User Manual
StableBit Scanner 2.X
An innovative disk surface scanner, disk health monitor and file recovery system.

File Recovery

(Build 3096)

Back to Contents

Damaged Sectors

During a surface scan, if we find any sectors that we are unable to read, we mark them as damaged and let you know. The status for the disk changes to "Damaged" to indicate this. Also, the Overview panel at the bottom lets you know that you have a damaged disk.

You may also see a tray notification message about the damage.

Once you have damaged sectors, it's time to recover the data from the damaged disk

Initiating the File Scan

To start the recovery process, select the disk with the damage. In the Disk Overview, it will let you know how many sectors were unreadable. Click on this, and it will bring up the File Scan window, where you can start scanning the disk to match the damaged sectors to files or file system locations.

At the top of the page will list the amount of space that is unreadable and the number of sectors.

Click on the "Start file scan" button to begin the process.

Before starting the recovery process, you have to allow the surface scan to complete. Once it has completed, then run the file system scan, to ensure you get all the damaged sectors on the disk.

The file system scan can take a long time to complete, depending on the amount of damaged sectors, the size of your disk and the number of files on the disk. This is because the file scanner is going through each and every file on the disk and identifying its location and comparing that information to the locations of the unreadable disks.

Damaged File List

As the file scan runs, it will start to list all of the affected files, if there are any. In each entry, it will list the size of the file, and the size of the actual damage.

You can expand each entry here to see where on the disk the damaged occurred, and where in the file itself the damaged occurred. It will list the total size and damaged sized here, as well.

Once the scan has completed, you can select all of the files, or specific files to recover. To start the recovery process, click the "Attempt file recovery..." button at the bottom of the window.

File Damage Map

For each damaged file the File Scan lists the Disk Map and the Damaged Entity Map.

The Disk Map lists how the current file is laid out on the current disk.

While the Damaged Entity Map shows where in the file the damage actually occurred.

You can hover your mouse over each block in the Disk Map and the Damaged Entity Map to get more details on the exact position of the damage.

Types of Damage

The most frequent damage type is file damage. But in addition to file damage, the StableBit Scanner detects a number of other on-disk damage.

  • Boot Sector

    The primary boot sector is found in the very first sector. It holds the code to start your computer (if the disk is bootable), and the partition table. If this sector is damaged, all the data on the disk is at risk. You may not be able to access any data after you re-boot, or re-boot at all.

  • Backup Boot Sector

    The backup boot sector exists on NTFS formatted disks and maintains redundancy if the primary boot sector fails. If it's damaged, none of your files are at risk.

  • NTFS Directory Index

    The directory index holds the list of files and folders in a directory. If it's damaged, some or all of the files in the folder may be missing.

  • NTFS Directory Metadata

    The NTFS directory metadata contains information about a directory. Without it, only the basic information about a directory is known such as its name. Its contents cannot be listed, and all the files and sub-folders that it contained are now missing.

  • NTFS Directory Read Error

    NTFS directories are composed of metadata and an index. The information necessary to retrieve the metadata or the index is damaged. All the files and sub-folders that this folder contained are now at risk.

  • Alternate File Data

    An alternate stream of a file is either partially or fully unreadable. NTFS files can have multiple streams. In other words, a file can actually contain 2 or more sets of data. This type of damage typically does not cause important data loss.

  • File Data

    The contents of a file is either partially or fully damaged.

    This is the most common type of data structure damage simply because that's the majority of the data that's on the disk.

    StableBit Scanner features file recovery capabilities to recover files from this condition.

  • File Metadata

    The metadata of a file is damaged. Metadata can be things such as file name, creation time, etc... This alone, does not mean that the actual data content of a file is damaged.

  • Primary GUID Partition Table

    The primary GUID partition table is damaged. The GUID partition table holds a list of partitions on the disk. Without it, the partitions cannot be accessed. There is a secondary GUID partition table in case the primary one fails.

  • Secondary GUID Partition Table

    The secondary (backup) GUID partition table is damaged. The GUID partition table holds a list of partition on the disk. Without it, the partitions cannot be accessed. This is the backup in case the primary fails.

  • Master Boot Record

    The Master Boot Record typically holds a list of partitions on the disk, among other things. Without it, you cannot access any partitions on the disk. In the case of a GUID partition table, the MBR is just a place-holder.

  • Master File Table

    The Master File Table (MFT) contains a list of all file and directory contents on the hard disk along with maintenance data. If a part of the MFT is damaged, then the files that are listed in that part will not be accessible. Any specific damage as a result of the MFT being damaged, such as file loss, will be reported as separate errors.

  • Master File Table - Primary $MFT Record

    The $MFT file is responsible for telling the system where the rest of the Master File Table (MFT) is. The MFT contains a list of all file and directory contents on the hard disk along with maintenance data. This is the primary record, if it is damaged, the mirror (backup) record is read.

  • Master File Table - Mirror $MFTMirr Record

    This is the mirror record to the $MFT record described above. It is a backup and is read in case the primary record is damaged.

  • Disk Unreadable

    This condition is triggered if the on-disk data cannot be analyzed as a result of boot sector damage, MBR damage, etc... All the data on the disk is at risk. This condition is typically combined with some other condition.

  • Partition Unreadable

    An entire partition on this disk is unreadable as a result of other damage such as damage to the MBR. This condition is typically combined with some other condition.

  • Unrecognized File System

    The StableBit Scanner understands how to analyze the NTFS file system, this is the standard Windows file system used on most systems, including the Windows Home Server. This error indicates that there is physical damage on a file system other that NTFS. This means that files on that partition are at risk.

The StableBit Scanner knows how to scan for damage on NTFS file systems only.

The StableBit Scanner recovery wizard is only designed to recover from file data damage as shown above. This is by far the most common type of damage that you will encounter.

However, the StableBit Scanner is designed to detect a myriad of other data damage conditions. If you are experiencing one of the other conditions, manual data recovery is recommended by a trained professional.

Attempt File Recovery

We will prompt for location to store the recovered files. Makes sure this is a safe location and not on the same disk.

By default, we attempt to recover from the bad sectors. However, you can disable this option, and it will only attempt to recover the undamaged sections of the files. If you're having issues recovering the file, disabling the "Recover bad sectors" option may be a good way to get partially recover the files.

Partially recovered files may or may not be usable. Depending on the format, it may be result in partial corruption (such as in media files) or could render the file completely useless (such as encrypted or compressed files).

NTFS compressed or encrypted files cannot be recovered with the StableBit Scanner.

Recovery

First, we will attempt to recover the good sectors from the files. Once that is done, we will attempt to recover bad sectors by utilizing different head positioning profiles.

This step will report on whether the file was recovered successfully or not.

Possible recovery results:

  • RECOVERED

    All data was recovered successfully for this file.

  • PARTIALLY RECOVERED

    Parts of the file were recovered, while other parts were not. Depending on the file type, the file may or may not work. For example, an incomplete EXE file may not run anymore. But an image, movie or song may work with some degradation in the damaged areas.

  • NOT RECOVERED

    No parts of the file could be recovered.

  • DAMAGED

    File recovery has not been attempted.

File Recovery

The StableBit Scanner's file recovery system is primarily designed to save the known good parts of a file to a another undamaged location. This ensures that you can access what's left of the file without seeing read errors. In many cases such as photos, this will save much of the original content, with some degradation in the damaged parts. This is what's called a partial file recovery.

In order to attempt full file recovery, the StableBit Scanner will try reading every unreadable sector multiple times while sending the drive's head through a randomized but pre-programmed set of head positioning profiles. The hope is that if the bad sector couldn't be read initially, by approaching it form a different direction and with a different velocity it will be read one last time. One more time is all we need.

While useful on a "spinning" drive, a solid state drive has no read heads, so the head positioning profiles will not be of any benefit. However, the repeated and rapid read requests from the drive may allow it to successfully read from the damaged sector one last time.

Full file recovery will not work all the time. It is not guaranteed to work by any means. It is a last resort approach and is worth trying if everything else fails.

Some people have found it useful to cool the drive before attempting bad sector recovery in order to make the metal contract. Your results may vary.