Data Recovery Scenario:
The client reported that while unplugging the drive from the USB port that resided on a shelf above the client’s desk the drive was dropped and fell approximately sixteen (16) inches. The client, realizing that this incident may have damaged the drive plugged the drive back in to see if the drive was recognized. Upon initialization the drive spun up, whirred a bit and then vibrated. The drive did show up in disk manager as “unallocated”.
Technicians initial response and diagnosis:
All drives that have had any type of sudden shock or impact are immediately given to a clean room technician for analysis. It is imperative that the drive not be powered up without a thorough examination of the external as well as the internal components of the drive. There are numerous complications that can ensue if in fact the drive is powered up before the examination has been completed. In this particular case there is a high probability that the read write heads would be dislodged and or misaligned and if the drive is powered on can in fact scratch the surface of the drive and make a complete recovery virtually impossible.
After the inspection of this client’s drive it was found that head one (1) of an eight (8) drive head stack was dislodged (See Figure 1). Although the heads were in the park position one can see that if the drive had been powered on then the offending head could have in fact scratched the platter.
Figure 1
Accessing the drive interface:
This particular model of drive is a standard USB 3.0 drive and as such the USB interface is part of the PCB. In order to get access to the IDE interface and be able to issue ATA commands which are necessary for this particular type of recovery the PCB must be modified. The modification includes ensuring that the firmware and head mapping operations are the same as the original USB board. Upon completing the construction of the new interface board (See Figure 2) the drive is powered on to confirm that there is a clean and unencumbered communication path from the board to the IDE interface.
Figure 2
Replacing the damaged heads:
We now have a drive that can be accessed through a low level IDE interface and issued ATA commands. In order to access the data on the drive it is necessary to replace the heads that were damaged when the drive was dropped. To do that the full head stack must be replaced by a trained clean room technician. In addition, the parts must be purchased that are to be used to do the actual replacement.
In the world of clean room data recovery finding parts is an art form in and of itself. Although this is a Western Digital drive we cannot simply call the parts department of Western Digital and ask for a new set of heads for this particular drive model and firmware version.
A ‘donor’ drive must be used so that the technician can cannibalize the parts from the drive and reuse them in the damaged drive. The following is a list of possibilities for our donor drive.
Ebay: $80.00 – Same model number, but no firmware match
Donor VAR: $300.00 – with firmware match
Ebay: $146.00 – External enclosure and SKU number match
These parts prices are times two (2) at the very least. It has been our experience that all dropped drives will need at least two sets of heads. We opted for the External Enclosure and purchased the drives. Due to the DTI policy of ‘No Data, No Charge’, there are times when we purchase parts and still cannot get the data. DTI Data absorbs that cost. In this case the External Enclosures were a good match and we used the heads for the recovery.
Cloning the drive:
We have changed the interface, we have changed the heads and are now ready for the cloning of the drive. It is important to note that the cloning settings are finely tuned to avoid slow reads in order to prevent further damage to the platter surface and/or the replacement heads. The cloning process is a multi-phase function that entails the following. There is a quick initial pass that catches all of the data that is easily read through high speed DMA. During this phase a technician must be present and pay close attention while the cloning is underway. Although, head one (1) was visibly damaged it is also possible that there were other heads that may have impacted the platter surfaces. If a drive is left unattended during the cloning process and there are slow reads and or bad reads the technician must immediately evaluate if that area of the drive should continue to be queried for data or move on to another area. This fine tune tweaking by a highly trained technician can make the difference between a full recovery or a drive so damaged that all data is lost. This particular process in many cases is the most critical for a successful recovery. Once the first pass is completed then a more strenuous labor intensive pass is made in order to pick up any sectors that did not get read during the DMA pass. This phase of the cloning must also be monitored and closely watched. Finally, a third pass is made only if the file system is missing data. The third pass is not always necessary but is an integral part of a clean data set.
Data and file system integrity:
We now have a clone that we can mount as a full file system to see if the data that we have recovered is in fact the data the client is been looking for. With each Work Order Request form we ask the client to list the folders that are most important to them in order for us to make sure that those folders are in place and contain the proper data. In addition, certain data types are spot checked in order to make sure that the data is usable. As an example, a photographer may have a particular wedding that they need to have recovered. DTI Data will look in that particular folder and mount the photos in the aggregate in order to verify that the data is usable. In addition, DTI Data has developed its own set of tools to evaluate the full data set and offers that report to the client for evaluation.
Outcome:
After all of the steps were completed DTI Data and its technical stuff made a full recovery of this particular job. Many steps, many tools, and years of recovery expertise went into this particular recovery. DTI Data Recovery takes pride in all of the work we do and always remains cognizant of the fact that this is our client’s data.
Update – Western Digital My Passport and Easy Store portable drives now use Shingled Magnetic Recording (SMR). The recording method drastically changed they way the way the hard drive translates and read and writes data. My Passports and Easy Store drives are now also encrypted via Printed Circuit Board (PCB) MCU. The level of difficulty to recover new versions of these drives has increased dramatically. Details will to come in a future post.
