Not enough space

[Seaitch]

HI, Help please,
Newbie & ancient duffer trying to recover files from 500gb hd, with apparently 465gb used. with, according to chkdsk a bad "uppercase file table". I created a 520gb partition for the image but when I try to create image, I get "not enough space left". How much space do I need for a 465 gig (bit less cos I'm only trying to image partition with the files in it) partition? Is this a *****ing Windows10 thing or is there a valid reason?
Many Thanks

[cgrenier]

The destination filesystem must not be FAT32 as usually it's not possible to create file larger than 4 GB.
Creating an image of a corrupted filesystem is useless to repair this filesystem corruption.
If you want to recover your data, try "chkdsk /f" and if it failed, use PhotoRec (unfortunaltely it will not recover the original filenames).

[Seaitch]

Hi,
Many thanks for quick reply, I was aware of limitations of FAT32, partition was formatted NTFS, to match the dying disk. I thought it might have something to do with block size, but fsinfo shows 512 bytes/sector and 4096 bytes/physical sector which looks right. Is it essential to write the partition table to disk before imaging? I'm reluctant to do any writes given its parlous state. Incidentally, W10 wouldn't let me shrink the original single partition to make space for image, said "not enough space"! Hence my wondering if W10 was the problem. I made the partition using PartedMagic, with which I am next going to attempt to image the partition. I hate W10!
Thaks again

[BitterColdSoul]

Creating an image of a corrupted filesystem is useless to repair this filesystem corruption.

It's certainly NOT useless to have a BACKUP.

If you want to recover your data, try "chkdsk /f" and if it failed, use PhotoRec (unfortunaltely it will not recover the original filenames).

When faced with a potentially severe corruption like this, it is especially recommended to create a backup clone before running the potentially dreadful CHKDSK -- which can fix minor issue and majorly screw up the bigger ones.

Many thanks for quick reply, I was aware of limitations of FAT32, partition was formatted NTFS, to match the dying disk.

If it is “dying”, as in physically dying, creating an image is paramount. The best free tools to do this are ddrescue and HDDSuperClone, which are specifically designed to quickly skip bad areas in their first passes, so as to recover good areas as fast as possible before the drive's status gets worse ; ddrescue has a -S switch which allows to write the image in “sparse” mode, meaning that it won't allocate empty clusters, which can greatly reduce the actual size of the image (not so much in this case if 465GB were used but it's good to know). You could create the image from a live Linux system (running from a USB drive or a memory card -- much faster than a CD/DVD). Be very careful when selecting the source device and the destination device -- a mere switch of two letters can lead to a disaster.
As for the “not enough space left” error message, no clue. It could be related to write access / user account control and that sort of things which do cause more nerve damage on a global scale than they actually enhance security. Is UAC activated, and is PartedMagic running with Administrator privileges ? Can you write a smaller file to that partition, with Parted Magic or anything else ? Maybe search the WWW with “partedmagic” + the exact error message you got, in quotes, would bring some useful hits / hints.

[Seaitch]

Thanks for the input BCS, yup I did my best to make sure permissions etc were Ok, and copied test files to the prepared destination. I’ve fired up PMagic, tried ddrescue but aborted it after five or six hours of it scanning so didn’t get past the start line. TestDisk/PhotoRec has been the only thing to make sense of this disk. Looking promising now, TD started imaging the partition at 2135, so despair is now turning to hope, no silly messages about “not enough space” (yet)!
Looks like W10 was the culprit, did I mention I hate W10?
Thanks

[BitterColdSoul]

So ddrescue could copy nothing at all ? Or it did copy something ? Are you sure that the settings were correct ? Was there a specific error message ? It would be very strange that ddrescue failed where TestDisk succeeds, as it's designed to deal with physically damaged drives as optimally as possible with software only tools, while TestDisk is more geared toward logical issues on otherwise healthy drives.
You can also try HDDSuperClone, which is supposedly more sophisticated and comes with a GUI.
What about the SMART status of the drive ? Does it have reallocated or pending sectors ? How many ? Or other issues ?

[Seaitch]

Perhaps I was too impatient, but I ran ddrescue, it started its initial scan and 5 hours later it was still scanning, and I aborted it. I haven’t tried anything specifically to read SMART, but Disc Health on PM and other things say it’s not available. I don’t think there is physical damage, not making noises or anything, as I say a chkdsk scan reported a bad uppercase file table, which is apparently necessary to the file structure.
My strategy is to image the partition, rescue whatever files I can, then let chkdsk (or something better) do it’s worst. Thanks for heads up on HDDSuperClone, haven’t heard of that.
It’s now 0700 here, TD is still at it, I hope. Any idea how long it will take & how do I know it hasn’t stalled ( said I was impatient!) ?
BTW, I was wrong in my first post about the disk usage, in my ignorance I thought 500/465 referred to size/used, didn’t realise there was a difference twixt Gb and GiB!

[Seaitch]

Thought it was too good to be true, TestDisk been working on this image for 22 hours now and is only at 0.17%. Obviously impractical, would take over 500 days at this rate! Opinions as to course of action would be appreciated.
Thanks

[BitterColdSoul]

Perhaps I was too impatient, but I ran ddrescue, it started its initial scan and 5 hours later it was still scanning, and I aborted it.

The question is, was it copying something, even at a slow rate ? If it was, you should have let it go on as far as possible. With a failing drive, every time you try something you've got to be aware that it gets about as good as it can get (if it's being done right of course) and it can only get worse with each new attempt. The first time I did a ddrescue recovery of a seriously failing drive, I thought that the initial copy rate was very slow at around 5MB/s on average, so I stopped and tried something else, but not much later it went down to about about 500KB/s at best, and I regretted the time when it was still copying at the blazing fast rate of 5MB/s...
If it wasn't copying anything, of course, it was wise to stop. But then in a situation like this one needs to act with no haste or panic, and calmly assess the current state of things in order to figure out the next move, rather than trying anything and everything with the fingers crossed. If ddrescue doesn't get any data from a drive, either there's something wrong with the environment or the settings, or the drive is already in a very bad condition. To verify the first hypothesis, obviously you could run a few tests with a known working drive as input, and see how it goes.

I haven’t tried anything specifically to read SMART, but Disc Health on PM and other things say it’s not available. I don’t think there is physical damage, not making noises or anything, as I say a chkdsk scan reported a bad uppercase file table, which is apparently necessary to the file structure.

It could very well mean that you have a bad sector, or more than a few, where that filesystem structure used to be located, and therefore it would be a physical issue manifesting itself as a logical one. And CHKDSK should never be used on a drive with even minor physical issues, so it's paramount to get a SMART assessment first.
A drive can have many bad sectors without making any abnormal noises. When there are abnormal noises it's usually too far gone to do anything “DIY” (although some drives working well are clicking like crazy once in a while, I have one like that, a Seagate from around 2010, I'm quite wary of plugging it for that reason, although its SMART status was still pristine last time I checked).
How is the drive connected ? If it's through a USB dock / enclosure, connect it directly to the motherboard instead. (If you don't have a desktop computer, find one.)

Thought it was too good to be true, TestDisk been working on this image for 22 hours now and is only at 0.17%. Obviously impractical, would take over 500 days at this rate! Opinions as to course of action would be appreciated.

You could ask about it on forum.hddguru.com to get further input from DR experts. But they might tell you that at this point the best course of action is to let a pro deal with it...

[Seaitch]

Aye, drive definitely is deteriorating, TD has been picking up all three partitions with a quick search, but last time needed a deep search to find the third. You’re dead right, it’s time to call in the pros, I’ve been quoted £290 on a no recovery-no fee basis (+media to put it on if I can’t provide my own), which seems pretty reasonable? Will consult with the drive’s owner (my daughter) and take it from there.
Thanks again for all your help