Anatomy of a Hard Drive
Why did my Hard Drive Fail?
A-Z of Data Recovery
Send Us a Drive
Data Recovery Guides
Hard Drive Recovery
Drive Rescue offers a full hard drive recovery service for logical, electronic and physical defects.
The three main issues that affect 1.8”, 2.5” and 3.5” drives are logical, electronic and physical failure.
We recover data from all drive types, including S-ATA, IDE, ZIF, LIF, SCSI, SAS and USB external hard drives.
We offer three main types of recovery:
Logical Recovery e.g. accidental deletion/format or files not accessible after system crash.
Electronic Recoverye.g. when the drive is not seen by BIOS or is not spinning at all.
Physical Recovery e.g. when the drive is not starting or is making a clicking or buzzing noise.
Logical Recovery
Logical failure occurs when the drive’s file system driver gets corrupted or erased. Logical data recovery can also be needed if accidental formatting has occurred.
Types of Logical Failure
File System Corruption
When the file system (NTFS, FAT, HFS) driver gets corrupted, the data on the device will become inaccessible.
NTFS and FAT file systems (Windows)
For NTFS and FAT file systems, the Master File Table remains the backbone of the folder structure. It contains an index of all the files on the volume, consisting of columns of “attributes” and rows of file “records”.
If the attributes of the file are within the 1024kb Master File Table, they are referred to as “resident” attributes. However, when the file attributes exceed the limits allowed by MFT records, they are stored in additional MFT records or in metadata files.
What happens when you delete a file (accidentally or otherwise) using the Windows (NTFS) file system?
When you delete a file the “allocation status” changes. When a file is deleted the status changes from “allocated” (file in use) to “unallocated” (deleted).
To recover data from a wiped hard drive, the data recovery technician will scour the drive for all MFT entries looking for “unallocated entries”. Using the right techniques, and assuming that extensive overwriting has not taken place, this type of data recovery can be very successful.
FAT 32 and exFAT (as used by External Hard Drives and USB memory sticks) Data Recovery.
The standard format for most removable storage devices is FAT32. This was introduced by Microsoft in the early 1990s as an improvement on their original FAT file system.
The FAT file directory consists of a Reserved Area, FAT Area, Root Directory and Data Area. In terms of data recovery, the most important part of the FAT file system is the Root Directory. This gives the data recovery technician a roadmap, as it were, to the contents of a drive. The directory entry will indicate attributes, such as file name, file creation dates, last modified dates, file size, starting cluster and allocation status (whether the file is in use or deleted).
Common Symptoms of Logical Failure
-
You have recently installed new software on your system and now the system will not boot.
-
You receive a Bluescreen (Windows) or a white screen with flashing question mark (Apple)
-
Folders or files seem to have disappeared for no apparent reason.
HFS Corruption (Apple)
Apple devices use the Hierarchical File System. In terms of logical data recovery from an Apple device it is important to be cognisant with various attributes and weaknesses of this file system.
The most important constituent of the Hierarchical File System is the Catalog file. This file is used by the file manager to organise information about the folder structure on a volume. The Catalog file is structured as a “B-Tree” file and consists of a header node, index nodes, map nodes and leaf nodes.
Corruption of the Catalog node is a common reason for data loss on Mac devices. When the Catalog file node gets corrupted, the file records get scattered and locating a file can become very difficult.
However, using the drive’s Volume Header information and analysis of Journal files can help the data recovery technician rebuild the Catalog file structure, and eventually recover lost or deleted files from an Apple storage device.
Drive Rescue Imaging Station
Firmware Corruption
Most of a modern hard drive’s firmware is stored on the “system area” of the disk platters. Typically, the system area contains the P-List and G-List defect lists. The P-List contains the Primary defect list. This contains all sectors marked as “bad” during factory testing. The G-List or Growth Defects List contains all the sectors marked as bad during the life cycle of the drive. The system area also contains important servo information to enable proper syncing between heads and platters.
When the firmware becomes corrupt, the drive will not be able to initialise properly and the data will be inaccessible.
Accidental Deletion or Formatting
Even the savviest computer user has accidentally deleted files from their computer. If you have deleted files accidentally, stop using your computer immediately. When a file is “deleted” the space it occupies on the hard drive is marked as “unallocated” until a newer file is written to that portion of the disk.
-
You have bought a new drive for your system and accidentally formatted the old drive instead of the new one.
-
Your system has been accidentally formatted with a Windows, Mac OS or Linux installation disc.
-
Using a RAID enclosure, you have accidentally erased a drive partition or reset an array to factory settings.
Data Recovery from Encrypted Drives
Encryption is a way of encoding data so it is not accessible without an
encryption key. Encryption can be user deployed or it can be built in to a storage device. Typical user-deployed encryption applications would include TrueCrypt, Safeboot and SafeGuard. Meanwhile, built-in encryption (such as 128-bit encryption) is commonly found on Western Digital external drives.
Data can be successfully recovered from drives which are encrypted. If the drive has logical defects, the drive is normally decrypted before the data recovery process starts. If the drive has physical defects, it is normally repaired first then decrypted.
Quick Way to Identify Logical Failure:
When you connect the drive to a computer, you receive the message:“You need to format the disk in drive X before you can use it. Do you want to format it?” Alternatively, the drive will not acquire a Drive Letter when connected to your computer.
Data Recovery Procedures for Logical Failure:
Typically, after logical failure, rebuild of the file system (e.g. NTFS or HFS) is needed. In certain cases, where there has been a substantial loss or corruption of the drive’s metadata, “file carving” is used during the data recovery process.
ˆˆ back to top
Electronic Failure
A Surge Damaged ROM chip of a Hard Drive
Types of Electronic Failure
ROM Chip Failure / Firmware Corruption
Some firmware modules, especially those needed to initialise the drive are stored on the ROM chip of the PCB. When the firmware gets corrupted or the ROM chip fails, the hard drive will not be accessible. Drive Rescue has an extensive firmware database for data recovery from Seagate, Western Digital, Samsung and Hitachi drives.
Failed Inductor or Transient Voltage Suppressor
The PCB board contains a number of inductors and one or more transient voltage suppressors to regulate voltage flow throughout the drive. If one or more of these fail, the drive will cease to power up.
Electronic Diagnosis – Drive Rescue Lab
Causes of Electronic Failure
Electrical Overstress
Each hard drive should operate within the range of voltage, current and power limits as established by the manufacturer. When a hard drive operates outside this “safe operating area”, electrical overstress can cause damage to its electronics. For example, using a replacement laptop power adaptor which has a different voltage to the original can put the electronics of a hard drive under stress.
Electrostatic Discharge
Although hard drives have built-in diode protection against sudden voltage changes, they are still liable to ESD damage. The higher-than-normal current flow stresses metal interconnectors and damages junctions on the drive’s printed circuit board.
Thermal Overstress
An overheating host device, e.g. a computer system or heat build-up in a hard disk enclosure, will cause thermal overstress on a hard drive’s electronics. This damage will sometimes be visible as “scorch marks” on the PCB itself, or on the ROM or MCU chip.
Quick Way to Identify Electronic Failure:
When you connect the drive to a desktop computer, it will not spin up at all or you will notice that the drive information appearing in the host system’s BIOS will be incorrect or garbled.
Data Recovery Procedure for Electronic Failure
In certain cases, physical repair of the PCB (such as repair of TVS diodes) will suffice in order to perform a full data recovery. However, in most cases where the drive’s adaptive information stored on the ROM is unreadable or corrupt, we use data recovery equipment which can read and restore firmware if needed.
ˆˆ back to top
Physical Recovery
Types of Hard Disk Physical Failure
Seized Spindle Motor
The spindle motor is an electronic component in your hard drive which spins the drive’s platters. The average rotational speed of the drive platters is 7,200 revolutions per minute. When the ball bearings of the spindle motor seize (due to shock damage, for instance) the drive will attempt to initialise but will be unable to rotate due to seizure of the bearings. Sometimes, using specialised hard drive motor tools, our data recovery technicians can un-seize the spindle. Other times, the drive will have to be stripped down for motor assembly replacement or transfer of the platters to an identical drive.
Bad Sectors
Disk sectors are categorised as “bad” when read/write operations cannot be performed within a certain time threshold. Bad sectors can be either be “soft” or “hard”. Soft bad sectors can be easily erased and the same area of the hard drive can be used again. Meanwhile, hard bad sectors are areas on the platters that are in a “magnetically fixed” state. These cannot be erased and the area of the hard drive where they are located cannot be used again.
Platter Damage
The magnetic coating on the disk platters is liable to damage. If the surface of the disk platter gets scratched, the damage is sometimes irreversible. Even if a head swap is performed, the replacement heads will get damaged almost immediately. Platter damage can normally be identified as concentric rings or scratch marks on the platter itself.
Drive Head Failure
Prehaps some of the most delicate components of a hard drive are its drive heads. Most modern drives use what are known as Giant Magneto Resistive heads. These are mounted on sliders that are located on the tip of the drive’s actuator arm. They glide along the surface of the disk platters but do not actually touch them. (This is known as an air-bearing). The drive heads detect signals from the disk platters which are converted into digital signals. This process is known as Partial Response Maximum Likelihood (PRML). These digital signals are transmitted to the drive’s MCU where they are un-encoded. The average “flying height” of the heads above the disk platters is around 3 nanometers. A human hair, a piece of dust or even a fingerprint can be enough to interfere with the read-write process. For a standard 1TB drive, there are normally six heads mounted on the sliders.
A Western Digital drive head which had its heads “lifted” during an accidental fall.
Causes of Hard Disk Head Failure
Latent Failure – Hard drives undergo quality control before they leave the factory. However, some hard drives might have incurred some small defects during the manufacturing process which are not detected during factory quality control. Latent failures typically manifest themselves during the first 12 months of the drive’s life cycle.
Shock Damage – A common cause of drive head failure which our data recovery technicians come across is failure due to shock damage. Shock damage is usually incurred due to an accidental fall of an external drive or laptop. This can result in the heads violently parking on the disk platters and then being prevented from moving back to the parking zone. In other cases of shock damage, the heads will “lift” from the platters making read/write operations impossible.
Degradation Over Time – As a hard drive ages, the output signal delivered by the head to the drive electronics can diminish. When the signal becomes too weak the drive is unable to read or write properly. This can lead to data accessibility problems.
Thermal Asperity – When tiny particles get lodged or stuck under the drive heads, a process known as thermal asperity takes place. These particles can cause the heads to overheat the platters, due to friction effects, and can cause thermal or mechanical erasure of the data.
Electro Static Discharge (ESD) – The sensors on Giant Magneto Resistive heads are extremely sensitive to ESD events. Such events can cause sensor damage to the heads and in certain cases ESD will cause the delicate head sensors to melt.
Preparing a drive for Head Disk Assembly Replacement
Failed Preamplifier Chip
In some cases, the drive heads, electronics and mechanics will be all functioning correctly, but the signals from the heads will be attenuated to such a degree, they will not be readable by the drive controller. This can be an indication that the preamplifier chip mounted on the actuator arm has failed. The function of the preamplifier chip is to amplify the encoded signal from the platters so the drive’s MCU can read them more easily. Failed pre-amplifier chips are usually the result of “secondary damage” incurred by a power surge. Replacement of the complete head disk assembly is usually needed for a successful data recovery.
Quick Way to Identify Physical Failure
The hard disk will normally make a buzzing, humming noise or clicking noise. Or the drive will cause the host operating system to intermittently freeze or not respond.
Data Recovery Procedure for Physical Failure.
For drive head issues, it is sometimes possible to remap the drive heads without performing a Head Disk Assembly swap operation. This can save the client time and money. In other cases, where deemed viable, a HDA swap is undertaken in our clean-room.
ˆˆ back to top
Mini Case Studies
We were helping a Dublin based on-line betting company to recover data from an external drive. One of their database developers had bought a brand new hard drive for data backup as his old hard drive was nearing full capacity. The default format of the new drive was FAT32. However, he needed to transfer files larger than 4GB onto the new drive so he formatted the drive to NTFS. (FAT32 cannot handle individual file sizes of larger than 4GB). The only problem was during formatting, he still had the old backup drive plugged into his computer. He erroneously formatted the old drive instead of the new one. Our data recovery technicians rebuilt the entire NTFS file system. One hundred per cent of their recovered data was delivered to their Dublin office within 48 hours.
The owner of a Dublin physiotherapist practice contacted us. During renovation works in his surgery there was a power-surge. This “knocked out” a number of electrical devices in their clinic including their main file server. This contained all their Sage accounting files, .JPEG images of X-rays and a complete customer database. Their IT support company examined the 2TB Western Digital S-ATA drive and could not get it to initialise successfully. On closer examination, they could get a smell of burn off the drive and saw tiny scorch marks on the PCB. They recommended us for data recovery. Our diagnostics revealed that the MCU chip had been burnt. We sourced an exact-match replacement board. We then de-soldered off the U12 chip from the damaged drive. The U12 chip contains unique adaptive information needed for the heads to access the System Area and to calibrate with the platters correctly. Once the servo-adaptive parameters of the drive were configured we then imaged the drive. All of their data was successfully recovered.
A personal user in Dublin had over 6 years worth of photographs stored on a 2.5” Toshiba external hard drive. One day, when he connected the drive to his laptop, the familiar and reassuring Windows “device connect” sound never came on. Thinking it was just a glitch, he connected the drive to his desktop computer. But the drive, alas, was still not mounting. The drive contained irreplaceable photos of weddings, baptisms and, sadly, photos of a loved one who had passed away. He asked his local computer repair shop to recommend a data recovery company in Dublin. He brought the drive to us. Our diagnosis revealed that heads 0, 1 and 2 had failed. Once the client had authorised recovery, we replaced the Head Disk Assembly in our clean-room. We had an exact match HDA already in stock. The drive was then calibrated and imaged. We then extracted 98% of his photos onto a new USB external hard drive and presented it to a relieved and delighted customer.
