Solved

Disable SMART function from WIN2K when no BIOS option exists

Posted on 2003-12-04
16
1,050 Views
Last Modified: 2012-06-22
I have a data recovery problem with an IBM (hitachi actually) hard disk where the SMART functionality on the drive is sick (DFT confirms this. With SMART turned on the drive fails. with it off the data can be accessed). The only systems I have avauilable have Award BIOS (or the compaq sort-of-bios/some stuff on the HD) and do not have any way to disable the SMART function on the drive.

The data in question is in an NTFS partition on the drive so I cannot simply use DOS and the DFT utility to turn off SMART then read the data. (and there are in fact some data errors but most of the data seems to be OK. DFT CAN read the disk surface).

Is there any way that I can convince the drvice drivers in W2K (or NT).

/s/ Terry
0
Comment
Question by:TerryMcCutchen
  • 6
  • 5
  • 5
16 Comments
 
LVL 2

Accepted Solution

by:
Bigjohn-s earned 460 total points
ID: 9878329
Terry -

Are you trying to recover the data to another machine/disk?

Norton Ghost will allow you to copy the partition to another disk.  The errors will still be there, but they'll just be bad sectors on a good disk.

John
0
 

Author Comment

by:TerryMcCutchen
ID: 9879294
John;
I hope this works ...

The problem is that I cannot get W2K past the automatic chkdsk. I HAVE managed to disable the S.M.A.R.T. functionality but I can't get W2k (Both PRO and AdvServer) past the "automount".

/s/ Terry
0
 
LVL 2

Expert Comment

by:Bigjohn-s
ID: 9879717
Ghost boots from PC-Dos diskette.   SO if SMART is disabled and you can boot a diskette you can access the hard disk.

If you need information on how to do this, let me know.  I just did 4 pc's over a network today.

John
0
 
LVL 1

Assisted Solution

by:NetwerkMerc
NetwerkMerc earned 40 total points
ID: 9889085
Well if you are not trying to data rec.
Make sure the BIOS AV protection is off and PIO/DMA and if present in the BIOS (usually not for IDE, only personally remember seeing it in SCSI BIOS's) "write caching" are disabled.  Good time to disable any other fixed disks to prevent access to unintended targets.

Boot from a Win98SE EBD or your favorite util boot disk, but it MUST have "debug" later thas DOS 5.0 (please).  (in the command list, each line represents a carriage return "enter")
x:\>debug
A 100
INT 13
<enter again>
RAX
0301
RBX
0200
F 200 L 200 0
RCX
0001
RDX
0080
P
quit

reboot and start install normally
You can type this manually or script via input redirection.  This directly calls Int13 for hard drive access and starts at Cylider 0, Sector 1 writing all 0's erasing ANY and ALL partition tables (thereby the partitions).  If you need DataRec before hand, as THIS WILL ERASE EVERYTHING, try www.sysinternals.com .  They have some good freeware to pull data off NTFS in a variety of ways.  

Hope this helps!

-Eric

Lemme just reiterate...  THIS WILL ERASE EVERYTHING!  Use at your own risk :)
0
 
LVL 1

Expert Comment

by:NetwerkMerc
ID: 9889110
btw....
.
.
.
0001
RDX
0080
.
.
"0080" specified the first hard disk.  So.."0081" would be the second, "0082" the third etc.  

if you script it, add lots of prompts for confirmation!!!

-Eric
0
 

Author Comment

by:TerryMcCutchen
ID: 10004270
Hi;
Still not working.

Ghost seems promising but it tries to scan the disk for bad blocks at maybe one per minute. At this rate it will be a LOOOOOOOOONG time before it gets to doing anything.

BTW doing it over the net is not an option.

/s/ Terry
0
 
LVL 1

Expert Comment

by:NetwerkMerc
ID: 10005340
You might want to give "Get Data Back for NTFS".  Usually if I cannot get data back through Rcon and/or NTFSdos, I try that.  It workes half the time.  Seems to work better of formatted or repartitioned disks, opposed to physical or media damaged.  But, between those three I was able to recover most, which is better than none.  Then you are going to need to lowlevel format and hope it is EM related to see if it is still viable hardware.  But most HD have a 5 year warrenty, so I would RMA it once you are done.  

-Eric
0
 

Author Comment

by:TerryMcCutchen
ID: 10006765
Hi;
I know a little more now. The first trick is getting the DRIVE to disable the S.m.A.R.T. functionality. Turns out that an IBM utility works for hitachi disks (Look up DFT on the IBM web site and there is a feature setting utility). The trick is to get this utility to work then run ghost WITHOUT doing a RESET (i.e. reloading).

GHOST is now coppying the disk (and has been for two says ... I guess another three to complete). Why so long you ask?? The disk has so many bad blocks (mostly at the start fortunately) that Ghost (and the BIOS) are retrying the bad blocks. For reference I am using the -IR and -FRO switches for the disk.

/s/ Terry



0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 2

Expert Comment

by:Bigjohn-s
ID: 10007334
Terry -

Best I can tell you're doing the right thing.  There is no other way to get a copy of the drive by sector that is more effective than Ghost.... can't guarantee the quality of the stuff you get, however... seems that your drive is quite badly hosed.  Especially if it's been running for 2 DAYS!  How big is the drive?

John
0
 
LVL 1

Expert Comment

by:NetwerkMerc
ID: 10008764
If for some reason it fails.  Make a Ghost DOS client disk (ie not PC DOS) from a Win98 SE EBD and copt SMARTDRV to it.  Load smartdrv and see if that increases performace.  On huge IO intensive jobs it can increase performace as much as 66+%.  If you do not have access to a 98 disk (for SMARTDRV), I'd have to check out DOS 6.22 and 7.0's current EULA, but I think I can give it to you as long it isn't modified or charged for.  Good luck.  Most of IBMs HD products have been licensed out to Hitachi.  If all else fails you can try "NTrecover" from Sysinternals.  But that over a serial connection, so that will take longer, but last ditch alternative.

-Eric
0
 
LVL 2

Assisted Solution

by:Bigjohn-s
Bigjohn-s earned 460 total points
ID: 10008816
Ghost is going to bypass smartdrv - it accesses the hardware directly.
0
 
LVL 1

Assisted Solution

by:NetwerkMerc
NetwerkMerc earned 40 total points
ID: 10008910
I think you force it to call Int13 via DOS.  It may make it faster.  Like I said...only if it fails.

-Eric
0
 

Author Comment

by:TerryMcCutchen
ID: 10009292
Hi;
Some updates. After 48 Hours the drive is still not really moving. The problem is that each read of the source drive is being retried. I know that at the start of the drive are some 64K bad sectors (this all started when the S.M.A.R.T. redirect area overflowed somehow).

For reference. The disk had two NTFTS partitions, each with a Win2K/Pro installed on it. Each partition (drives D: and E:) is roughly 10GB. The D partition ran fine for two years as part of my W2K domain.  There was a problem so I needed to build another system and built it on E. I was transfering stuff from D to E when things started going crazy.

Looking back what I think happened is that the S.M.A.R.T. function started fetting sick (DFT now claims that the function is completely dead, the reference at the start of this discussion is to convincing the BIOS that S.M.A.R.T. is dead). At this same time something went wrong with the BIOS on the system where the disk then lived.

The original system is back up (with a reflashed BIOS) and the disk is now in a different system that recognizes the absence of S.M.A.R.T. (The answer to the question that started this discussion is "use a different BIOS that ALLOWS S.M.A.R.T. to be disables ... mutter mutter mutter").

Now the disk has actually been through a W2K/Adv Server startup but will crash AdvSvr if an attempt is made to actually access it. In the CHKDSK on server startup (Which took two days) numerous problems were found in the FIRST partition (D:) but the second partition (E:) seemed ok as (obviously) is the VTOC (sorry for the dated terminology). Under AdvSvr any time I "touch" the drive the system blue screenes (don't have the actual error data handy ... it's one of the kernel exceptions).

The problem behing the problem is that I was packing some 200 boxes for storage just before this all happened and had the packing list (and some tax information) on the desktop on D. My backups normally run around 3:00 AM and the first crash (of the system on D) happened durring the backup. {My normal daily backups are simple  XCOPYs of the profile directories and the crash resulted in the backup desktop not being there but I didn't realize this}. Once I had built the new system I copied the profiles from the old D partition to the new E partition and planned to get the backups going after I had moved. (not realizing that I did't have a clean backup of the old D system).

So when the system died I figured I would just go ahead with the planned upgrade of the "system disk" (D and E) to a 60 GB ATA100 drive then restore from the backup. While building the new system disk I discovered that the BIOS was sick. Thus we get to the situation at the start of this discussion where I need to get the data back from the old D or E partitions.

Two other things of note. First, I suspect that I may have had some kind of BIOS virus and have since replaced the motherboard on this system (and the "new" BIOS does in fact allow me to disable S.M.A.R.T.). Second, I think after this is all over (one way or another) I am going to go to a RAID 5 configuration likely with 4, 5 or 6 60GB drives in a 1/x configuration.

Finally Ghost is running again with the -FFI switch (direct IDE) and seems to be running a little faster but it still has not brought up the "confirm clone" dialogue box.

/s/ Terry
 
0
 

Author Comment

by:TerryMcCutchen
ID: 10639442
Welll ... It has been a battle but the problem is now resolved (and I know more about hard drives than I ever wanted).

First the solution involved running ghost for almost two months (after a mere two week false start). What I wond up doing was making a RAW Sector by sector copy to an identical disk. This gave me an image that I could sucessfully mount (and run chkdsk on). Once I got to this point the files I needed were all there. The time was caused by the fact that I was only able to process one sector at a time.

more later.

/s/ Terry
0
 

Author Comment

by:TerryMcCutchen
ID: 10639622
Sorry about that:

It turns out that the original problem was caused by the Master/Slave jumpers on the drive. This is the other reason that I am only now writing this resolution note. The drives in question are IBM (really Hitachi) 20MB disks vintage 1999/2000. When I first started using ghost to copy the drives I had to change both to "masters" since that was the only way I could get the IDE controllers to see them. Even then I needed to use the disk setup utility from IBM to make the bad one come on-line.

For the disk that had failed, I needed to disable the on-board cache and SMART. Once I had done that I was able (usually) to get them both to come on-line. Any reset would; however, make the bad one disappear until I re-did the utility (DFT) to re-select based on serial number (using the diagnostic/uint specific alternate selection method). The trick was to bfing up DFT under PC/DOS select the drive then "RUN" Ghost from PC/DOS. I was finally able to make this kluge work for the 55+ days that it took to make the image/forensic copy of the bad drive.

After I had made the copy (and went through the IDE specifications) I then took a look at what HAD to be happening since the symptom (DFT to select the drive, BIOS can't normally see it) seemed impossable. I finally reached the conclusion that the master/slave jumpers could not be functioning properly. A little work looking at the "Unit Selected" signal on the circuit board with a logic tester showed a "flicker" on the led (I wish now I had used a scope) when the BIOS tried to do the select which was not present when DFT did it. (The LED came on hard) I then took a close look at the physical jumper and noticed that it didn't have the normal "closed staple" look. Rather it had one nice loop and only part of the other loop. (normally jumpers look sort of  like (__) this one looked like (__| ... {sorry best I can do in this editor} I stole a jumper from a newer drive, pluged it in and the whole problem went away.

What I think was happening to cause the failure was that the jumper was flakey for some time causing the drive to at random go off-line and come back on-line.

I don't know (yet) what caused the cache and S.M.A.R.T. functions on the board to die but there was at least one power failure about six months before I got my UPS systems up. Why this could have taken so long to manafest itself is still a mystery.

I have since gone through my collection of drives (14 active) and jumpers (many) and found three OTHER occurrences of this flakey jumper problem. Fortunately only one of the jumpers was in an active drive, the others were in my "Random Parts" box.

Three lessons from this:

1 - Raid is definitely the way to go, no matter how good the backup scheme. (I plan on a 240 GB Raid-5 structure made up of 5 60GB drives as soon as I can get the Promise RAID controller)
2 - I need some form of cheap and simple way to get noitified when the disks start getting problems. (Yep I check the event logs around once per month already but that clearly didn't work here)
3 - Check the physical jumpers on any new drive and periodically check those of active drives (I'll probably do this once every four months since that seems to also be the frequency with which I tear the boxes appart for filter and fan replacement)

Hope this helps someone.

/s/ Terry
0
 
LVL 2

Expert Comment

by:Bigjohn-s
ID: 10640316
A good raid controller and raid5 array is definately the way to go.  Hot Swap is best, but if the controller supports rebuilding the array in background while live thats cool too.  If it does not, look at a down day while you're recovering the array.

John
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Join & Write a Comment

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This article explains how to prepare an HTML email signature template file containing dynamic placeholders for users' Azure AD data. Furthermore, it explains how to use this file to remotely set up a department-wide email signature policy in Office …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now