioned above, except you let testdisk write your files to your second destination drive instead of trying to make a straight clone. It's sort of steps 2 and 3 all in one in that it tries to just recover files, and leaves you with the results(with options to grab more garbled stuff if you want). It's basically ddrescue with a bit more functionality.

I got about this far with my music/media/photos drive i hadn't recently backed up, then ran that. I only lost something like 5 files, and the drive was completely bunk afterwards and headed for the drill press and the garbage after that.
posted by emptythought at 4:01 AM on July 24, 2015

Response by poster: Amazingly, I was able to copy everything over to a new drive. I left the old drive in my PC and just kept some TV shows and movies on it, and so far it seems to be serving those up to a Roku without problems, but I won't put anything else on it, just in case.
posted by polywomp at 7:17 AM on July 25, 2015