Furthermore, the “repair” is not so much of a repair. You could consider this repair to be the equivalent of a tourniquet. The hard drive is like an arm that has been badly wounded and is bleeding profusely. The tourniquet is the “repair”, which temporarily relieves the underlying issue, but the fact is it’s only a temporary solution to a escalating problem. With hard drives, there is no hospital that can stop them from degrading; we can only hide the degradation temporarily.

So what is really going on when a drive is “repaired”? Reallocation.

A hard drive is constantly performing built-in maintenance routines and when the drive recognizes an unstable sector, the hard drive realizes this, marks the sector bad, then puts it in a reallocation queue.

What is this “reallocation”?
It’s a simple principle: the detected bad sector gets put into a list that says “do not use this sector anymore, because it can’t hold data reliably”. This list is known as the “G-list” or “Grown Defects List”.

Once the bad sector has been removed and put into the G-List, a new, reserved sector is used in its place. This reserved sector is “mapped” as the same LBA (Logical Block Address) as the old, dead sector, but it is in a different physical location on the disk.

This can cause issues once many sectors begin failing because the heads will have to change position to read the new sectors that are located in the reserved areas. This will cause delays in access times and will eventually be noticeable to the end user.

All hard drives contain these reserved sectors and the OS is unable to see or use them. Only the drive knows of their existence and their location on the disk.

There is even more to this story though, as there are two types of bad sectors. There are “physical bad sectors” and “logical bad sectors”.

A physical bad sector is a sector that for some reason can no longer to be magnetically manipulated and used to store data. These are the types of errors that will be mapped to the G-List.

A logical bad sector is a sector that is able to be magnetically manipulated, but for some reason was incorrectly manipulated (maybe power was pulled during a write to that sector or the heads are failing/weak and wrote incorrectly to the sector, etc).

These logical bad sectors can be regenerated (usually by writing fresh, correct data to them) and then reused. But, sometimes logical bad sectors can be incorrectly written to the G-List. This often happens when the heads of a hard drive are failing and are reading good sectors with UNC errors because the read element of the heads is malfunctioning. If this happens, the drive will attempt to queue these sectors for reallocation and, if successful, good sectors can end up in the G-List of the drive. Luckily, if you are in need of your data being recovered, such an issue is reversible. Most data recovery technicians can easily access the G-list of a drive that is held within it’s “service area” and remove false entries, or even clear the list completely.

The last thing that I would like to mention is refurbishing. Refurbishing drives takes a somewhat similar approach as these normal repair programs do: they remap bad sectors. The difference is that good refurb companies have reverse engineered hard drives so that they have the manufacturer-unique commands that tell the drive to reallocate bad sectors to a different list. This list is called the “Primary Defects List” or “P-List”. Sometimes it may be called the “Push-Down Defects List”.

The P-list is typically only written once in a disk’s lifetime. This is typically done at the manufacturing site when the drive is assembled and the servo code is written to the platter surface. The P-list handles reallocation much differently than just replacing the bad sector with a reserved sector. It is a more complicated process that will be discussed in more details in a future post, but, in short, it eliminates the performance issues mentioned that occur when many sectors are replaced with reserved sectors.

I hope this has enlightened some about hard drive repair. In conclusion, there is no real “repair” for a drive. Even the refurbishing technique is a temporary solution. The fact is that when a few sectors degrade magnetically, the degradation usually begins to spread to nearby sectors fairly quickly, and the drive will soon become unusable.

Lets start off with a picture:

The end of the arm

There are many components of the Head Stack Assembly, or HSA for short. These components include the actuator, sliders, gimbal, and the heads themselves. The heads themselves are so small that it requires a microscope to view them.

In the Above picture of a 2.5 inch Hitachi Travelstar we can clearly see many of the components of the HSA.

Shock absorption system

Starting on the far left side we have the “Shock absorption system”. This part’s primary function is obviously to absorb any shock that occurs when the heads load back on to the load/unload system (the ramp). This is the part that is notorious for making noise when you shake the drive itself, and many users incorrectly assume this sound means that there is a problem with the drive. The noise is actually normal; the shock absorption system fits very loosely inside.

Top Magnet

Moving to the right a little bit we see the top magnet. Normally there are at least two magnets in a hard drive; rarely are there less. In some recently manufactured low capacity drives you may find only one magnet, but traditionally you will always find a top and bottom magnet. These magnets are VERY powerful and require a significant amount of force to remove and very careful planning to put back on. Their purpose is to provide a magnetic field that will be utilized by the voice coil, which is nestled in between the magnets.

Voice Coil

The voice coil is made up of tightly wound copper wire. When a current is driven to the voice coil, it produces a magnetic field. This magnetic field reacts with the field produced by the magnets which causes a reaction. Because all of the magnets are affixed by screws, the associated magnetic fields stay in place. Because the voice coil is mounted to the head stack (which is movable), the entire voice coil has the ability to move away from the other magnetic field. By changing the current, the voice coil can be manipulated to move in multiple directions. This is how the heads are able to move, and move at extremely high speeds accurately.

Axis and Arm

The next components you will see clearly are the axis and the arm.

The axis allows the arms to move across the disk surface.

preamplifier + leads

If I could pick out any component of the head stack assembly (besides the heads themselves) as the second-most important part, I would pick the preamplifier. The frequencies of the signals that are coming from the head stack are very high (above 1ghz), so these frequencies would most certainly dissipate well before they could reach the MCU (Master control unit) without some preventative measures. Enter the preamp, whose job is to amplify the signal coming from the heads and send it out to the MCU. Its other duty is to control which head is to be used, and also if that head is to read or write. This is necessary because the nature of how the data is written and read from the platters is that only one head may be utilized at a time, and that one head can either read or write at any given time, not both. The preamplifier controls this function along with the MCU.

The Leads pictures above to the right of the preamplifier chip are simply the connections to the heads themselves. You can clearly see that this particular drive has 4 heads and there are 4 leads present. Sometimes the lead may be present, but the head is not in use. This can be easily identified as you will see that the lead does not continue down the arm to a head and it will end near the preamp.

First lets take a look at the MBR (Master boot record) for an NTFS file system.

80 01                ..
000001C0:01 00 06 0F 7F 96 3F 00 -00 00 51 42 06 00 00 00  …..?…QB….
000001D0:41 97 07 0F FF 2C 90 42 -06 00 A0 3E 06 00 00 00 A….,.B…>….
000001E0:C1 2D 05 0F FF 92 30 81 -0C 00 A0 91 01 00 00 00 .-….0………
000001F0:C1 93 01 0F FF A6 D0 12 -0E 00 C0 4E 00 00 55 AA ………..N..U.

Above is the end of a MBR created using Windows. When reading hex you will notice that the beginning of each line actually starts on the line above it. You can see very easily that the boot indicator for the first partition is 80, follow by 01 which is telling which is the starting head. Future partitions will not list a starting head, but rather simply the starting sector.

At 0×1C2 you will find the value 06. This is the system ID field. This tells you what file system formatted the partition. 06 is a FAT indicator. 07 is NTFS. 05 is an extended partition, and 01is a FAT12 partition. There are many more system ID fields, but these are the ones present in the example above.

The last thing I wanted to talk about is file signatures. Every type of file has a signature, even photos taken with a digital camera have a special signature that can actually tell you what kind of camera took the picture and when. This is the type of thing that you need to really learn for forensics, and can prove to be a very helpful skill for data recovery if you are going to attempt to repair files. There just isn’t enough time and space for me to go into the various types of signatures here, but here is a link to a list of signatures that is constantly being updated:

http://www.garykessler.net/library/file_sigs.html - File signatures

You now have the basic understanding of hexadecimal and the part that it plays in data recovery and forensics. From here you should refine your ability to recognize patterns in the code so that you know when something has been changed or is damaged. Practice is the key here. You should constantly be looking at files in hex so that you can see what a working file should look like. Then, as a learning tool, you can damage that file and take note of the differences that occurred when you damaged it. Look for signatures in all kinds of files and become familiar with their location.

Next week I am going to be returning to the topic of hard drive anatomy, continuing with headstacks and then moving into the details of Servo technology.

HDD Doctor

As you likely know, computers read/write data in binary at the lowest level. Binary is a “base 2″ numbering system, which means there are only two possible values for each digit. Binary is often compared to a “light switch” because values are either “0″ (off) or “1″ (on). Each binary digit is considered a “bit”.

Because binary is difficult to read and interpret quickly, hexadecimal is often used to simplify and make low-level data easy to deal with. Each hexadecimal digit represents 4 bits (or binary digits). When viewing hex data, viewers often group data digits in pairs of two, because this represents 1 byte of data.

Hexadecimal counts as the following: 0 1 2 3 4 5 6 7 8 9 A B C D E F

Here is a chart showing the Hex/binary values of 0-15.

Now, this is where things get a little more tricky. Obviously, the number system doesn’t just end at “F”. Just like decimal (base 10), when hexadecimal gets to “F”, it adds a digit. So “16″ in decimal is “10″ in hexadecimal, and “17″ in decimal is “11″ in hexadecimal.

An important equation you should familiarize yourself with is how to convert a hexadecimal value to decimal. It is as follows:

Next week we will continue our look at hexadecimal by looking at hex data from the boot sector of an NTFS partition, and also the hex data for certain types of files to show how you can find patterns that will help you identify the type of file, and other interesting attributes about it.