A drive that SMART calls PASSED can already be losing your data. The overall
self-assessment is a manufacturer threshold, not a statement about your files — and it stays
green well past the point where sectors have started going unreadable.
Here is the case that matters, from a real report:
SMART overall verdict : PASSED
Reallocated_Sector_Ct = 24 sectors already remapped
Current_Pending_Sector = 8 sectors unreadable RIGHT NOW
That drive passes. It is also actively failing.
The five attributes worth reading
Forget the table of forty values. Five of them describe the two families that precede
unreadable data — reallocation and pending sectors:
| ID | attribute | meaning |
|---|---|---|
| 5 | Reallocated_Sector_Ct |
sectors already remapped |
| 197 | Current_Pending_Sector |
unreadable now, waiting to be remapped |
| 198 | Offline_Uncorrectable |
the drive could not read them offline |
| 187 | Reported_Uncorrect |
errors it could not correct |
| 188 | Command_Timeout |
commands that timed out |
A non-zero 197 on a drive reporting PASSED is the exact situation to act on.
Read it in one command
smartctl -a -j /dev/sda | python3 smart_triage.py
The script is MIT, has no dependencies and no network access — it reads stdin and prints a
verdict, with exit codes 0 healthy, 1 monitor, 2 back up now, 3 stop and image:
https://gitlab.com/ler.eric/smart-triage
The order of operations, which decides whether you keep the data
If the verdict is stop and image, the sequence is not negotiable:
- Stop using the drive. Every hour of use turns more pending sectors into lost ones.
-
Image the whole device to a file with
ddrescue— not a file copy, a block-level image. - Work on the copy. Never on the original.
The mistake that destroys recoverable data is running a filesystem repair tool first. fsck
and chkdsk write to the disk. Writing to a drive with pending sectors is how a
recoverable image becomes an unrecoverable one — and it is irreversible.
What SMART does not tell you
SMART predicts a meaningful share of failures, not all of them. Controller failures, firmware
faults and head crashes can arrive with every attribute still green. A clean report is a reason
to keep monitoring, never a reason to skip backups.
If you want the detail of what is realistically recoverable per failure mode — mechanical,
electronic, logical, firmware — this breakdown covers it:
https://www.save-my-disk.com/en/blog/hard-drive-failure
