Recover data from a defective Fujitsu desktop drive

Transcription

1 Data Compass - Case Study Recover data from a defective Fujitsu desktop drive Symptom: Data on the Fujitsu desktop drive is not accessible directly by the client. The initial diagnosis implies that the drive suffers from a logical failure, as the drive is detected and not clicking. The drive details are: Model: P/N: MPE3102AT CA05367-B803000N Firmware: Diagnosis of the drive using conventional procedures found the drive to be detected by the computer but with an error message, as show in the picture below. Further diagnosis using Recovery Studio showed that the drive is detected by the studio, as shown in the picture below: 1

2 This is a common failure with drive suffers severed bad sectors problem either in the boot sectors or data area. There s no way to move forward unless we clone the drive by cloning tools. Solution: There are two types of bad sector failures, namely logical bad sectors and physical bad sectors. Logical bad sector failures are very easy to deal with using specialist recovery tools. Physical bad sectors arise from damage to the magnetic surface of disks, caused by scratches, cracks, particles and so on. This may be the result of the Read/Write Heads falling on the disk surface, usually referred to as a head crash. Media degradation due to ageing of the magnetic surfaces may also cause these symptoms. The probability of recovering data from such drives depends on the distribution of the bad areas on the drive surfaces. Problems will become more complicated if the bad sectors are located in the System Area where such vital system tables as the Master Boot Record (MBR) and the File Allocation Table (FAT) etc, are stored. Usually, the user data area is likely to have a large distribution of bad sectors which will generate constant I/O errors from the OS during the copying process. The OS will terminate access to these bad sector areas making them inaccessible. Generally speaking, to deal with a drive with bad sectors failure, a special cloning tool is required. 2

3 Using the Data Extractor from PC3K, a good cloned copy of the defective drive was produced. 99.9% of the drive content was successfully cloned to a donor drive. However, after loading the drive onto Recovery Studio, no file structure was detected, as show below. A Full Scan is required to restore the file directory. After performed a Full Scan, it displayed the information as following: 3

4 As can be seen from the above, none of the partition has been detected, only the Extra Found Files and the partition of the cloned drive itself have been found. Another cloning tool, Power Data Extractor, which was developed by SalvationDATA, was tried. Another good copy of the defective drive was produced, but when checked using Recovery Studio, the result was the same, no file structure detected. According to the client, the drive used an NTFS file system. With NTFS systems, the boot sector and the MFT (Master File Table) are crucial for gaining access to file directory. If one of these is lost, there is no way to access the file through file directory. In such cases, a Long scan may help this by searching the file heads. But after carrying out both Quick and Long scans of the cloned copy, no file directory information or even file heads, could be found. None of the files could be recovered by these means. Finally, Data Compass with SalvationDATA Data Recovery Studio was tried. Powered on the drive through the interface of the Data Compass and it became Ready, as shown below: 4

5 Tried to view the Sector 0 in the [Sector View] section to make sure the boot sector was readable ( Enable Read should be activated), and the corresponding partition table was shown (1 active partition and ended with 55AA signature): After successfully booting the drive from Data Compass, the Data Recovery Studio was used to extract the data. Started the program and it showed: 5

6 The drive was detected correctly and the partition of NTFS system was also found without doing any Scan operations. Double clicked on the System partition with start sector of 63 and 7.87GB size, it showed: 6

7 The file structure was displayed. To make sure the files are intact and viewable, tried to open some of files, by clicking [View as Image, or Text, or Video] as show below: 7

8 Finally, selected the desired file and clicked [Save File]. The files were successfully restored to a specified folder. The reason the Data Compass is able to restore the file structure in this way is due to the optimized data fetching technique and the built-in DRS algorithm, which allows file headers to be searched for and detected independently of the normal sector search process used by operating systems. For further information: datacompass@computersciencelabs.com UK: International: (+44)