Data Recovery Case File · Portable Drives · Stop the Scan
Forty-Eight Hours of Scanning
His enquiry described a reasonable panic and its consequence. A 2TB external drive holding "millions of documents — for the most part a vast library of PDF and Word files, labelled 'author - title'. Three days ago my computer was unable to find this drive, although it showed up in Device Manager. I panicked, downloaded a copy of recovery software and set it running. 48 hours later it has scanned some 20% of the disk." Everything about that is understandable and the last sentence is the alarming one — not because the software is bad, but because the scan rate is itself a diagnosis. A healthy 2TB drive is read end to end in a few hours. Two days to cover a fifth of it means the drive is failing reads continuously, and it has been made to do so, without pause, for two days.
| Media | 2TB external hard drive holding a large personal document library — enumerated by Device Manager without presenting a volume; consumer recovery software running continuously for approximately 48 hours |
| Reported situation | Drive no longer accessible while still enumerating at device level · recovery software commenced immediately and left running · approximately 20% of the surface scanned in two days · substantial reference library held |
| Fault class | Widespread read failure with severe retry behaviour — surface degradation indicated by scan rate; continued scanning compounding exposure |
| Equipment used | Scanning halted · Atola Insight Forensic surface and error-rate assessment · PC-3000 Express with Data Extractor imaging under per-sector timeouts · healthy regions banked first, weak neighbourhoods deferred · library structure preserved in delivery |
The decode: what the rate means, and what two days cost
Why 20% in 48 hours is the finding: reading a 2TB drive sequentially at healthy speed takes somewhere around four to six hours. His scan has managed a fifth of that in two days — roughly twenty times slower than it should be. There is only one mechanism that produces that: the drive is failing reads and retrying internally, taking seconds per sector where it should take milliseconds. So before anyone opens anything, the scan rate has already established that this is a surface-level problem rather than a filesystem one, and a widespread one rather than a bounded one.
What the software has been doing to it: consumer recovery tools have no facility to give up on a sector and return to it later. They ask, wait for the drive's internal retries to exhaust, and ask again. Applied to a drive with widespread read failures, that means two days of continuous hammering concentrated on precisely the regions least able to take it — with the heads repeatedly reseeking across weak areas, generating heat, and in the worst cases converting marginal sectors into permanently unreadable ones. The software is not at fault; it is being used on a drive it was never designed for.
Why panicking and scanning is so common: worth saying without reproach, because the instinct is universal. A drive stops working, the loss feels immediate, and running software feels like doing something while waiting feels like doing nothing. In practice the opposite is true: on a physically failing drive, the most valuable action available is to stop, because every hour of running spends margin that cannot be replaced.
What should happen instead: imaging under per-sector timeouts — the same intention as his scan, done properly. Each failing sector gets a strict budget and is deferred rather than retried indefinitely; the healthy expanse is captured first at full speed while the drive is at its strongest; and the difficult ground is revisited afterwards on later passes. On a drive this degraded, that ordering is the difference between capturing most of the library and stalling at 20% forever.
Why his library needs structure preserved: documents named author – title are a reference collection where the naming is the catalogue. A carve that returns a million files called file000001.pdf would technically be a recovery and practically be useless. So filesystem reconstruction is attempted thoroughly before any carving, because the folder tree and filenames are most of the value.
On the bench
The scan was stopped, which was the single most valuable action available. The Atola Insight Forensic assessed surface condition and error rates directly, establishing how widespread the degradation was and how much margin remained — the measurement his scan rate had already hinted at. Imaging then ran on the PC-3000 Express under Data Extractor with per-sector timeouts enforced: healthy ground banked first at full speed, weak neighbourhoods deferred to later patient passes rather than retried indefinitely. Filesystem reconstruction was attempted thoroughly before any carving, so the library returned with its filenames intact.
The outcome
The scan halted, the surface measured and the library imaged under timeout control with its structure preserved. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone running recovery software on a failing drive: the scan rate is a diagnosis — a healthy 2TB drive reads end to end in hours, so a fifth of it in two days means reads are failing continuously; consumer tools cannot defer a bad sector, so they retry until the drive gives up and then ask again, concentrating days of load on the weakest regions; running software feels like doing something and stopping is worth more. Preserve the filenames if the naming is your catalogue.
Recovery software that has been scanning for days
Stop it. If a scan has covered only a fraction of a drive in a day or two, that slowness is telling you something important: a healthy drive of that size reads end to end in a few hours, so a rate twenty times slower means it's failing reads and retrying constantly. Consumer recovery tools have no way to give up on a bad sector and come back later — they wait for the drive's internal retries, then ask again — so what's actually happening is continuous hammering of exactly the areas least able to take it, for as long as you leave it running. Nobody should feel foolish for starting it; running software feels like doing something. But on a physically failing drive, stopping is worth more than any tool. And if your filenames are your catalogue, say so, because a carve that returns everything unnamed isn't a recovery.
Stop it now — call Newcastle Data Recovery on 0191 406 1051; surface measured, imaged healthy-regions-first under per-sector timeouts, filenames and folders preserved.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.