Data Recovery Cases
← Back to Bad Advice
Bad AdviceUpdated · Data Recovery Cases Editorial Team

Why scanning a failing drive with every tool is risky

The first recovery program finds nothing useful. A forum recommends a second, then a third, followed by a deeper scan and an overnight retry.

Trying another tool can be sensible. Repeatedly scanning the original without checking its condition is the problem.

Different tools can produce different results

Recovery programs differ in file-system support, interpretation of damaged metadata, RAID handling and file carving. One program may reconstruct a directory tree that another misses. A second opinion is useful when the source is preserved and the comparison answers a specific question.

However, a program cannot compensate for unreadable storage simply by scanning for longer. Nor can changing software reverse genuine overwrite or retrieve old SSD content that the controller no longer exposes through logical reads.

Separate source access from file interpretation

There are two distinct questions: can the device return the requested data, and can the software interpret that data correctly?

If reads succeed but one program does not support the file system or storage layout, another program may help. If reads fail because the drive cannot supply sectors reliably, switching file parsers leaves the access problem unresolved. If the wrong layer is being scanned, even a healthy image may look like random or meaningless content.

An encrypted volume, for instance, needs the correct decryption context before ordinary file-system analysis can work. A member of a striped array normally needs the array reconstructed before the contained file system becomes coherent. A longer signature scan is not a substitute for either step.

Read the result, not the advertised scan depth

“Deep scan” does not describe one standardized method. It may mean a broad search for file-system structures, signature-based carving, or a combination. The label alone tells you little about suitability.

Suppose one scan finds a convincing folder tree but a large video will not play. Another finds thousands of numbered video candidates. The second result is not automatically better. A carved candidate may have a recognizable header while lacking later fragments. Conversely, an original name can survive even when the content has been overwritten.

Compare actual output: representative large files, fragmented files, archives, documents and files from different folders. A thumbnail or a few seconds of playback is only a partial check. Count useful, validated results rather than counting every detected signature as a recovered file.

Why repeated scans can be the wrong experiment

A deep scan may read much of the address space. Running several programs directly against unstable media repeats that work. Timeouts, retries and reconnects may consume the remaining opportunity to obtain readable data without producing a reusable preservation copy.

Read-only access prevents intentional host writes; it does not stop mechanical activity, eliminate read stress or freeze a device's internal behavior. A read-only scanner is therefore not automatically suitable for a failing drive.

On a healthy, stable disk, reading is normal operation. There is no universal number of scans after which it suddenly becomes unsafe. The warning concerns observed instability and an unplanned workflow, not ordinary reads as such.

What to do instead

  1. Define the failure: deletion, formatting, missing partition, damaged file system, incorrect RAID reconstruction or unreadable hardware.
  2. Check whether the device stays available at the correct capacity and reads consistently. SMART information is one clue, not a certificate of health.
  3. Preserve readable data using a suitable acquisition method. For degraded media, staged imaging with a progress map is preferable to repeatedly starting a full scan; serious physical symptoms call for professional assessment.
  4. Scan the image and save scan results to separate healthy storage where supported.
  5. Choose the next tool because it supports a missing feature or a different reconstruction approach. Compare previews and actual extracted files.
  6. Keep notes about unreadable regions and incomplete acquisition. A clean scan result cannot fill gaps in the source image.

An imaging attempt also reads the source and may be inappropriate for a mechanically damaged drive. “Image first” is a preservation strategy, not an instruction to force every device through DIY imaging.

Why an acquisition map matters

A suitable imaging tool records which address ranges were copied and which remain unresolved. That allows later work to focus on gaps instead of rereading everything from the beginning. The map and the image serve different purposes: the image contains acquired bytes; the map describes acquisition progress and limitations.

A file with the expected image size is not necessarily a complete image. Depending on the acquisition method, unresolved regions can appear as holes, filler or other output states. Keep the tool's logs so those regions are not mistaken for confirmed source content. A checksum can identify that image and detect later changes; it does not prove that every original sector was read correctly.

Where a failing source cannot tolerate a complete pass, the acquisition order may need to prioritize valuable data or accessible regions. That decision requires more than selecting “scan all sectors.”

A practical test for the next attempt

Before running another program, write down the limitation it is supposed to address. Useful reasons include support for the actual file system, better handling of surviving metadata, a required RAID layout, or a complementary carving method for specific formats.

“The previous program found nothing” is an observation, not yet an explanation. Check whether it scanned the intended disk or image, whether the necessary partition or storage layer was available, and whether encryption was unlocked. Do not modify the source merely to make it appear in the next program's volume list.

Keep tool versions, selected parameters, scan logs and validation notes. If a result improves, those notes explain why. If access is deteriorating, stop changing parsers and reassess the source.

When another scan is reasonable

It is reasonable on a preserved image, or on stable media where the risks are understood. For example, compare structure-aware recovery with carving when metadata recovery is incomplete. Carving has its own limits, especially with fragmented files.

The principle

Preserve once where feasible, then investigate the copy. More programs are useful only when they test a plausible explanation.

Sources and further reading

← Back to Bad Advice