"Before doing any data recovery work, the exact cause of the problem must be known and understood."
"If the diagnosis of the problem is incorrect, then it is unlikely that the data will be recovered. This must be the first and most important stage of the data recovery process."
Mike Montgomery - Managing director.
Some data recovery companies use an ad-hoc method of 'try this, then try that'. We believe that is the way to disaster and not the way to diagnose a potential problem, and so have developed this methodology. This list is not exhaustive, but describes the main diagnosis process used by us at MJM.
"We were asked to help in the recovery of data on a failed hybrid drive that had been examined by a couple of other companies with no positive outcome. I was referred to MJM by another recovery specialist.... Our client was thrilled with what was recovered, which allowed his business to continue without lost IP."
The electronics board is removed, and standard components are tested and where necessary signals are traced through the various points on the board to make sure all is correct. When a fault is found, the original board is never used for the recovery.
The PCB often contains unique information in ROM or Masked ROM (inside the CPU) that must be extracted and transferred to a fully working PCB. This is done using software and hardware specifically designed for this purpose, In cases where the ROM cannot be read, the physical ROM chip is removed, and the content read using a device programmer. The content is then written to another known working PCB.
The drive is opened in one of our clean air cabinets and visible surfaces are closely examined under magnification for signs of damage. Drives that have been dropped can have heads that have been dislodged or have broken off or leave 'speckle' marks on the platters. All missing heads must be accounted for before the drive is spun up. Loose heads or debris inside a drive can cause irreparable damage, rendering a drive unrecoverable within a very short time if the drive is spun up whilst debris is loose in the drive.
The inside of the drive cavity is checked for debris from the remains of a head crash and the internal filters are examined for contamination as that also indicates head failures on non-visible surfaces. Small dentistry-type mirrors are used to look in places that are not directly accessible, such as the spaces between platters.
Microscopic examination of the condition of the Read/Write heads condition can give vital information about the state of the heads and platters.
Careful examination of each head can determine if there is platter damage on one of the surfaces that are not easily viewable without removal of the platters. If there is debris in one or more of the heads, this is an indicator of severe media damage for the affected surfaces. Careful removal of affected heads from a new set of heads can let us gain access to the data stored on the remaining good platters.
Some hard disk faults need analysis using a Disk Drive Analyser (or DDA), the DDA is an advanced, expensive and very fast oscilloscope, with speeds in the GHz bands they are designed specifically for use in hard disk drive development and troubleshooting, it is a must-have for any serious data recovery company. When used correctly a lot of information about the health and status of the drive can be gleaned from the traces including head faults, bad media and minor platter damage.
A bus analyser monitors the protocol of data transferred between the hard disk under test and the computer. The protocol includes the commands sent to the drive, the response codes received from the drive and data written to or read from the drive. We use this mainly for hard disks that show firmware problems, so we can determine the exact location of the problem is and what type of error is generated. This lets us target the exact sectors within a specific module that are causing the problem, giving much more control than using standard software solutions. The most important aspect of this stage is identifying the correct response from errors codes. Attempting to write a firmware module with certain errors can render a drive totally inoperable.
Other important tools are commercially available for example, hard disk firmware analysis tools such as the PC3000 from ACE Laboratory, ACE have been providing us with data recovery firmware analysis technology since 2002 and their software is the flagship of firmware analysis and repair.
They also provide the 'data-extractor' add on that works in tandem with the PC3000, which is an advanced hard disk imaging software that enables the best possible recovery.
Imaging by head on all makes of drives, selective data imaging for most operating systems and advanced control of bad media and performing live firmware repairs and decryption of BitLocker and other hardware encryption during the imaging process. This means we can select critical files without have to clone the whole drive, decrypt and then find the critical data.
Owning the equipment is a small part of the process, having an understanding of hard disk firmware is absolutely vital. We have received many drives where incorrect firmware 'fixes' have rendered a drive inoperable. Most of them we have been able to repair, but sadly, not all.