|
 In order to better understand the data recovery process, it may be helpful to
learn a bit about how hard drives physically work.
Hard drives store data magnetically on glass or aluminum disks, or "platters."
Every few years, the capacity of hard drives goes up due to new advances in data
storage technology; current drives usually store from 40-500GB of data, though
drives that store up to 1 terabyte (1,000GB) of data are available and larger
hard drives are expected by the end of 2007.
A spindle spins the platters under read/write heads, which are able to
magnetically write and read the data which is stored on the magnetic surface of
the hard disk platters. While in operation, the heads of the drive never
actually come into contact with the hard drive's platters unless the drive
suffers a fairly severe physical failure; rather, they float slightly above the
platters while reading, writing, and seeking information.
The heads of a hard drive can move back and forth across the surface of the
platters at extremely high speeds in order to seek specific sectors of data.
They're also extremely precise, and read and write data at blindingly fast
speeds. Because the heads of the hard drive are so sensitive, it's important
that hard disks aren't subjected to large amounts of physical shock that may
cause them to become damaged or misaligned.
The PCB or logic board (the green electronics board on the bottom of the drive)
of a hard drive is the electronic board the controls the flow of data between
the computer memory and often contains critical information that the drive needs
to function properly in the form of
specialized microcode. This information is often specifically programmed to the
board of the drive during the drive's construction to meet each individual
drive's specifications.
In addition, much more microcode is located within the service area of a hard
disk's platters. In fact one side of a platter is specially reserved to store
information about the drive. The information contained in the system or service
area of the hard drive are as follows:
Relational information about the drive's heads. The drive must be programmed so
its heads can work together. slight differences between drives make this
information unique to every hard drive. Factory-born defects contained on the
drive (often called a P-list). Again, this information is unique to every hard
drive. According to data recovery experts, the chances of two 300GB drives
having the same factory defect table is roughly one in 500 trillion. Just one
lost defect from this table and your data will not be recoverable unless you you
contact a data recovery company such as Data Recovery Lab who have the
expertise to recover the lost data.
 A list of sectors that have gone bad since you owned the drive (called the
G-list). While not as critical, a misappropriated or "bad" sector can cause your
data to become temporarily inaccessible. This should be recoverable by any
competent data recovery company.
The zone table of the drive also contains critical information tells the CPU
about the density of data on the platter as the heads move from the inner part
of the platter to the outer edge. Heads map tells the drive in what order it
should use a disk head, and also how many heads there are in the drive. SMART
log keeps track of operating specs, and flags the BIOS when failure is imminent.
In recent years, hard drive manufacturing companies have researched ways to
safely spin platters at extremely high speeds, currently up to 15,000 RPM. These
incredibly high speeds help reduce seek time and increase the rate at which data
is read by the hard drive and sent to the CPU. The higher speeds are also
concurrent with a move to scale down the physical size of hard drive components;
this allows for better and more secure data storage.
When a hard drive fails, one or more of the physical components of the drive are
usually to blame. By getting the drive to an operational state long enough to
copy data off of the hard drive's platters, data recovery technicians are able
to maintain a high rate of recovery without risking any sort of damage to the
hard drive.
What is data recovery?
Data recovery is the process of salvaging data from damaged, failed, wrecked or
inaccessible primary storage media when it cannot be accessed normally. Often
the data is being salvaged from storage media formats such as hard disk drive,
storage tapes, CDs, DVDs, RAID, and other electronic storage devices. This can
be due to physical damage to the storage device or logical damage to the file
system that prevents it from being mounted by the host operating system. Data
recovery can also be the process of retrieving and securing deleted information
from a storage media for forensic and investigation purposes.
Physical damage:
A wide variety of failures can cause physical damage to storage media. CD-ROMs
can have their metallic substrate or dye layer scratched off; hard disks can
suffer any of several mechanical failures, such as head crashes and failed
motors; tapes can simply break. Physical damage always causes at least some data
loss, and in many cases the logical structures of the file system are damaged as
well. This causes logical damage that must be dealt with before any files can be
salvaged from the failed media.
Most physical damage cannot be repaired by end users. For example, opening a
hard disk in a normal environment can allow dust to settle on the surface,
causing further damage to the platters and complicating the recovery process.
Furthermore, end users generally do not have the hardware or technical expertise
required to make these repairs; therefore, a data recovery company such as Data
Recovery Lab are consulted to salvage the data using specialist tools.
Data recovery specialists often use
Class 100 clean room facilities to protect the media while repairs are being
made. The extracted raw image can be used to reconstruct usable data after any
logical damage has been repaired. Physical recovery procedures include removing
a damaged PCB (printed circuit board) and replacing it with a matching PCB from
a healthy drive (this often entails the movement of a
microchip from the original board to the replacement), changing the original
damaged read/write head assembly with matching parts from a healthy drive,
removing the hard disk platters from the original damaged drive and installing
them into a healthy drive, and often a combination of all of these procedures.
All of the above described procedures are highly technical in nature and should
never be attempted by an untrained individual and must only be entrusted to a
trained data recovery technician.
Logical damage:
Far more common than physical damage is logical damage to a file system. Logical
damage is primarily caused by power outages that prevent file system structures
from being completely written to the storage medium, but problems with hardware
(especially RAID controllers) and drivers, as well as system crashes and or
electro-static discharge (ESD), can have the same effect. The result is that the
file system is left in an inconsistent state. This can cause a variety of
problems, such as strange behaviour (e.g., infinitely recursing directories,
drives reporting negative amounts of free space), system crashes, or an actual
loss of data. In these cases, the disk space is identified by the Operating
System as "unallocated space". This means that the logical structure or logical
format of the drive has been destroyed and consequently data is lost. Data
recovery technicians often use disk editors to correct the logical structure of
the data and make the drive accessible to the Operating System.
Some types of logical damage can be mistakenly attributed to physical damage.
For instance, when a hard drive's read/write head begins to click, most
end-users will associate this with internal physical damage. This is not always
the case, however. Often, either the firmware on the platters or the controller
card will instead need to be rebuilt. Once the firmware on either of these two
devices is restored, the drive will be back in shape and the data will be
accessible. Data recovery specialists use special tools which operate the hard
drive in safe
mode enabling them to reconstruct or update the hard disk firmware.
|
