First lets take a look at the MBR (Master boot record) for an NTFS file system.

80 01                ..
000001C0:01 00 06 0F 7F 96 3F 00 -00 00 51 42 06 00 00 00  …..?…QB….
000001D0:41 97 07 0F FF 2C 90 42 -06 00 A0 3E 06 00 00 00 A….,.B…>….
000001E0:C1 2D 05 0F FF 92 30 81 -0C 00 A0 91 01 00 00 00 .-….0………
000001F0:C1 93 01 0F FF A6 D0 12 -0E 00 C0 4E 00 00 55 AA ………..N..U.

Above is the end of a MBR created using Windows. When reading hex you will notice that the beginning of each line actually starts on the line above it. You can see very easily that the boot indicator for the first partition is 80, follow by 01 which is telling which is the starting head. Future partitions will not list a starting head, but rather simply the starting sector.

At 0×1C2 you will find the value 06. This is the system ID field. This tells you what file system formatted the partition. 06 is a FAT indicator. 07 is NTFS. 05 is an extended partition, and 01is a FAT12 partition. There are many more system ID fields, but these are the ones present in the example above.

The last thing I wanted to talk about is file signatures. Every type of file has a signature, even photos taken with a digital camera have a special signature that can actually tell you what kind of camera took the picture and when. This is the type of thing that you need to really learn for forensics, and can prove to be a very helpful skill for data recovery if you are going to attempt to repair files. There just isn’t enough time and space for me to go into the various types of signatures here, but here is a link to a list of signatures that is constantly being updated:

http://www.garykessler.net/library/file_sigs.html – File signatures

You now have the basic understanding of hexadecimal and the part that it plays in data recovery and forensics. From here you should refine your ability to recognize patterns in the code so that you know when something has been changed or is damaged. Practice is the key here. You should constantly be looking at files in hex so that you can see what a working file should look like. Then, as a learning tool, you can damage that file and take note of the differences that occurred when you damaged it. Look for signatures in all kinds of files and become familiar with their location.

Next week I am going to be returning to the topic of hard drive anatomy, continuing with headstacks and then moving into the details of Servo technology.

HDD Doctor

As you likely know, computers read/write data in binary at the lowest level. Binary is a “base 2″ numbering system, which means there are only two possible values for each digit. Binary is often compared to a “light switch” because values are either “0″ (off) or “1″ (on). Each binary digit is considered a “bit”.

Because binary is difficult to read and interpret quickly, hexadecimal is often used to simplify and make low-level data easy to deal with. Each hexadecimal digit represents 4 bits (or binary digits). When viewing hex data, viewers often group data digits in pairs of two, because this represents 1 byte of data.

Hexadecimal counts as the following: 0 1 2 3 4 5 6 7 8 9 A B C D E F

Here is a chart showing the Hex/binary values of 0-15.

Now, this is where things get a little more tricky. Obviously, the number system doesn’t just end at “F”. Just like decimal (base 10), when hexadecimal gets to “F”, it adds a digit. So “16″ in decimal is “10″ in hexadecimal, and “17″ in decimal is “11″ in hexadecimal.

An important equation you should familiarize yourself with is how to convert a hexadecimal value to decimal. It is as follows:

Next week we will continue our look at hexadecimal by looking at hex data from the boot sector of an NTFS partition, and also the hex data for certain types of files to show how you can find patterns that will help you identify the type of file, and other interesting attributes about it.

What to do if: You knock over your external drive while it is on and now it isn’t recognized.

This is a very bad scenario. In this case the only good course of action is to NOT attempt to turn the drive on again and talk to a pro ASAP.

Why? Because significant damage has probably been caused to the internal mechanics of the drive that, if not treated properly, can render your data permanently inaccessible and gone forever.

There are a few different ways that this can happen:

1) The heads might crash into the platter causing a radial scratch on the media surface which possibly kills the head and renders that area of the disk permanently un-readable.

2) The Spindle Motor suffers damage and seizes. It will no longer spin up unless it is somehow loosened. Even if it can be loosened many times there is “eccentricity” that will cause the heads to be unable to read the media.

3) The heads may stick to the media, causing damage to the surface, the heads, and the motor. This can be made even worse if the user continues to attempt to re-power the drive.

What to do if: You plug the wrong power connector into your external drive or you plug in the Molex/SATA power connector in upside down.

In this scenario you have at minimum damaged the PCB (Printed circuit board) of the HDD. You will need knowledge of circuits and be handy with a VOM (Voltage-Ohm meter) or DMM (Digital Multi meter) to repair this. Typically the only damage that will occur to your drive in this case is to the power protection components of the drive (assuming they did their job and did not fail). You will need to repair these components to return the drive to service. Even if you manage to repair the drive it is never recommend you use the drive again; transfer your data to a new drive and back it up.

So we went over all of the parts that I chose for my work PC and why I chose them; and also made some recommendations for alternative components.

Now that we have all the parts it’s time to put them all together and make it work. I’m going to walk through the steps that I take when building a PC; while giving some pointers that I have picked up over time.

The first thing I always do when building a PC is to prepare the Case. If the wires for the power button and reset button are in the way; move them to a safe, out of the way position for now. Also remove both side panels for easy access, and wire management. Some cases you may want to take off the front panel; as with the case that I got (the sides bulge out so that  it will not sit flat unless you remove the front panel).

Bottom view with front panel removed

Side view looking at the HDD area

After preparing the case I always start by installing the processor and heat-sink (used to cool the processor) while they are outside of the case. (Some cases have “removable motherboard trays”). If the case you choose does then you will want to remove it and do the installation on the tray while it is removed.

The reason I like to work outside of the case is because installing heat sinks (especially large, aftermarket ones) can be increasingly difficult if you attempt to install them while in the case. Also, many large aftermarket heat sinks (like the one I chose) have a special back plate you will have to install on the bottom-side of the motherboard for extra support so the board does not break.

Heatsink (left), motherboard, processor, thermal compound

Mirror finish on the Heatsink base

Installing the processor itself is simple; and there are instructions provided on how to do so which explain it as good as I can, so I recommend following those instructions.

Once you have installed the processor, you will need to apply thermal compound to both the processor and the heat sink. There are many “techniques” that are recommended to do this. From my experience, do not listen to the instructions telling you to put a “drop” on the middle of the processor and letting the force of the heat sink spread it. I recommend using the technique I have used for a number of years, and always get amazing results.

First, you will need two “tools”. A zip-lock bag, and a used credit-card/ gift card. Then what I do is put a drop on the heat sink (more then a small drop, but not too much) then you are going to want to put the zip lock bag over your hand, and massage the compound into the base of the heat sink; the reason for this is because there are microscopic machining marks that will be filled that increase the heat transfer even further. Once you have done this, put one more small drop on the heat sink, and use the card to spread it evenly across the base. Once you have done this; put another drop on the processor and spread it evenly across the top of the processor. Make sure that none of the metal on the processor is showing, but that the compound is not too thick (paper thin at most).

Spreading the thermal compound on the processor

Spreading the thermal compound on the processor    Once you have done this it is time to install the heat sink. You heat sink may have a different mounting apparatus; so my best advice here is to follow the instructions provided, and if in doubt get online and browse around some forums (overclocking forums are a good place to look) for guides and reviews made by other users. You can find some useful pointers about your heat sink, and the best techniques to use while installing.   For my Zalman cooler that I chose; I have found that the best way to install this is to have a partner handy to help you. The reason for the is because the bracket calls for you to screw in two screws alternating back and forth on each side until the heat sink is securely fastened. The problem that the instructions don’t tell you about is that the bracket is curved (sort of like a U shape slightly). This makes for a nice tight fit once fastened, but also causes a lot of resistance while installing; you can never get one screw quite tight enough to stay in place while you tighten the other screw; I actually stripped one of the sockets the first time I tried to install this cooler (on a different computer) and had to re order a new heat sink. So, the best way is to have a partner with a screwdriver screw in one side a little; while you are also pushing down and screwing in your screw, and alternate back and forth until they are both tightened securely. Installed heat sink

Installed heatsink

Once you have installed the processor and heat sink it’s time to install the motherboard into the case. Make sure you install all of the pegs into their correct positions, and then carefully place the board into place. You will probably have to apply some force to the board (pushing towards the back of the case) while you screw in the peg screws.

The motherboard installed into the case

Installing memory is extremely easy; just match the connectors and apply force. Usually you will hear a “click” but don’t count on it. Watch the clips and observe if there are in the proper place after you have applied force. You can install the memory before or after you install the motherboard into the case; I chose to do it before in this case.

Installing the graphics card is almost identical to installing the RAM, but make sure you take the back-plate off of the case before you try to install the card.

Installing HDD is also fairly simple, but every case has a slightly different type of installation. This particular case came with screw-less installation. Basically, it’s some brackets that you install on each side of the drive, allowing it to slide in and out of the HDD are fairly easily, but hold firm enough to not cause any un-wanted vibration.

Installed Hard drives

Installing the Power supply is straight forward. Just screw the unit into it’s position. I usually try to un-tangle the cables once I get it installed, and plan out which way I want the cables to run; so they do not obstruct air flow, and look kinda pretty to! Any unused cables can be run to the back side of the case (that has no window) so they will be hidden, and not obstructing air flow.

Running cables behind the motherboard tray

And that is all!

You are done building the computer, the only thing you may have to install are the bay devices (Removable HDD tray, CD/DVD drive)

Here is a picture of the finished product:

The finished product

Good luck building, and have fun!

- HDD Doctor

Building a PC is something almost everyone in the world of technology does at some point in time; some do it a lot more then others, and some even take a hobby to it (like myself). Being the hobbyist I am; I keep myself familiar with not only Data Recovery, but with all the latest parts for PCs being released, and all of the latest technologies with processors, graphics cards, motherboards, and all those other components that make up a PC. Recently, I was appointed to build a new Work PC for our Data Recovery Department here at Ji2, and I am going to walk you through the steps that I took to build a good PC for Data Recovery work.

Depending on the amount of cases you see and the way that you/your technicians like to work will play a big part on how much you will need to spend on your work PC; or if you are going to need to purchase duplicate parts to build multiple PCs.

Logical work is always an afterthought in the data recovery community; and I am not sure why because logical recovery is inevitable. No matter if you do a platter transplant or a PCB swap, in the end the goal is to be able to image the drive, and rebuild the files/file system on that drive to extract the data.

A problem I always see in our lab is this: physical work only takes a matter of minutes, but logical work can easily take hours, even days to image and rebuild the file structure. This can cause a major problem to arise; your workload becomes backed up because you have to wait for a drive to image or for your software the rebuild this 500GB hard drive’s file structure. This greatly reduces productivity. All of these things I took in to consideration when building a new PC. I wanted something that was fast, had a lot of expandability, and most of all, reliability. Reliability should be your number one priority. You will be working with customer data on this computer, and you cannot afford for it to crash. This puts customer data at risk, and also lowers productivity.

Alright, so I got started looking for all of the parts I wanted for my work pc. I didn’t really need to research much (I build PCs as a hobby, remember) so I already generally knew what was going to be the best route to go with brand, configuration, etc. Here is a pic of all of the parts after they arrived. Set up all fancy and everything to!

Fancy picture

So, you may be wondering; why did you choose these parts? Why do you need the case with the huge fans on it? The answer is: you don’t. Why did I get the case with the massive fans? Because it was a combo deal with the processor and huge fans mean one thing: huge airflow. Airflow leads to cooler components, and cooler components have longer lives and better reliability. For every one’s benefit; here is a list of all of the parts that I chose, and why I think that this part/brand is important, and if I have any alternative recommendations.

[Processor]-Intel Core 2 Duo e8500: If you have kept up on processors in the last couple years then you surely know that AMD had a big lead with their “Athlon 64″ processors up until about two years ago, when Intel released the beast that is the “Core 2″ series of processors. There is no arguing that these processors deliver, and Intel has been extremely aggressive with pricing. I chose a dual core and not a quad core for a very specific reason; compatibility. At this point in time you may run into compatibility issues with quad cores due to the programming of a lot of software used for data recovery. For that same reason; while a program may not crash while running on a quad core, most programs aren’t designed to run on a quad core and therefore do not utilize all four cores. At this time, a dual core is the best solution for the software DR technicians to use. I recommend getting the highest clocked (GHz) processor you can afford.

[Motherboard] – Asus P5Q Pro: Fairly straight forward; get a board that has a lot of SATA ports, and as many PATA ports as you can; it is hard to find boards with more then one these days. This board I chose because not only does is have 8 SATA ports; but it also has “8-phase power” which essentially helps clean up the currents running to your components; very nice for a DR PC. It also sports “Solid State capacitors” which have much longer life expectancy then standard capacitors.

[Hard Drive] – Samsung Spin-Point F1: For hard drives I looked no further then samsung. The spin-point F1 series is among the quickest 7200rpm drives you can have right now; and it is a general consensus that samsung makes some of the easiest drives to recover, due to their simple, but efficient design. I went with 3 750GB drives, and ran them in a RAID 5. RAID 5 essentially gives you the high read performance of RAID 0, with parity so that if one of the drives fails, it can rebuild itself. Keep in mind that if you want to run a RAID 5 you will need a minimum of three drives (get them identical in size) and that one of those drives is used only for parity, so the total amount of data you will be able to store is the combined total of two of the drives.

[Power Supply] – Corsair VX550: Power supplies get overlooked far too much. A lot of people figure they can go cheap on the worthless power supply to save some money. This is asking for all of your expensive parts and valuable data to go up in smoke. Never go cheap on the power supply. There are a couple things to consider when choosing a power supply. Watts is the most commonly known figure to look for on a power supply. Depending on how much hardware your running in your system you may want to go higher, but ~500watts give or take should be more the enough. The big number you want to look for is the amount of amps on the 12v and 5v rails. This corsair I those can feed something like 50amps into the 12v power rail. In comparison, one of the spinpoint F1 drives uses ~ 2amps on start-up. So you can see how 50amps gives you a lot of head room. The last number you want to look for is efficiency. You want a Power supply that has an 80% + efficiency rating. A lot of people don’t realize that just because your power supply says “500 watts” that does not mean that’s what it can actually output. Depending on heat, and the cleanliness of the current coming into the power supply it usually is much less ~20% less on a good power supply, which gives you your 80%. Keep all of this in mind when looking for a power supply and you should have no problem. Some of my personal favorite brands for PSU are: OCZ, Corsair, Seasonic, Thermaltake, and pc power and cooling.

[Memory] – Corsair XMS DDR2 800 4GB – Corsair has been making great memory for years; it has a lifetime warranty, and it was on sale. Memory is so cheap these days; max it out. On XP and Vista 32bit you will only see ~2.8-3.2gb depending on some variables, but that’s OK, at least cap it out. I would tell you to go with a 64bit operating system, but as with the quad-cores, that is something I would wait a while for because of compatibility issues with data recovery software. Other good brands are: OCZ, Kingston, Mushkin, Geil, Crucial.

[Graphics Card] - HIS ATI 2400pro: Graphics cards don’t do anything to speed up our DR work. Keep it simple and low profile; so it doesn’t use a lot of power. You may want to consider things like the video outputs if you want to run multiple monitors. This card is very solid and was under fifty dollars. Go with ATI or Nvidia, anything else is not very good.

[DVD Drive] – Samsung: DVD burners are only like thirty dollars these days; I picked the samsung, but there are quite a few good brands out there: Samsung, Sony/NEC, LG, Liteon, Asus to name a few. You may want to consider going with a Blueray burner in another half a year or so. With a 40GB capacity, it may come in handy for cheaper delivery media.

[Cooling] - Zalman CNPS 9700LED and Arctic cooling MX-2: As a hobbyist I have learned that keeping your CPU cool will help it live a nice long life. If you can keep you CPU running at around half of its “safe operating temperature” then chances are that processor should last you a good half a decade. The zalman cooler I chose is the most popular cooler on the market for PC Gamers, and games being as strenuous as they are; if you can cool a processor to play games, then you will be just fine cooling it for any other tasks. Arctic cooling MX-2 is what is called “Thermal compound”. This stuff goes in between the processor and the heatsink to promote better transfer of heat. This stuff is ceramic so it is non-conductive, and you don’t need to re apply it for over five years.

Alright, we went over all of the parts; next time I will walk you through the building process and give you some pointers for building a PC.

- The HDD Doctor