Storage failures: reading the warning signs and getting the files off

Why this matters

Every other fault in this domain costs time. This one costs data, and data is the only thing in a computer that cannot be bought again.

That single fact reorders the troubleshooting method. Normally you diagnose, then fix. With a failing drive you copy first and diagnose afterwards, because every minute of operation may be the last one and every diagnostic pass is more wear on a mechanism that is already failing.

The exam asks about symptoms, about the self-monitoring data, and about the correct order of actions. The order is the part people get wrong, and getting it wrong is how a recoverable situation becomes an unrecoverable one.

The lesson

Symptoms that point at a drive rather than at the operating system

Storage faults masquerade as software faults, and the giveaway is usually timing and repeatability.

Pointing at the drive:

• Noises. Clicking, grinding, or repeated spin-up attempts. Mechanical drives only, and conclusive.
• Long freezes. The machine stops for ten to thirty seconds and resumes. That is the drive retrying a bad sector, and the retry timeout is why the pause is so characteristically long.
• Files that fail to open, differently each time, or archives that fail their integrity check.
• The operating system repeatedly repairing the file system at startup.
• Errors naming the disk in the event log — controller resets, bad blocks, timeouts.
• A machine that is fine after a fresh installation and degrades again within days.
• Boot failures reporting no operating system or an inaccessible boot device, on a machine that has not been reconfigured.

Pointing elsewhere: crashes at random points with different error messages each time suggests memory (lesson 19); failures that correlate with load suggest power or heat (lesson 36); a fault that arrived with a specific update is software.

Solid-state drives give much less warning. They do not make noise, and they tend to fail suddenly — sometimes by becoming read-only, sometimes by disappearing from the system entirely between one boot and the next. The absence of warning signs on an SSD is not reassurance.

Self-monitoring data: which values matter, and what a passing result does not mean

Drives maintain SMART data: counters and thresholds the drive keeps about its own health, readable with any of several free tools.

The attributes worth understanding on a mechanical drive:

• Reallocated sector count. Sectors found bad and replaced from a spare pool. Any non-zero value is a signal, and a rising one is a failing drive. The rate of change matters more than the number.
• Current pending sector count. Sectors that failed to read and are awaiting reallocation. These are the ones that correspond to files you cannot open.
• Uncorrectable sector count. Sectors that could not be recovered — data that is already lost.
• Spin retry count, and power-on hours for context.

On a solid-state drive the relevant figures are different: percentage used or remaining life, total bytes written against the endurance rating, and available reserved space.

The critical caveat, and it is the same shape as lesson 17's point about cable testers: a SMART "pass" does not mean the drive is healthy. The overall assessment is a manufacturer threshold test, and drives fail without ever crossing it. Read the individual attributes rather than the summary verdict, and treat a rising reallocation count as a failing drive whatever the summary says.

The other direction is reliable: a SMART failure means replace it now, and copy the data first.

Getting data off a failing drive first, and why every other step waits

The order, and it is not negotiable:

1. Stop using the drive. Power the machine down. Every additional read or write risks the remaining data, and an operating system running from the drive is writing constantly.
2. Copy the data off before anything else. Attach it as a secondary drive in another machine, or boot from removable media, and copy to somewhere else.
3. Copy in priority order. Most important data first, because you may not get all of it. Documents and photographs before applications; irreplaceable before re-downloadable.
4. Use a copy tool that skips errors and continues rather than one that halts on the first failure. A tool that logs which files failed gives you a list of what is missing.
5. Only then run diagnostics, attempt repairs, or replace the drive.

Why every other step waits: a file-system repair writes to a failing drive; a surface scan reads every sector on a mechanism that may not survive the pass; and defragmenting is the worst thing available — hours of heavy mechanical activity on a dying drive, moving data that was readable into places it may not be readable from.

When to stop and escalate. A drive that is clicking, grinding, or not spinning has a mechanical failure, and continued attempts cause physical damage to the platters. That is a professional recovery job, it is expensive, and it is the only route to the data. Powering it up repeatedly to try again is the thing that turns an expensive recovery into an impossible one.

And the point to make to the user, once: this was preventable with a backup, and the conversation about backups is best had while the pain is fresh.

Solid-state failure, which arrives with less warning than mechanical failure

Solid-state drives fail differently and the differences change what you can do.

• Sudden disappearance. The drive is not detected at all. Sometimes a power cycle brings it back briefly — and that brief window is the only chance to copy, so it should be used for copying rather than for investigating.
• Read-only mode. Some drives switch to read-only when they detect a problem, which is deliberately protective. Copy everything immediately; this state is not reversible in any useful way.
• Controller failure, where the flash is intact and unreachable. Recovery requires specialist equipment.
• Firmware defects, which have caused known failures at specific power-on hour counts on some models. Checking the manufacturer's firmware updates is genuinely worth doing on a fleet.
• Wear, which is predictable from the endurance figures and is rare in ordinary use.

Because the warning is so much shorter, the SMART lifetime figures matter more: they are a forecast rather than a symptom, and acting on a drive at ninety per cent of its rated life is far easier than acting after it stops.

One more practical note: do not defragment a solid-state drive and do not run a full surface test on one routinely. Neither helps, both consume write endurance, and the operating system's TRIM handling from lesson 20 already does the maintenance that matters.

RAID arrays in trouble: degraded, rebuilding, and the state you do not write to

Lesson 21 covered the levels. This is what a technician does when one is in trouble.

• Degraded means a member has failed and the array is still serving data with no remaining tolerance. It is an emergency, not a maintenance item. Verify the backup, then replace the failed member.
• Rebuilding means the replacement is being reconstructed. The array is under its heaviest sustained load, the surviving members are the same age as the one that died, and this is the window where a second failure ends the array. Avoid additional load until it completes.
• Failed means more members have been lost than the level tolerates. Stop. Do not initialise, do not recreate the array, do not accept a controller's offer to rebuild in the wrong order — those actions overwrite the metadata that a recovery would use, and they are how a recoverable array becomes an unrecoverable one.

Practical points that matter in the moment:

• Identify the correct physical drive before pulling anything. Removing the wrong member from a degraded array destroys it instantly, and drive bay numbering does not always match the controller's numbering. Use the controller's locate function or the drive's serial number.
• Check the other members' SMART data at the same time. Same batch, same hours, same conditions.
• Read the controller's logs, which usually record why the member was dropped — and a member dropped for a cabling or timeout reason may not be faulty at all.

The recurring lesson: an array protects against a disk failing, and nothing else. When the array itself is in trouble, the backup is what you have.