Certain types of media damage mandates using a professional service. Physical damage caused by fire or water should never be attempted by a non-professional. The reason is obvious, simply powering-up the media will increase the damage to the media. Other symptoms, such as a clicking hard drive, can lead to additional damage if power is applied to the drive. While that is not always the case, unless you're trained to recognize the potential for additional damage based on experience and proper diagnostics, always default to the safest bet for data recovery - use a professional data recovery service.

In the real-world it's not always practical or economically feasible to use a professional data recovery service. Perhaps the data is not worth the $400 to $2000 that is commonly charged. Maybe it is worth the money, but you don't have that kind of cash available. So, you determine you're first line of action is to attempt recovery on your own. Whatever the case, if you're going to do-it-yourself, adopting these processes can help.

Disclaimer: This is not intended as a comprehensive instruction for data recovery. The following processes are generally used to recover data from a hard disk drive.

Preliminary Diagnostics
You can see that a chip is blown on the board (PCB) of your drive. There are many internet resources and guides suggesting methods of replacement and repair. What you don't know is whether or not that blown chip caused additional damage to the internal electronics or the head assembly. Possibly worse, if the power surge sent a write pulse to the heads and overwrote sensitive data on the internal media. If you proceed to do board level repair on your own, you can cause additional damage to the drive. This is where experienced data recovery technicians earn their money. Consider the value of your data and determine if this step is really worth the risk.

Let's say you followed the internet instructions for PCB repair. It's not uncommon for a failed drive to provide "one last shot" at recovery, even after a repair. You should still follow the processes below before powering-up the drive.

DO NOT OPEN THE DRIVE - Please don't open the hermetically sealed portion of your hard drive. At the very least it will void any warranty you have. At the most, it can render the data permanently unrecoverable. There is some really bad advice that can be found on the internet with respect to this. It's not very likely you have a real clean room. While your bathroom may be "clean" and you may be able to temporarily remove particles from the air, the odds are you don't have finger cots, powder-free gloves, protective clothing, proper air-flow, proper filtration, and the necessary equipment to do the work. Again, this is where data recovery professionals earn their money.

Setup
The first thing to do is stop using the subject drive. Reducing the number of times power is cycled and the read/write heads are engaged is the goal. Continued use of the drive can cause data to be overwritten or additional physical damage. This fact is well documented. If you don't understand or believe that statement, do your research. I'll refer to this drive, presumably failed or in need of undeleting files, as the "subject drive".

If the subject drive is the boot drive, prepare a replacement bootable drive or use a second system. Using the same operating system to recover your data may or may not be advisable, although usually a good idea. You'll need this to install, store and run utility programs. This drive should also be large enough to store the recovered data. I'll refer to this as the "boot drive". Make sure you have enough connections to accommodate all of these drives and any additional storage devices (i.e. CD's or DVD's).

Prepare yet another hard drive. This drive should be the same size or slightly larger than the subject drive. I don't mean physically larger, I mean in terms of logical blocks (LBA's). Different makes and models of hard drives vary in terms of the number of LBA's. While you may have two 100GB drives, one may actually be smaller than the other. It's generally a good idea to use a drive with the same interface, (IDE to IDE, SATA to SATA, etc.). We're going to image or clone our subject drive to this one so we'll call it the "image drive".

Before you begin the next step, wipe the image drive or write zeros to each and every sector. When you run undelete or other extraction software on the image drive you don't want to be recovering any "bogus" data. Writing zeros to the image drive will insure it is clean and has no partitions or old data.

Imaging / Cloning
A good professional data recovery service will have proprietary software and/or proprietary hardware to image one drive to another. They can copy in either direction, record bad sectors for later reference, skip areas and much more. Commercial imaging software varies in quality and capabilities. Many use interrupt (int13) to access disk drives. Others use the computer BIOS to access the drives. Using the computer BIOS is generally faster, but int13 access is more reliable. The objective is to clone each sector from the subject drive to the image drive. I've used many brands of commercial software for imaging. The most reliable I've found are DiskPatch by DIY Data Recovery and Media Tools by ProSoft Engineering. Both have the ability to wipe a drive. Both have also been confirmed to provide an exact image without error.

Whichever software you choose to use, test it and practice with it. Clone your boot drive to the image drive a few times to become familiar with the software and how it works before you try to execute this process on the subject drive. I also suggest setting the number of retries to 1 or 0 during the image process. In the event the subject drive has physical errors, minimizing the number of retries will speed-up the process. Be aware that if the subject drive does have physical damage this process can make it worse. You will be asking the subject drive to read each sector sequentially. Even any physically damaged areas.

You really don't want the subject drive to run any longer than necessary at this stage. Image the subject drive as quickly as possible. Towards that end, using imaging software that requires a lengthy boot process is not advised. Booting to Windows or any other OS that uses a GUI is not a good idea. The aforementioned tools boot from a DOS floppy disk fairly quickly with minimal drive interaction.

Data Extraction
If you've followed the steps above, you're now ready to recover data. Data extraction software is where the real recovery happens. Ideally the software you chose will be able to rebuild file system data structures in memory and not write the "fixes" directly to the drive. This will have the advantage of not corrupting the image drive with "repairs" that don't work or make your situation worse. If the software you've chosen writes "repairs" directly to the drive, at the very least it should offer the option of creating an "Undo" file. If that is the case, don't skip the option of creating the "Undo" file. Rebuilding file system data structures and "Undo" files are safety features that should not be ignored. In the event you are not happy with the results you get with one data extraction package, you may want to try another. Having the image drive in the original "failed" condition when you try a second software package is optimal. Recommended software includes R-Studio or GetDataBack for Windows PC's and Data Rescue for MAC PC's.

At this stage you can connect the image drive as a secondary disk in your computer. Use the boot drive you created above to start the system and install the data extraction software you've chosen on the boot drive. Once installed, you'll be able to execute the extraction software against the image drive to recover your data. Remember to recover the data to the boot drive, not the image drive.

Test, Test, Test
Now that the data has been extracted, confirming that it works is a good idea. Try opening your most important data (i.e., images, documents, spreadsheets, etc.) to make sure it's not corrupt. Reinstalling the applications may be required or taking the recovered data to a machine with the appropriate applications already installed is an option. Just be sure the files that are most important to you really work before you pronounce the process successful. It's not uncommon to recover proper file names and directory structure only to find the files won't open due to corruption.

Conclusion
The steps above will maximize the possibility of recovering the most data from a failed hard drive and minimize additional damage to a physically failed hard drive. Data recovery professionals follow these essential processes with the same intent. If you decide to do-it-yourself, you should too.

• Add New
• Search
• RSS

Comments (0)

Write comment

Your Contact Details:

Name:

Email: do not notifynotify Gravatar enabled

Website:

Comment:

Title:

UBBCode:         -color-aquablackbluefuchsiagraygreenlimemaroonnavyolivepurpleredsilvertealwhiteyellow -size-tinysmallmediumlargehuge

Message:

Security

Please input the anti-spam code that you can read in the image.