Technotes

Essential Steps For Do-It-Yourself Data Recovery

There is a standard set of procedures most, if not all, professional data recovery service companies use to recover data from damaged or corrupt storage media. These processes are used to minimize the risk of further damaging a client's media. If you intend to attempt data recovery on your own, it is recommend that you adopt these same procedures to minimize the damage to your media and optimize the possibility that a professional service may be able to help, should you determine that you need to exercise that option.

WD PCB's

Western Digital (WD) uses a combination of model/part number and a DCM number on the drive cover as well as a part number on the PCB.

Hard Drive Repair - PCB

Attempts to repair mechanical failures by anyone other than a qualified data recovery shop or the manufacturer, will void the warranty.

Swap at your own risk!

There is a certain amount of agreement, between several of the data recovery service companies, that replacing the PCB, on newer hard disk drives, is a bad idea. In fact, swapping the PCB may actually damage the drive further. They make a good case, have cited examples, and some have gone to great lengths to document their information.

Selecting A Data Recovery Service Company

Selecting a data recovery service company is perhaps one of the most stressful things a person or company can endure when all other restoration options have been attempted. It's the nature of business to highlight the positives and down-play the negatives particularly in a service oriented business. Virtually no one wants to say... "We can't do this or we can't do that." Virtually all will tell you how wonderful and better they are than the "other guy". This makes selection difficult to say the least. Here are some things to consider when selecting a data recovery service company...

Hard Drive Platter Removal

Fiction:
The belief that media can be removed from a multiple platter drive and data can be
successfully recovered using a Universal Media Reader.

Partition Repair & Recovery

All file systems use the first sector of a hard drive as a partition block. This sector contains the total number of sectors in the drive (a.k.a. Disk Capacity), size of the primary partition, defines the file system on the primary partition, the location of the next partition and the location of the boot block. The partition combined with the boot block is also referred to as the Master Boot Record or Boot Strap. In a Hex Viewer or Editor using Absolute Sector mode this will be sector 1(one). In LBA mode it is sector 0(zero).

A partition is one sector or 512 bytes in length and defines the size of the partition and indicates the beginning sector of the boot block(s). All partitions have a signature located in the last 2 bytes of the sector which is 55AA (hex, of course). The use of "overlay" programs such as Disk Manager in some cases installs additional sectors, which will need to be considered, that changes the location of partitions and boot sectors. If you've used one of these programs, you're pretty much on your own to figure-out how to fix or replace a partition. Of course, you could send your media to a data recovery service company. If your data is mission-critical, that would not be a bad idea. If you're hardcore, poor or just plain stubborn you can try the following;

Repair - File Allocation Table (FAT Repair)

The FAT file system uses 2 File Allocation Tables (FATs or FAT Tables). The two FAT tables are supposed to remain synchronized. There are occassions when they aren't. This causes problems. Both FATs are located between the boot block(s) and the root directory structure.

Roughly; the FATs keep track of the first cluster a file is assigned to. If the file size exceeds one cluster there is a marker at the end of the first cluster that indicates the location of the next cluster that is used by the file and so on, and so on. In this way the operating system keeps track of all the files on a hard drive. If one of the sequential markers is lost then part of the file is lost. If the FATs are damaged then the operating system can't even begin to locate files. Additionally, certain corruption occurs when two markers point to the same cluster. Like ice-cubes in a tray, there can be only one ice-cube in each division and there can never be two ice-cubes in a single division. Using a hex editor one can locate a FAT by it's signature. The first few bytes of the beginning sector of a FAT begins with F8FF (hex, of course).

Hard Drive Diagnosis

Diagnosing a failed hard drive is fairly straight forward and an important step to resurrecting data. Determining if the device has a physical or logical failure will help guide you to the next step. Making the determination between the two can be tough, the symptoms are often the same.

If the hard drive is not recognized by the BIOS or controller, the drive has failed and needs to be repaired. If replacing the electronics doesn't change the symptom, then professional help is advised.

Hard Drive Stiction And Data Recovery

Defined: Stiction is a term used in the hard drive and data recovery service industry that defines a specific failure condition of a hard disk drive. The condition refers to the head bearing making contact with the magnetic media and becoming stuck to the surface. Three things go wrong in the stiction scenario. 1) The head arm assembly does not park the heads properly. 2) The spindle motor spins down before the heads are moved to the park position. 3) The heads stick to the media and prevent the spindle motor from starting. The end result is called stiction. Not all hard drives are prone to stiction. The continued application of power applied to a drive that has stiction can result in additional damage.