Sunday 23 June 2013

Hardware repair in data recovery



A common misconception is that a damaged printed circuit board (PCB) may be replaced during recovery procedures by an identical PCB from a healthy drive. While this may work in rare circumstances on hard drives manufactured before 2003, it will not work on newer hard drives. Each hard drive has what is called a System Area. This portion of the drive, which is not accessible to the end user, contains adaptive data that helps the drive operate within normal parameters. One function of the System Area is to log defective sectors within the drive; essentially telling the hard drive where it can and cannot write data. The sector lists are also stored on various chips attached to the PCB, and they are unique to each hard drive. If the data on the PCB does not match what is stored on the platter, then the drive will not calibrate properly.In most cases the hard drive heads will click, because they are unable to find the data matching what is stored on the PCB.

Recovery techniques



Recovering data from physically damaged hardware can involve multiple techniques. Some damage can be repaired by replacing parts in the hard disk. This alone may make the disk usable, but there may still be logical damage. A specialized disk-imaging procedure is used to recover every readable bit from the surface. Once this image is acquired and saved on a reliable medium, the image can be safely analyzed for logical damage and will possibly allow much of the original file system to be reconstructed.

Physical damages during data recovery



A wide variety of failures can cause physical damage to storage media. CD-ROMs can have their metallic substrate or dye layer scratched off; hard disks can suffer any of several mechanical failures, such as head crashes and failed motors; tapes can simply break. Physical damage always causes at least some data loss, and in many cases the logical structures of the file system are damaged as well. Any logical damage must be dealt with before files can be salvaged from the failed media. 

Most physical damage cannot be repaired by end users. For example, opening a hard disk drive in a normal environment can allow airborne dust to settle on the platter and become caught between the platter and the read/write head, causing new head crashes that further damage the platter and thus compromise the recovery process. Furthermore, end users generally do not have the hardware or technical expertise required to make these repairs. Consequently, data recovery companies are often employed to salvage important data with the more reputable ones using class 100, dust- & static-free cleanrooms.

Monday 25 February 2013

Data recovery



Data recovery is the process of salvaging data from damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally. Often the data are being salvaged from storage media such as internal or external hard disk drives, solid-state drives (SSD), USB flash drive, storage tapes, CDs, DVDs, RAID, and other electronics. Recovery may be required due to physical damage to the storage device or logical damage to the file system that prevents it from being mounted by the host operating system.


The most common "data recovery" scenario involves an operating system (OS) failure (typically on a single-disk, single-partition, single-OS system), in which case the goal is simply to copy all wanted files to another disk. This can be easily accomplished using a Live CD, many of which provide a means to mount the system drive and backup disks or removable media, and to move the files from the system disk to the backup media with a file manager or optical disc authoring software. Such cases can often be mitigated by disk partitioning and consistently storing valuable data files (or copies of them) on a different partition from the replaceable OS system files.

Remote data recovery



It is not always necessary for experts to have physical access to the damaged drive; where data can be recovered by software techniques, they can often be used remotely, with an expert using a computer at another location linked by an Internet or other connection to equipment at the fault site.
Remote recovery requires a stable connection of adequate bandwidth. However, it is not applicable where access to the hardware is required, as for cases of physical damage.

Physical damage



A wide variety of failures can cause physical damage to storage media. CD-ROMs can have their metallic substrate or dye layer scratched off; hard disks can suffer any of several mechanical failures, such as head crashes and failed motors; tapes can simply break. Physical damage always causes at least some data loss, and in many cases the logical structures of the file system are damaged as well. Any logical damage must be dealt with before files can be salvaged from the failed media.
Most physical damage cannot be repaired by end users. For example, opening a hard disk drive in a normal environment can allow airborne dust to settle on the platter and become caught between the platter and the read/write head, causing new head crashes that further damage the platter and thus compromise the recovery process. Furthermore, end users generally do not have the hardware or technical expertise required to make these repairs. Consequently, data recovery companies are often employed to salvage important data.

Recovery techniques

Recovering data from physically damaged hardware can involve multiple techniques. Some damage can be repaired by replacing parts in the hard disk. This alone may make the disk usable, but there may still be logical damage. A specialized disk-imaging procedure is used to recover every readable bit from the surface. Once this image is acquired and saved on a reliable medium, the image can be safely analyzed for logical damage and will possibly allow much of the original file system to be reconstructed.


Hardware repair


Media that has suffered a catastrophic electronic failure requires data recovery in order to salvage its contents.
A damaged printed circuit board (PCB) may be replaced during recovery procedures by an identical PCB from a healthy drive; this does not necessarily work, as data specific to an individual drive unit may be stored on a chip, so that even boards manufactured to be identical may not work on a drive mechanism for which they are not set up.

Corrupt partitions and filesystems, media errors


In some cases, data on a hard drive can be unreadable due to damage to the partition table or filesystem, or to (intermittent) media errors. In the majority of these cases, at least a portion of the original data can be recovered by repairing the damaged partition table or filesystem using specialized data recovery software such as Testdisk; software like dd_rescue can image media despite intermittent errors, and image raw data when there is partition table or filesystem damage. This type of data recovery can be performed by people without expertise in drive hardware, as it requires no special physical equipment or access to platters. Sometimes data can be recovered using relatively simple methods and tools; more serious cases can require expert intervention, particularly if parts of files are irrecoverable. Data carving is the recovery of parts of damaged files using knowledge of their structure.