Disk cloning with DiskPatch
back to Repair/Rebuild Boot Sectors next to Disk Surface Scanning

 

A step-by-step example of how to use this function can be found here.

Introduction

Why clone a disk?

The first thing a professional data recovery engineer will attempt before performing any repair or recovery operation, is cloning the problem disk. No matter how simple the problem may seem at first sight, a cloned disk offers a good safety net in case the recovery doesn't go according to plan.

Cloning a disk first offers several key advantages:

  • you can perform your repairs on the clone. If the repairs don't work out as planned, you still have the original disk in its unmodified state, so you could create another clone to try again.
  • in case of bad sectors, repairs can not be made on the original (bad) disk. If bad sectors exist in areas on the disk that contain disk structures, repairing these structures is going to be impossible because you can't write to bad sectors. Cloning the bad disk to a good disk will give you a much better chance of repairing those damaged structures.
    Be prepared for the fact that cloning a bad disk to a good disk can take a considerable amount of time.

Having said this, you can safely make repairs on a physically healthy disk using DiskPatch. If repairs do not bring the desired results (access to your data) or even make matters worse, you can undo the repairs you have made. If you can be certain that the disk needing repairs does not have any physical defects (bad sectors) and you don't have a spare disk handy for cloning, you can forego the option to clone a disk. You can check a disk for physical defects by running a surface scan.

In short:
If you're performing a partition table repair or a boot sector rebuild and the disk is in good (physical) condition, a clone is not needed.
If the disk shows signs of having bad sectors, a clone should be made as soon as possible: not only to facilitate repairs (if needed) but also to copy the data from the bad disk before the disk fails altogether.

Many of the 'conventional' cloning products, disk copiers and disk imagers are not particularly good at handling disks containing bad sectors or corrupt disk structures. The DiskPatch cloning feature is designed to handle disks that contain unreadable areas, and to ignore any damage in disk structures such as partition tables and file systems. Keep in mind though that the DiskPatch clone feature does not offer the functions that 'conventional' imaging tools offer, like resizing partitions; clone is meant to facilitate recovery.

Important: If a disk is cloned for forensic purposes (evidence acquisition) refer to the "Forensics" page for background information and procedures.

How DiskPatch cloning works

DiskPatch uses an intelligent method to make sure that as much data as possible gets copied. This is achieved by running the clone using a 2 step procedure:

Step 1: copy as much data as possible in the quickest possible way. Read retries are ignored to make sure that the first step completes as fast as possible. When a bad sector is encountered the clone process will skip a number of sectors and add the location where the skip starts to a list. This list is used in step 2.

Step 2: clone the areas that were skipped in step 1. Read retries are now used and the sectors are handled in such a way that as much as possible gets copied. Step 2 can be time consuming; depending on settings bad sectors can slow down the clone process severely.
  • skipping sectors (step 1) is used because bad sectors are usually found in groups; skipping more than 1 sector after running into bad sectors will speed up the clone process. The number of sectors that should be skipped can be configured in the options screen.
  • both steps can be run automatically (meaning you can run a 'full' clone; step 2 will start automatically when step 1 has finished), or you can run only step 1 or step 2. Step 2 can only be run if step 1 has been completed first.
  • step 2 only needs to run if sectors were skipped during step 1. If step 2 starts and no additional sectors need to be copied, DiskPatch will notify you of this.
  • if you restart step 1 after you have aborted step 1 you will have to start from the beginning again.
  • if you abort step 2 you DO NOT have to run step 1 again. DiskPatch keeps a list of sectors that need to be copied for step 2 and that list is updated as step 2 runs to completion. If you abort step 2 before the entire list has been processed, restarting step 2 will simply continue processing that list.
  • the bad sector list that is created during step 1 and used during step 2 is saved on the target disk so exiting and restarting DiskPatch will not have negative consequences. When the clone has been completed the list will no longer be on the target disk (it is used and removed on the fly during step 2 of the clone process) leaving the cloned disk(area) as an exact copy of the source disk(area).

The advantages of the 2 step clone process explained through examples:

Consider cloning a disk that is dying rapidly (the number of bad sectors is growing as the disk is used). If you would clone the disk with a clone tool that would simply grind its way through the disk from start to finish, it's at all possible that the actual clone process could cause the disk to seize as it encounters clusters of bad sectors; you could end up with a partial clone.

If you would clone using the DiskPatch '2 step' clone it could go something like this:
Step 1 will copy everything that can be read as quickly as possible, circumventing clusters of bad areas. Step 2 will 'work' the areas that step 1 has skipped and extract as much data as possible. As step 2 does not interfere with the work that step 1 has already done, the data that has already been copied during step 1 is safe: if the source disk dies during step 2 than at least step 1 has copied the bulk of the data. A possible downside to this scenario is that step 2 could take quite some time. Keep in mind that step 2 can be aborted and restarted as needed; you could analyze the clone before letting step 2 run to completion to see if the data you need has already been copied. You could also change the settings that affect step 2.
Never change the contents of the target disk when you're examining the disk in between cloning steps.

Now consider cloning a disk that has 1 or 2 bad sectors (in important places, like the MBR). There's no need to 'grind' through the disk extracting as much as possible; most sectors can be read normally. Step 1 will complete quickly and the few bad sectors that will be processed during step 2 will not take very long. The clone will be completed quickly.

What happens when a bad sector is encountered.
If DiskPatch encounters a bad sector during a read operation and the sector's contents can not be read at all, DiskPatch replaces the sector data with a text string: DPBADSECTOR. If the contents of the (bad) sector need to be written to disk after the read error (for instance during a clone operation, or a read/write surface scan) the sector data will contain this string. This can help to locate files that were affected by the read errors: search through the files and use DPBADSECTOR as a search string.

General clone considerations

  • if you have a disk that's dying (bad sectors are appearing) you should keep in mind that each time you read that bad disk, it could be the last time. Clone this disk as soon as you can!
  • you should decide how to handle bad sectors and read errors during step 2 before you start cloning the disk.
    If you use default settings, each bad sector that is encountered will be read a maximum of 32 times (read retries) to see if data can be read. This can make step 2 very slow. You need to decide for yourself where the focus must be:
    clone faster and maybe lose some sectors (set read retries lower),
    clone slower and get as much as possible (set read retries higher).
    You can change the number of read retries in the options screen. Setting this to 0 (zero) will disable read retries. Setting read retries higher than 64 is generally not a good idea.
    Another setting that affects the clone process is the maximum number of read errors that are allowed before DiskPatch aborts the process (read error threshold). This affects both steps of the clone. The default setting for maximum read errors is 32, meaning that after 32 read errors DiskPatch will interrupt the current process and ask you how to proceed: ignore further errors, reset the number of errors or disable error checking. You can change the read error threshold in the options screen. Setting this to 0 (zero) will disable read error checking.
  • the target disk for the clone should be at least the same size as the source disk. The target disk is allowed to be smaller, but DiskPatch will warn you if this is the case. Obviously, if the target disk is smaller a part of the source disk will not be copied, so this is generally not a good idea.
  • disk cloning may take quite some time and both disks will be active continuously. Because of this the disks may get hotter than during normal operation. Consider opening the PC casing and blowing in cool air using a fan placed at approximately 1 meter from the PC.
    If you do not apply additional cooling, do not remove the case as this will disrupt the internal air flow
    !
  • as every read error is logged, the log file may expand in size up to a point where no room is left on your DiskPatch boot diskette. Consider disabling logging while cloning a disk that is in really bad shape (read more on how to do this here), or reduce the amount of info that is logged by disabling 'log each disk read error' in the options screen.
  • the write error threshold is set to '1' for both steps of the cloning operation. If the prompt is displayed after a write error has occurred, you can choose to disable the write error threshold; after that, no more write error notifications will be displayed.

There are a number of configuration settings that affect DiskPatch's behavior during cloning. Make sure these settings are correct before starting the procedure.
The settings that affect cloning are:

affects step 1 affects step 2
read retries no yes
write retries yes yes
read error threshold yes yes
write error threshold yes yes
disk reset after error yes yes
skip x sectors after error yes no
log each disk read error

affects logging only

Starting the clone procedure

Important: The disk that has been selected in the 'select disk' screen is the source disk for the clone operation.

Select [Disk related tasks], [Clone]. Select the target disk (the disk that should receive the clone). If the target disk is smaller than the source disk DiskPatch will notify you.

You can then select the type of clone operation:

1 Pass (fast) run step 1 of the clone process.
2 Pass (full) run step 1 and step 2 of the clone process.
2nd Pass only run step 2 of the clone process (step 1 must have been completed).
Verify clone compare the cloned areas for the source- and target disk.

Next you must select the area to clone. Leave the suggested values to clone the largest possible area. You can only select the area to clone when starting step 1; step 2 automatically uses the values that were entered when starting step 1.
Please note that the maximum size of the area that can be cloned is defined by the smallest of the 2 disks involved.

The clone status screen:

The [Blocks skipped] count tells you how many areas were encountered that have been skipped during step 1. The total number of sectors skipped is determined by the 'block skip size' and the number of areas skipped. In this example: 3 errors were encountered, the skip size is 1024 sectors so a total of 3072 sectors was skipped. These will be cloned during step 2.

Note: If DiskPatch encounters areas that can not be read during step 2 the 'estimated time remaining' may increase dramatically. Once the bad areas are processed the 'estimated time remaining' will decrease again.

http://www.diydatarecovery.nl