The first thing to mention is that there is tons of “imaging” software out there, but there is a HUGE difference between these and a data recovery imaging tool. Many of these software work great such as Acronis TrueImage, but as soon as you put a weak or failing hard drive into the mix; the software shows it’s flaws. This software is not designed with failing hard drives in mind; it is designed as a solution for easy duplication, and backup solution.

So lets get down to it. What makes a data recovery imaging tool different from all of that software? It is a combination of specialized hardware and highly advanced features that come together to place these tools into a completely different league then normal software imaging solutions.

Lets talk hardware:

So you may be wondering what kind of “special” hardware is needed to insure that a data recovery imaging tool is up to the job.

The first thing is that this hardware has to be able to support the full array of ATA commands, as well as any custom manufacturer commands that may be implemented. While a standard ATX Motherboard may be able to handle most of the ATA commands; there are many undocumented commands that are not “required” by the ATA standard that the manufactures use for their own purposes. These commands are completely different between each manufacturer as each manufacturer designs their firmware in a different fashion.

The Second is that when working with failing hard drives; you may run into drives that have circuit board issues that will cause a short in your system. A standard motherboard and/or PSU will see this and it’s circuit protection will trip; in this scenario you will likely not even be able to power up your system with the drive plugged in let alone run any kind of imaging operation, or at the very least run diagnostics on the drive.

Data recovery imaging equipment has specialized power regulation and monitoring systems that allow you to apply power to drives, and monitor the currents running through them. If there is a short on the circuit board this hardware won’t just shut down; instead it will likely notify you of the short and shut down the drive promptly to protect the drive from any further damage. At the same time the hardware is highly resistant to any damage from short circuits, etc so you do not have to worry about this hardware sustaining any damage from damaged PCB.

Write Protection is another hardware feature that is especially important for forensic examiners. Every device a forensic examiner plugs a drive in HAS to be write protected, even if the device shouldn’t be making any writes to the master drive it is a safety precaution that is required by forensic examiners; for this reason it is nearly standard on all data recovery imaging tools.

There are other hardware features that are good to have, but the main purpose of the customized hardware is to facilitate the features mentioned above. The real power lies in the software that ties into the hardware (in some cases the hardware may have firmware embedded into it that acts as the software, and makes the unit standalone)

What kind of software features set a data recovery imaging tool above your normal software imager?

Sector Timeouts: The ability to customize how long you wait for a sector to be read. This feature is useful because you may want to quickly avoid any problem areas; in this case you will set your timeout very low. If you want to really make sure that heads cannot read this sector, then you would set the timeout really high.

Sector Skipping: Skipping is a useful feature to attempt to navigate around problem areas. All good data recovery tools will have the ability to skip AT LEAST 1 sector. The most advanced tools should be fully customizable, and you will be able to change this skip parameter on the fly.

Retry: This feature can be great if used properly. Most normal software imaging tools have this set to 99, which is terrible. This means it will sit on 1 sector and try 99 times to read it. This is a huge waste of time, and can potentially cause even more damage to the drive. If you are trying to copy a weak or failing drive you want to get as much data, as quickly as possible because the drive is liable to fail at ANY time.

The best way to utilize a retry is “Multi pass imaging”

Multi pass imaging: Multi Pass Imaging is one of the most powerful features a data recovery imaging tool can have. Only the best of the best tools have this feature. The idea is that you can customize “passes” where each pass has different parameters. You would likely want to start with a quick pass; quickly skipping over bad areas and getting all of the easy to get sectors. Once the first pass is completed the imager starts over from the last sector is wasn’t able to read on the first pass. Here is the catch: The imager remembers all of the sectors is already copied. This way you are not wasting your time going over sectors you have already gotten, and you can try more in-depth settings on the sectors that are giving you trouble.

Reverse Imaging: Reverse imaging is useful in many cases. Some drive seem to copy more reliably when copied in reverse. This may be because reverse imaging often disables any drive caching, and also moves at a slower pace. Reverse imaging is also useful if you suspect there is media damage somewhere towards the front or middle of the disk; by imaging in reverse you attempt to avoid this damaged area in hopes that the heads will live a little longer while you try to extract the data from the drive.

Power Cycle: Sometimes a Drive may hang completely when faced with a certain error, or bad sector. In this case it is critical that you are able to cycle the drive, and be able to continue exactly where you left off.

Reset: A similar concept to power cycling, but this involves just resetting the drive without re powering it.

UDMA Speed adjustment: If a drive is unstable it may run better at a slower speed. Being able to change the max UDMA speed may help the drive run more reliably during the imaging operation; sacrificing speed.

PIO mode: PIO mode avoids UDMA transfer all together in favor of the older PIO mode. This mode only runs at ~2MB/s but is useful if you are working with a VERY unstable drive, or area of a drive.

Ignore ECC: All sectors have ECC (Error Correction Code). Sometimes a sector may be reported as UNC, even though there is some readable data within the sector (maybe 25% of the sector data is corrupt, but 75% is not. With this feature you ignore the error correction code telling you the sector is bad, and read what you can out of the sector anyways. This feature is useful off the basis of: SOMETHING is better then NOTHING.

Disable Read-ahead: This is another feature that was added to hard drives that is useful during normal operation, but when working with an unstable disk may cause more instability. Basically, when a you request a certain sector/s from a drive it will actually read ahead of what was requested and cache it, predicting that you will likely be requesting those sectors as well.

Data-Only Copy: This feature is self explanatory; if possible you want to try to image only the sectors with actual data on them. If your patient drive is a 1TB, the chances of it being 100% full are not very high. In most cases the drive is going to be no more then 50% full. When copying data in a recovery scenario, every single move you make counts, so wasting time imaging blank sectors does not make any sense. Data only copying requires that the tools knows what information it needs to retrieve to know where all of the data is; such as a FAT table, or MFT, etc. Usually only certain file systems are supported. The common ones that will be supported are NTFS, FAT, and HFS. Ext support is becoming more common as well.

Image by selective heads: This is the big one. Sometimes a drive may identify itself, and seem like it is working normally, but one or two of the heads are practically dead, or VERY weak. In this case you will likely need to perform a head transplant, but you would like to get all of the data you can off of the drive first. This is where this feature comes in. You can actually tell your imaging tool to image only data from a certain head. By doing this you can image the data from the heads that are working well, and then perform you head transplant and then image the data from the heads that you did not image before.

So, those are the most important features of a data recovery imaging tool. You will find that there are even more features that can be useful in certain situations, but the ones listed are the ones that you really want to have if you are going to be getting an imager for data recovery use.

Furthermore, the “repair” is not so much of a repair. You could consider this repair to be the equivalent of a tourniquet. The hard drive is like an arm that has been badly wounded and is bleeding profusely. The tourniquet is the “repair”, which temporarily relieves the underlying issue, but the fact is it’s only a temporary solution to a escalating problem. With hard drives, there is no hospital that can stop them from degrading; we can only hide the degradation temporarily.

So what is really going on when a drive is “repaired”? Reallocation.

A hard drive is constantly performing built-in maintenance routines and when the drive recognizes an unstable sector, the hard drive realizes this, marks the sector bad, then puts it in a reallocation queue.

What is this “reallocation”?
It’s a simple principle: the detected bad sector gets put into a list that says “do not use this sector anymore, because it can’t hold data reliably”. This list is known as the “G-list” or “Grown Defects List”.

Once the bad sector has been removed and put into the G-List, a new, reserved sector is used in its place. This reserved sector is “mapped” as the same LBA (Logical Block Address) as the old, dead sector, but it is in a different physical location on the disk.

This can cause issues once many sectors begin failing because the heads will have to change position to read the new sectors that are located in the reserved areas. This will cause delays in access times and will eventually be noticeable to the end user.

All hard drives contain these reserved sectors and the OS is unable to see or use them. Only the drive knows of their existence and their location on the disk.

There is even more to this story though, as there are two types of bad sectors. There are “physical bad sectors” and “logical bad sectors”.

A physical bad sector is a sector that for some reason can no longer to be magnetically manipulated and used to store data. These are the types of errors that will be mapped to the G-List.

A logical bad sector is a sector that is able to be magnetically manipulated, but for some reason was incorrectly manipulated (maybe power was pulled during a write to that sector or the heads are failing/weak and wrote incorrectly to the sector, etc).

These logical bad sectors can be regenerated (usually by writing fresh, correct data to them) and then reused. But, sometimes logical bad sectors can be incorrectly written to the G-List. This often happens when the heads of a hard drive are failing and are reading good sectors with UNC errors because the read element of the heads is malfunctioning. If this happens, the drive will attempt to queue these sectors for reallocation and, if successful, good sectors can end up in the G-List of the drive. Luckily, if you are in need of your data being recovered, such an issue is reversible. Most data recovery technicians can easily access the G-list of a drive that is held within it’s “service area” and remove false entries, or even clear the list completely.

The last thing that I would like to mention is refurbishing. Refurbishing drives takes a somewhat similar approach as these normal repair programs do: they remap bad sectors. The difference is that good refurb companies have reverse engineered hard drives so that they have the manufacturer-unique commands that tell the drive to reallocate bad sectors to a different list. This list is called the “Primary Defects List” or “P-List”. Sometimes it may be called the “Push-Down Defects List”.

The P-list is typically only written once in a disk’s lifetime. This is typically done at the manufacturing site when the drive is assembled and the servo code is written to the platter surface. The P-list handles reallocation much differently than just replacing the bad sector with a reserved sector. It is a more complicated process that will be discussed in more details in a future post, but, in short, it eliminates the performance issues mentioned that occur when many sectors are replaced with reserved sectors.

I hope this has enlightened some about hard drive repair. In conclusion, there is no real “repair” for a drive. Even the refurbishing technique is a temporary solution. The fact is that when a few sectors degrade magnetically, the degradation usually begins to spread to nearby sectors fairly quickly, and the drive will soon become unusable.

Lets start off with a picture:

The end of the arm

There are many components of the Head Stack Assembly, or HSA for short. These components include the actuator, sliders, gimbal, and the heads themselves. The heads themselves are so small that it requires a microscope to view them.

In the Above picture of a 2.5 inch Hitachi Travelstar we can clearly see many of the components of the HSA.

Shock absorption system

Starting on the far left side we have the “Shock absorption system”. This part’s primary function is obviously to absorb any shock that occurs when the heads load back on to the load/unload system (the ramp). This is the part that is notorious for making noise when you shake the drive itself, and many users incorrectly assume this sound means that there is a problem with the drive. The noise is actually normal; the shock absorption system fits very loosely inside.

Top Magnet

Moving to the right a little bit we see the top magnet. Normally there are at least two magnets in a hard drive; rarely are there less. In some recently manufactured low capacity drives you may find only one magnet, but traditionally you will always find a top and bottom magnet. These magnets are VERY powerful and require a significant amount of force to remove and very careful planning to put back on. Their purpose is to provide a magnetic field that will be utilized by the voice coil, which is nestled in between the magnets.

Voice Coil

The voice coil is made up of tightly wound copper wire. When a current is driven to the voice coil, it produces a magnetic field. This magnetic field reacts with the field produced by the magnets which causes a reaction. Because all of the magnets are affixed by screws, the associated magnetic fields stay in place. Because the voice coil is mounted to the head stack (which is movable), the entire voice coil has the ability to move away from the other magnetic field. By changing the current, the voice coil can be manipulated to move in multiple directions. This is how the heads are able to move, and move at extremely high speeds accurately.

Axis and Arm

The next components you will see clearly are the axis and the arm.

The axis allows the arms to move across the disk surface.

preamplifier + leads

If I could pick out any component of the head stack assembly (besides the heads themselves) as the second-most important part, I would pick the preamplifier. The frequencies of the signals that are coming from the head stack are very high (above 1ghz), so these frequencies would most certainly dissipate well before they could reach the MCU (Master control unit) without some preventative measures. Enter the preamp, whose job is to amplify the signal coming from the heads and send it out to the MCU. Its other duty is to control which head is to be used, and also if that head is to read or write. This is necessary because the nature of how the data is written and read from the platters is that only one head may be utilized at a time, and that one head can either read or write at any given time, not both. The preamplifier controls this function along with the MCU.

The Leads pictures above to the right of the preamplifier chip are simply the connections to the heads themselves. You can clearly see that this particular drive has 4 heads and there are 4 leads present. Sometimes the lead may be present, but the head is not in use. This can be easily identified as you will see that the lead does not continue down the arm to a head and it will end near the preamp.

First lets take a look at the MBR (Master boot record) for an NTFS file system.

80 01                ..
000001C0:01 00 06 0F 7F 96 3F 00 -00 00 51 42 06 00 00 00  …..?…QB….
000001D0:41 97 07 0F FF 2C 90 42 -06 00 A0 3E 06 00 00 00 A….,.B…>….
000001E0:C1 2D 05 0F FF 92 30 81 -0C 00 A0 91 01 00 00 00 .-….0………
000001F0:C1 93 01 0F FF A6 D0 12 -0E 00 C0 4E 00 00 55 AA ………..N..U.

Above is the end of a MBR created using Windows. When reading hex you will notice that the beginning of each line actually starts on the line above it. You can see very easily that the boot indicator for the first partition is 80, follow by 01 which is telling which is the starting head. Future partitions will not list a starting head, but rather simply the starting sector.

At 0×1C2 you will find the value 06. This is the system ID field. This tells you what file system formatted the partition. 06 is a FAT indicator. 07 is NTFS. 05 is an extended partition, and 01is a FAT12 partition. There are many more system ID fields, but these are the ones present in the example above.

The last thing I wanted to talk about is file signatures. Every type of file has a signature, even photos taken with a digital camera have a special signature that can actually tell you what kind of camera took the picture and when. This is the type of thing that you need to really learn for forensics, and can prove to be a very helpful skill for data recovery if you are going to attempt to repair files. There just isn’t enough time and space for me to go into the various types of signatures here, but here is a link to a list of signatures that is constantly being updated:

http://www.garykessler.net/library/file_sigs.html – File signatures

You now have the basic understanding of hexadecimal and the part that it plays in data recovery and forensics. From here you should refine your ability to recognize patterns in the code so that you know when something has been changed or is damaged. Practice is the key here. You should constantly be looking at files in hex so that you can see what a working file should look like. Then, as a learning tool, you can damage that file and take note of the differences that occurred when you damaged it. Look for signatures in all kinds of files and become familiar with their location.

Next week I am going to be returning to the topic of hard drive anatomy, continuing with headstacks and then moving into the details of Servo technology.

HDD Doctor