Hard drive analysis methods
How hard disk drives are analysed for faults.
Diagnosing problems on hard drives.
“Before doing any data recovery work, the exact cause of the problem must be known and understood. If the diagnosis of the problem is incorrect, then it is unlikely that the data will be recovered. This must be the first and most important stage of the data recovery process.”
Mike Montgomery – Managing director.
Some data recovery companies use an ad-hoc method of ‘try this, then try that‘. We believe that is the way to disaster and not the way to diagnose a potential problem, and so have developed this methodology. This list is not exhaustive, but describes the main diagnosis process used by us at MJM.
Electronics and PCB problems
The electronics board is removed, and standard components are tested and where necessary low voltage signals are injected and traced through the various points on the board to make sure there are no short-circuits. When a fault is found, the original board is only used for the recovery when it is needed for encryption keys stored in the processor. In rare cases, we have to move the processor to a new board.
The PCB often contains unique information in ROM or Masked ROM (inside the CPU) that must be extracted and transferred to a fully working PCB. This is done using software and hardware specifically designed for this purpose, In cases where the ROM cannot be read, the physical ROM chip is removed, and the content read using a device programmer. The content is then written to another known working PCB.
Internal visual analysis
The drive is opened in one of our clean air cabinets and visible surfaces are closely examined under magnification for signs of damage. Drives that have been dropped can have heads that have been dislodged or have broken off or leave ‘speckle’ marks on the platters. Any missing heads must be accounted for before the drive is spun up. Loose heads or debris inside a drive can cause irreparable damage, rendering a drive unrecoverable within a very short time if the drive is spun up whilst debris is loose in the drive.
The inside of the drive cavity is checked for debris from the remains of a head crash and the internal filters are examined for contamination as that also indicates head failures on non-visible surfaces. Small dentistry-type mirrors are used to look in places that are not directly accessible, such as the spaces between platters.
Read/Write head testing
Microscopic examination of the condition of the Read/Write heads condition can give vital information about the state of the heads and platters.
Careful examination of each head can determine if there is platter damage on one of the surfaces that are not easily viewable without removal of the platters. If there is debris in one or more of the heads, this is an indicator of severe media damage for the affected surfaces. Careful removal of affected heads from a new set of heads can let us gain access to the data stored on the remaining good platters.
Tools used for diagnosis
There are many tools that assist in the diagnosis, too many to list fully. Below is just a part of the list of tools we use here at MJM Data Recovery Ltd.
Disk drive analyser (DDA)
Some hard disk faults need analysis using a Disk Drive Analyser (or DDA), the DDA is an advanced, expensive and very fast oscilloscope, with speeds in the GHz bands. They are designed specifically for use in hard disk drive development and troubleshooting, it is a must-have for any serious data recovery company. When used correctly, a lot of information about the health and status of the drive can be gathered from the traces, including head faults, bad media and minor platter damage.
A bus analyser monitors the protocol of data transferred between the hard disk under test and the computer. The protocol includes the commands sent to the drive, the response codes received from the drive and data written to or read from the drive. We use this mainly for hard disks that show firmware problems at start up, so we can determine the exact location of the problem, and what type of error is generated.
This lets us target the exact sectors within a specific firmware module that is causing the issue, giving us much more control than using standard software solutions – which leaves a lot to guesswork. As our MD states above, the exact cause of the problem must be known and understood. The most important aspect of this stage is identifying the response code for errors generated during start-up. Attempting to repair a firmware module with specific error types can render a drive totally inoperable.
Other important tools are commercially available for example, hard disk firmware analysis tools such as the PC3000 from ACE Laboratory. ACE have been providing us with firmware analysis technology since 2002, and their software is the flagship of firmware analysis and hard drive repair.
They also provide the ‘data-extractor’ add on that works in tandem with the PC3000, which is an advanced hard disk imaging software that enables the best possible recovery.
Imaging by head on all makes of drives, selective data imaging for most operating systems and advanced control of bad media and performing live firmware repairs and decryption of BitLocker and other hardware encryption during the imaging process. This means we can select critical files without have to clone the whole drive, decrypt, and then find the critical data.
Owning the equipment is a small part of the process, having an understanding of hard disk firmware is absolutely vital. We have received many drives where incorrect firmware ‘fixes’ have rendered a drive inoperable. Most of them we have been able to repair, but sadly, not all.