Recently, we received a Toshiba clicking hard drive data recovery that would spin, initialize and report an ATA ready status; however, when trying to access the data, the drive would click and hang the operating system during boot then display the ‘blue screen of death’. We tested the read write heads individually to pin point which read/write head was failing.
In this case, the hard drive had two read write heads, head 0 and head 1. After our testing, we found head 1 was no longer functioning. This would explain why the hard drive was still recognized because head 0 is the only one that needs to be read to display the hard drive model and size from the System Area and report to the system BIOS of the computer.
We attempted to make a sector by sector mirror image or clone of the hard drive with manually configured read times and jump sector spaces with head 1 disabled. The jump spaces from extended read times was necessary during this process to avoid areas of the platters which may have been damaged by impact from the read write head.
Once this process completed, we had a complete image of the drive but with only one head and one side of the platter imaged. This case then went into our clean room for read write head replacement so we could access head 1.
The read write head replacement was successful and the drive was imaged once again with head 1 activated to fill the gaps in our cloning process. After cloning about 30% of the drive, the read write head encountered a damage area on the platter and started to show multiple jumps in cloning and began to click. The cloning process was immediately halted as to not cause any damage to the new read write heads that we had just installed.
To recap, at this point we had a clone of the entire drive with head 0 and 30% of head 1. This was good news as we knew that we had imaged important information such as the Master Boot Record (MBR), the Boot Sector (in this case 63) and the Master File Table (MFT). On further inspection of the hard drive’s MBR we found reference to Bit Locker encryption and found the hard drive was encrypted.
We then continued the cloning process, but this time in reverse, from the end of the hard drive towards the 30% we had already cloned. This went smoothly until about 32%, and then the drive started to show the same behavior as earlier, clicking and attempting sector jumps. At this point we had 98% of the hard drive cloned and this was the last area of the hard drive required. We had to force a read of the remainder of the hard drive.
Hours later the drive was clicking immensely. The result was complete platter damage stripping 100% of the hard drives magnetic surface from the platter leaving the bare glass platter behind. The good news is that the requested data was recovered successfully.
If we had not taken the proper precautions and steps required to recover the majority of the data before forcing the drive to read, the data would not have been recoverable.
By recovering all that was possible before attempting to access the damaged area we increased the chance of clicking hard drive data recovery.
In the wrong hands, this case could have easily turned out a lot different and in many instances such as this one, you only have one chance at data recovery.
Nice job!