When a read to a disk returns an error for a sector previously identified as good, the read is retried a predetermined number of times to attempt to recover the sector data. If the sector is unrecoverable, the failed sector is relocated and an "unusable" bit associated with the replacement sector is set to indicate that the data is bad. The unusable bit indicates that the replacement sector is good, but the data contained within the replacement sector is bad. A read error is generated for subsequent reads to the replacement sector as long as the unusable bit remains set. The unusable bit is cleared after a write to or reformat of the replacement sector. The replacement sector thereafter becomes a fully functional substitute for the failed sector, containing good data. The validity of data within the replacement sector is identified at all times, allowing use of bad data to be avoided.