Data recovery from a drive with physical defects within the firmware Service Area, unrecoverable using

Transcription

1 SalvationDATA Data Recovery Example Application: Image from the HDD with serious bad sectors in the Data Area by Data Compass What failures can Data Compass help to solve? 1.Logical Malfunctions Partition Loss File loss or destruction Virus attack Accidental formation Accidental deletion or clone 2. Physical malfunctions Data recovery from a drive with physical defects within the firmware Service Area, unrecoverable using conventional processes. (Note: IBM/Hitachi drives are currently supported and other brands will come with this feature in the near future) Data Recovery from drives with severe defects in the firmware service area using hot swap by Data Compass Based on that the data area can be accessed by DC and DC can recover data from "clicking" drives caused by poor performance of the Read/Write head assembly or degraded magnetism of the servo information on the platter surface. Data recovery from drives with a wide distribution of bad sectors where Logical Recovery software has been unsuccessful. Data recovery from drives with multiple bad sectors or unstable read caused by poor head exchange Data recovery from drives whose heads or motors are unstable Recover target data fast when there are multiple bad sectors or unstable read or bad sectors caused by poor head replacement. For hard disk image, DC is the best choice. What malfunctions Data Compass cannot handle directly To drives with very severe or complete physical damage, DC cannot recover data directly. The following are some examples: PCB burnt Complete head or motor damage Severe scratches on the disk data areas The HDD was overall cleared or the target data area was covered. The data in the data area cannot be viewed by DC Firstly, Let's examine the disk by its appearance to find out if it was stroke or disassembled. You may ask the customer for detailed information or check if the screws were twisted off. These physical examination on the patient disk is very important and necessary before connecting to power. Because some physical damages to disks are fatal and unrecoverable.

2 What the HDD indicates: Connect this HDD with the PC as slave disk, turn on the power and the relative disk parameters can be recognized correctly under COMS; however, it's too slow to enter the OS normally and we turn off the power and start the OS first. After this, we connect to the PC by the USB port, we see the mouse lose control and all programs stopped. The OS appeared as crashed like the picture below: Bypassing the OS and scan the bad sectors of the slave disk From the scan, we know there are a lot of Red and Green squares and "B" symbolizing a wide distribution of bad sectors. 'Green square' means low access speed while 'Red square' means reading difficultly. 'B' means where there are bad sectors or errors. We have discussed it is impossible to recover data from slave mode. Because when the OS is started, it will detect all the hard devices and only if the hard drive is found, all the partitions will be read. Once there or crash. re bad sectors, the bad sectors will be read round and cause the whole system to stop working

3 To this situation, we will recover data from the patient disk by image method with DC. Let's connect as following: Start the DC Panel and enter The 'Hardware Control' Panel. Turn on the power and wait until the 'HDD Status' indicates 'Ready

4 Usually, it's suggested to turn off the read function to patient disk by the 'Read' button on the DC console. This is done to avoid the slow reading to patient drive with multiple bad sectors when starting the program. After we enter the DC panel, we can turn on the 'Read' function manually. Turn on the 'Read' function, DC can then access the patient disk and read data there now. Click "Total LBA" and get the real capacity from the HDD. If the HDD has been serious damaged, please manual input the HDD LBA instead of click the "Total LBA" Here, it is suggested that you need change the LBA manually. Normally, the detected drive can automatically read the LBA once it is loaded; while the drives which have SA error can't be loaded correctly and the LBA can't be read automatically. Then it will reveal the default LBA Special explanation here: if the hard drive cannot be read normally, then users please change the LBA to the real capacity of this drive. That is because if the default LBA is smaller than the real capacity, the program only can read the contents out of the defined LBA. For instance, supposing an undetected 500G drive, after SA Emulation, if we didn't change the LBA manually, then the program will only read out the front128g contents, the latter will not be read. Whereas, if the default LBA is larger than the real capacity, change or not both will be insignificant as the latter LBA will be blank. "Enable Write" controls the writing operation to the source HDD. It is very important to keep the original data on the Source HDD. Data Compass reserves the writing operation to the source HDD, but needs satisfy two conditions: 1 Turn on the "Enable Write Function" 2 Shut down the "ShadowDisk Function", because when the ShadowDisk Function is running, the data will be wrote on the ShadowDisk instead of be wrote on the source disk. In general, we don't suggest you directly write data on the source disk. "Enable UDMA" controls the reading mode to the source disk. PIO is the default mode. Turn on the function; it will be changed to UDMA mode. UDMA is the high speed reading mode. To the HDD which has serious bad sectors, please choose the PIO mode

5 The program provides multiple settings to control the source HDD bad sectors reading, including: Waiting for readiness time; Retry times; Soft Reset times, Hard Reset times and Power supply Reset time. Waiting for readiness time: sector reading time can't exceed the defined waiting for readiness time. If it exceeds the waiting for defined readiness time, the system will identify the data reading unsuccessful and return as 0X40 Retry time: in order to gain the data from this sector after the unsuccessful reading within the waiting for defined readiness time, we should set the retry times to read this sector again. The longest time per reading will not exceed the waiting for readiness time. Soft Reset Times: It can't gain the data successfully after many times reading, and also it can't get the response/can't gain the data successfully on next sector reading. The system will automatically carry out the soft reset operation send out the reset command. Hard Reset times: The HDD also can't get the response after achieve the soft reset times. Data Compass will send out an electric single to do the hard reset without cut off the HDD electricity. Power supply Reset times the HDD also can't get the response/can't be ready after achieve the hard reset times. Data Compass will do the power supply reset. The power supply reset will stop the electric power supply to the HDD, and then turn on the electric power supply to the source HDD. For average users, they do not need to care for the problem of parameters setting, they only need to use the default setting. Unless the defective HDD have a severe physical problem, then you can change the default setting to a more reasonable one by using your data recovery experience. All these default settings are the desired result of large number of studies and operations which have been done by SalvationDATA's engineers, it is suggested to use them for those ordinary cases Select "Default setting" first, and then click "save", it will effective soon after restart Now you can set hidden LBA into 0, it means Data Compass will work from the first section C/H/S 0/0/1. Also you can set any LBA as long as it is smaller than the entire HDD LBA, then all the hidden HDD section will be skipped and will start reading from this LBA. If the defective HDD has severe physical problem, it is recommended to hidden the first section to avoid the operating system being stuck.

6 After setting the parameters, you can switch to Sector View interface and inspect the content of any section. Once you input any LBA in DEC or HEX (DEC means Decimal number, HEX means hexadecimal), system will automatically show a corresponding numerical in another frame If the data are all shown as 4040, then it means the current sector is corrupted. It is because that if the data cannot be read out, the system will define it as If the data we see are not 4040, and we can read the content, then we can use Data Compass Explorer (Abbreviation: DCEXP) to copy the data. Press DC Explorer or double click the DCEXP.EXE file in the installation directory, this program will be launched automatically.

7 After accessing the DCEXP interface, we need select the File Recovery panel. You can view the partitions and the file directory from this panel, which is called the most vivid way for data view. Click "Open Disk", the logical data recovery software will read all the logical partitions in this drive.

8 We can see all the partitions in a while due to the layered scan technology of DCEXP. It will first scan the root directory which can highly shorten the directory read time. Then users can do a selective data recovery for the usable and important data. One layer to another, this maximally saves the working time. At the same time, you can directly extract the files or you can do a whole image. During the data recovery, it allows users to image data fully from the source drive, partition, or any LBA area. As a target, it can reach far to files, or disk. There are also some handy functions like fast clockwise, fast reverse, exact clockwise and exact reverse functions for you to choose flexibly. Meanwhile, it can also allow recovering data fast and effectively from any bit of data via "Bitmap Technology". All the read partitions will be listed in the left column. Showing the information of the partition or not can be controlled by clicking "+" or " ". Shown as the above picture, this defective drives has three partitions. As told by customer, the most important data is stored in the third sectors. Its content is: NTFS LBA SIZE =15005MB This means the file system of this drive is NTFS, the start is sectors, and the size is 15005MB. Right click this partition and choose the third line "Image Partition" in the pop menu, namely, to image this partition. Additionally, right click DCHDD and select "image Partition", then it comes to the "whole hard drive image".

9 Then you can see the pop window for you to set the imaging tool. Check below: DCEXP has already calculated the start LBA and the size. This saves a lot of time for the future process. In right Target setting panel, you can select the Target to file or to disk. Imaging to a disk can use together with "Image Data Area Only". By this cooperative use, DCEXP can automatically judge and calculate the place of effective data, then image only to this part. A lot of time has been saved and the working efficiency is enhanced.

10 In this case study, the effective data is imaged to a connected external WD 120G HD. When clicking "Create Task" to execute the image command, a window will pop up and shows "Creating Bitmap, please wait ". Please note that when imaging the effective data, it may take some time to be responded, please wait patiently then till the image is complete. Besides, when imaging effective data, it doesn't mean the capacity of target should be larger than the effective data. It is because while creating the Bitmap, it will allocate the size according to the partition (not the disk). So please make sure that the capacity of the target disk is larger than the partition where the effective data stored. Till the Bitmap is created successfully, it will redirect to the next screen. Please click "Start" button and begin imaging. There are parameters of image which you can select on the left "Set Up" panel: Block Size, Timeout (MS). Also you can choose" Known Bad Sector Retry" option and it can work together with the "Retry Times" in the Data Compass Panel menu.

11 On the right upper panel, the default setting is that the four options are selected: quick obverse image; quick reverse image; intensive obverse image and intensive reverse image. While running the DC Explorer, it will image according to the default setting: quick obverse image and skip the bad sectors, then quick reverse image till find the bad sector again. After the quick obverse and reverse image both are completed, for the non retrieved bad sectors, the program will make another the intensive obverse and reverse images. In the process of image, it can show LBA value of any sector by left clicking on any sector on the disk map.

12 By right clicking on the disk map, there will show up 3 options menu: Lock HDD map, Used count and Sector Skip. "Lock HDD map can stop scanning statistics map and save the operating system resource; Used Count can figure out how much percent of the effective of the partition while the last option "Sector Skip" indicates the real time image status. As you can see the screenshot below: You can see clearly the status of obverse and reverse image from the picture below. The target sectors which are not read yet, the failed read sectors are marked as red and bad sectors as blue. The other colors mean the different sector respond time. After the image finished, you can use logical data recovery programs to scan and check the data. ( To protect client's privacy, mosaic is used.)

13 So far, the complete data recovery process is done and retrieve the data! Data Compass is a professional data recovery tool and we have the complete intellectual property rights for this equipment. It is not only designed to solve the logical malfunction, but also more lean to recover data from defective HDDs which have physical malfunction. Such as physical damage on sectors, read instability, and firmware corruption The purpose of our development is to change the traditional data recovery ideas and methodib Today, the 21st century, we are in a data era more than information era. User's data volume is rapidly increasing along with upgrading of storage products. The HDD 80G, 120G, 160G, we all thought it was enough for use not long ago, is disappearing With the tremendous growth of electronic data, our file container is becoming empty. However, on the other hand, followed by this, there is more chance to lose data stored in media. Furthermore, as the density of media becoming higher and higher, the need of data recovery cannot be met by the traditional data recovery method For example a 500G hard drive, and the ordinary imaging speed is 2G per minute, it will at least take 4 hours to complete imaging work. If the defective hard driver with severe physical problem, the time of imaging will be unable to calculated. Data Compass applied with 9 patent technologies, especially with Shadow disk technology and SA emulation technology which laid solid foundation for directly extracting data from defective HDD, it is greatly improve the data recovery success rate and efficiency Data Compass will change the traditional data recovery mode, and represent a new data recovery trend