2025-05-06

Hard Disk Details(11)

DATARECOVERYUNION.COM07 mins

Random Notes and Ideas For Data Recovery

    1. Drive goes to sleep, replace the board live
    2. Partitions start on Cylinder Boundaries
    3. Hard Drives have a Safe Mode
    4. You can fix LaCie problems with a Mac mounting them in the system
    5. Drives that you plug in that cause windows to Crash – Use Ubuntu to Read Files
    6. When problems with MFT then retry smaller blocks
    7. If drive parts are good then rewriting the SA area is the part that needs repairing
    8. SA Code can be replaced to do data destruction or encryption
    9. If you are thinking of a hard drive as 0’s 1’s then you are wrong. The equipment interprets signals to make the representation of 0s or 1s. Designers have taken into account the signal distortion and interface problems to make the work
    10. Remove a chip from the PCB and re-solder the chip onto a good board to fix specific problems with chips that are burned, cracked, etc
    11. Soft resets on SATA also need to do a hard reset the controller as it cannot be reset any other way like the bus is reset in a PCI or ATA
    12. ATA-3 Spec – hard drive read without retry was disabled and now is internal on the drive
    13. Seagate Drives use a serial interface of which you can find online. It will show you stats on the drive. If you see FFFF mask FFFF mask it is a head error
    14. If a drive is read with a standard read then it does not need to be read again but it might be good to use ECC to compare in a later pass
    15. Force the drive to use PIO mode instead of DMA/UDMA modes. Some hard drive failures cause the drive to fail reading UDMA but might still work in PIO
    16. Powers on good drive, while board is still in use move it to a new drive. Wrong defect tables and can be cleared
    17. If the platters are misaligned you can write data over the servo wedge and thereby destroying any chance that you can ever read the data
    18. As the thermal heat increases stability of the bits drop rapidly and with the addition of Areal density – degradation is much higher. There are fewer atoms in each bit to retain the bit orientation. Currently the drive will test for decay and if detected will automatically rewrite the data it detects
    19. Hard drives stored in heat for long term storage is extremely bad
    20. Adaptec ATA Raid 1200A Controller in combination with MHDD is great for recovery software.
    21. To determine if there is an HPA – Look at the LBA Maximum and if it is equal to Maximum Native LBA then there is no HPA
    22. Partitions created using standard disk partitioning tools, fdisk, Windows Disk Management, Partition Magic, will all be cylinder aligned. You only have to scan cylinder boundaries for partitions. Dynamic disks do not use partition tables, they use LDM which is at the end of the disk and needs to be done backwards. It uses one single partition occupying the entire disk minus one cylinder. When volumes are added or deleted the partition table is not updated. There are only 4 partitions possible with the standard Windows tools
    23. All partition table signatures end in 55 AA – if this is gone the OS will regard this as not existing. 80 is active 0B fat32 0F extended
    24. Everything in NTFS is a file – $boot
    25. Sector is the smallest addressable unit on the disk. You can read more than one sector but you cannot read less
    26. If doing a head replacement try straws for head stack replacements around the heads to keep them protected. Cut off a small piece of a drinking straw and place it over the head area of each and every head
    27. Even when the lower part of a head stack does not have heads they are still numbered.
    28. Increasing numbers of drive have no chance for parts replacement due to changes in the hardware
    29. Some drives store the lists in the NV Ram on the PCB. The table on one drive will not match the table on another drive and are unique. That might cause the same logical blocks to be mapped to different physical blocks on different hard drives. It is possible to have a swapped board cause a space on the hard drive to be overwritten due to the mapping problem.
Read More

Gigabyte to Terabytes

DATARECOVERYUNION.COM02 mins

For fun, here is a comparison of some old storage media with something in our data recovery lab right now.

Gigabyte-to-Terabytes

On the left is an IBM 3380 ‘direct storage access device’ circa 1980. Capacity: 1 GB. On the right, a RAID recovery on one of our lab workbenches, set up in a couple of storage cases.
Capacity: 48 TB.

The cases and the old IBM device are about the same size… ~30cm across, but of course 30 years difference.

Gigabyte:

The gigabyte is a multiple of the unit byte fordigital information storage. The prefix giga means 109 in the International System of Units (SI), therefore 1 gigabyte is1000000000 bytes. The unit symbol for the gigabyte is GB or Gbyte, but not Gb (lower case b) which is typically used for the gigabit.

Terabytes:

The terabyte is a multiple of the unit byte digital information. The prefix tera means 1012 in the International System of Units (SI), and therefore 1 terabyte is 1000000000000 bytes, or 1trillion (short scale) bytes, or 1000 gigabytes. 1 terabyte in binary prefixes is 0.9095 tebibytes, or 931.32 gibibytes. The unit symbol for the terabyte is TB or TByte, but not Tb(lower case b) which refers to terabit.

Read More

Scp from remote Linux to local Windows with spaces in local path

DATARECOVERYUNION.COM04 mins

To push a file from a Linux terminal to a Windows system, the following two examples work just fine. scp /home/user.name/file.html user.name@local.ip.num:/C:/Users/user.name/test_folder/file.htmlscp /home/user.name/file.html user.name@local.ip.num:”/C:/Users/user.name/test_folder/file.html” I need to do this where the local folder has spaces and I cannot change the name, say /C:/Users/user.name/test folder/ All of the following fail with the message scp: ambiguous target…

Read More

Guideline for Diagnostics – Data Recovery

DATARECOVERYUNION.COM06 mins

This is intended to be a guideline for determining whether a hard drive is failing physically or if the drive is a candidate for software recovery by technicians in the field.

There are many commercial utilities that will allow users or qualified technicians to recover data from a hard drive that is otherwise inaccessible. Commercial utilities work with varying degrees of success. The question to be asked is when is it a good idea to use these utilities versus when is a good idea to send the hard drive to Data Recovery Group?

The first step is to determine if the hard drive is functioning. If the hard drive is functioning properly it should be recognized in the CMOS and you should be able to boot the system from another media source, such as a floppy, CD-ROM, or another hard drive. If there are any BIOS errors when attempting to boot the system the hard drive has malfunctioned and needs to be sent to Data Recovery Group. If during the boot process the system is unable to boot from an alternate media source, this is another indication that hard drive is malfunctioning. Further attempts to boot the system could seriously reduce the likelihood of a successful data recovery.

If the system can be successfully booted the next step is to attempt to run the data recovery utility. Most utilities work in the same way. The first step the data recovery utility performs is to scan the drive to locate the file system components. Most utilities will display this scan with some type of progress meter. It is necessary to monitor progress and to stay with the hard drive while the utility is operating. If the hard drive starts to make unusual noises stop the scan immediately and power down the computer. The hard drive will need to be sent to us. Another thing that needs to be watched is the rate of progress for the utility. Usually there will be a count of sectors read. The count should steadily increase and it should not stop. If the count or progress does stop the scan should be terminated and the computer powered down. Failure to stop could jeopardize the likelihood of a successful data recovery. The hard drive should be sent to Data Recovery Group.

If there are any signs that the hard drive is failing physically, it is important that software data recovery utilities not be used on the hard drive. Hard drives usually fail gradually and this failure process will be accelerated during a full scan of the hard drive necessary for most data recovery utilities to recover the data.

It is important to read the instructions provided with any data recovery utility you may use on a hard drive. It is important that if you can complete a scan of the failing hard drive that the recovered files are not saved back to the hard drive you are trying to recover. It is possible o save recovered files on the source drive and if this occurs the recovered files could overwrite other files you are trying to recover.

In conclusion, it is very important to determine if a drive has any physical failure before attempting to recover the data using a utility. Data Recovery Group has received many hard drives from customers where the data could have been recovered had we received the drive right after the original failure. Repeated attempts to recover the data with software rendered the drive useless and the data not recoverable.

Read More