Case Study: Quick data recovery using HOT SWAP trick in Data Compass

Transcription

1 Case Study: Quick data recovery using HOT SWAP trick in Data Compass What failures can Data Compass help to solve? 1.Logical Malfunctions Partition Loss File loss or destruction Virus attack Accidental formation Accidental deletion or clone 2. Physical malfunctions Data recovery from a drive with physical defects within the firmware Service Area, unrecoverable using conventional processes. (Note: IBM/Hitachi drives are currently supported and other brands will come with this feature in the near future) Data Recovery from drives with severe defects in the firmware service area using hot swap by Data Compass Based on that the data area can be accessed by DC and DC can recover data from "clicking" drives caused by poor performance of the Read/Write head assembly or degraded magnetism of the servo information on the platter surface. Data recovery from drives with a wide distribution of bad sectors where Logical Recovery software has been unsuccessful. Data recovery from drives with multiple bad sectors or unstable read caused by poor head exchange Data recovery from drives whose heads or motors are unstable Recover target data fast when there are multiple bad sectors or unstable read or bad sectors caused by poor head replacement. For hard disk image, DC is the best choice. What malfunctions Data Compass cannot handle directly To drives with very severe or complete physical damage, DC cannot recover data directly. The following are some examples: PCB burnt Complete head or motor damage Severe scratches on the disk data areas The HDD was overall cleared or the target data area was covered. The data in the data area cannot be viewed by DC The Hitachi SA Analog technology of Data Compass can initialize the HDD SA by uploading built in rescore files, thus avoid the problem of can't reading the modules due to SA bad sectors. After the HDD SA initialization, you can read the P list and G list modules and access the data area. However, this technology is now only open for Hitachi drives, one need to do hot swap for other brands HDD with bad sectors in SA. This tutorial takes an example of Maxtor drive to introduce how to recover data by using HD Doctor for Maxtor and Data Compass with the hot swap method. (DONOR drive: Model: 6E030L0, S/N: E10JR6SE Code: NAR61590; PATIENT drive Model: 6E030L0, S/N: E10JS0NE, Code: NAR The DONOR is a drive in good condition, while the PATIENT drive is one with bad sector in SA, can t be recognized in BIOS and can t be repaired by downloading the firmware.)

2 The principle of Hot Swap is to load the firmware to the RAM after hard drive power on and initialization in order to access the data area of patient drive. There need two hot swaps to recovery data using Data Compass. In the first hot swap, you need to write the coding list of the patient drive to the healthy drive with the help of HD Doctor for Maxtor, which requires that the coding list module of PATIENT drive (24/55/120) or the factory P list module(51)is not damaged. In the second one, you need Data Compass to copy the data. Please check the detailed steps below: To connect the DONOR to the HD Doctor for Maxtor to do the first hot swap, reading the DONOR coding list module or the factory P list module. First of all, you should make sure the power supply and all cable connections are normal because in the whole process of hot swap, there should be no power break, otherwise the content in the RAM will miss. Secondly, you had better put the DONOR and the PATENT abreast so easier to do PCBA swap. Pic. 1 PATIENT&DONOR After DONOR power on, load from HDD, then click "stop motor" in menu "others". After make sure the motor is at rest, screw off to change the PCBA. In the whole process, you should never touch the power cable and make sure all connections are normal. Pic.2 After motor at rest, remove the DONOR PCBA to place the one of the PATIENT

3 Pic.3 The PCBA of DONOR on the PATIENT drive After load the PCBA in PATIENT, click "start motor", then the drive state will turn from "busy" to "ready". You need to check if you can access the SA by double clicking the module. If not, you need to find other donors to try because it maybe the head problem or the DONOR and PATIENT don t match. If the SA can be accessed, the first step is clicking "View P list" in the "Defect Management". There will be two conditions: the first is that the program doesn't show P list note; the second one is the program can show the P list note and generate a PLIST text file in the current working directory. Pic.4 P list note damaged and cannot show anything Pic. 5 Can access P list note

4 The first condition is that module 51(factory P list note)is damaged. So long as module 24(coding list), module 55 and module 120 are good, you can directly upload the three modules and write to DONOR. The second condition is that you can write the coding list to DONOR by the "Import P list" function. Attention: After upload the coding list module or view the P list, you need to remove the PCBA to the DONOR drive and then write or import P list. After writing the coding system of the PATIENT to the DONOR, you can do the second hot swap using Data Compass. First of all, connect DONOR to the Data Compass console, power on and run the Data Compass Panel. When the status is "Ready", click "stop" to stop the motor and repeat the PCBA swap. Pic. 8 Stop the motor

5 After load the PCBA of the DONOR to the PATIENT, click "Run" to start the motor, then input the LBA address to view the sector in DEC or HEX column in the "Sector View" menu (DEC stands for decimal system, HEX stands for hexadecimal system ), then click "View Sector" to check if you can access the data area. Pic. 9 View sector When you view all the data "4040", it means that the current sector is damaged and can t read any data. Pic. 10 Can't access the sector We shall check sectors which is on the beginning, middle and the ending in order to make sure the data we see are not "4040". In this case, it means the data area can be accessed. After accessing the data area, we also can use "Sector Servo" to scan the drive so that we can make sure if there are many bad sectors. If there are many bad sectors, we must use shadow disk in order to preserve the patient drive. If there are no bad sector then, the shadow disk can not be used in order to get higher image speed.

6 ShadowDisk technology is different from the traditional disk image technologies. The function of ShadowDisk is not simply used as image disk, isn't extract the data of the source HDD to the ShadowDisk one to one. The traditional disk image technologies should only recovery data after the whole image been completely established. However, by using the shadow technology, which needn t wait the shadow be completely established. Building the shadow and doing data recovery are carried on simultaneously. The shadow technology does not extract data directly from the shadow disk, it extract the data directly from the source disk. When do data recovery, first it will check the LBA of the resource disk has been established as shadow or not. If the shadow has been established, it will read the data from shadow disk directly. If the shadow hasn t been established, it will read the data from source disk directly. Also it will decide to establish the shadow or not by the result of reading. From the traditional image technologies, data should be extracted after the whole image is successfully established. Also the traditional image technologies are too weak to read the LBA data from the parts where include some bad sectors, and even affect the data extraction on the parts where don't include sectors. This problem will never excite by using the shadow technology. Towards the failed reading LBA, it will not establish the shadow, it will just do special handling fill full of 0x40 to cheat the Window system. As that the Window system will not do auto scan, which can prevent the Window system halt from reading the bad sectors. The other advantage of using shadow technology is: the operation is so convenient, so easy. Users can establish the shadow at the discretionary setting area of LBA. Users can close the program at any time, no matter the shadow has been established or not in a certain time. When users do the operation again at next time, it will not rebuild the shadow which had been built. It will read the data directly from the shadow disk. It will only read LBA which hadn't been established as shadow. And will establish shadow of corresponding LBA. Special requirements for ShadowDisk: 1.It is better to choose a hard disk which has a capacity that is at least as large as the source disk. 2.It must make sure that the data in the shadow disk should be backed up to avoid the unnecessary loss. 3.The selected shadow disk must be in good condition and without any bad sector, or the success rate will be reduced. Move to the ShadowDisk Control panel; Select the Shadow disk from 'ShadowDisk'. The system will Shield the current OS disk automatically.

7 Pic 12 choose the Shadowdisk After selecting the Shadow Disk, you can use the button 'Initialize ShadowDisk'. For data recovery from the patient drives for the first time, one time ShadowDisk initialization is enough. Note: If it's the first time to set up the shadow disk, it requires initialization. When you need to have a second time to finish the recovery, you just need to turn off the Shadowdisk function and when you continue recovery at the second time, you just turn on the ShadowDisk function and then you can continue. Because An index log had been created for the data retrieved in the first time and when you recover data at a second time from the patient disk, the program will read automatically the data recorded on the Shadow Disk and therefore the read times on source disk are reduced and lots of time is saved. Click the "Initialize ShadowDisk". And the ShadowDisk will be initialized into three parts: 1.Reserve Area 2.Index Area 3.Shadow Data Area

8 Picture 14 Initializing progress bar Once the shadow disk initialized, we can set LBA for Shadow disk same as the Donor. Input the start location of patient drive in "Start LBA", and input the end position in "END LBA". In order to distinguish different shadow disks, we are able to mark them by using "Shadow Disk Label". Picture 15 Shadow Disk Set After shadow disk initialized, click "Enable ShadowDisk" to start working, then all the sectors been read from patient drive will write a copy into the shadow disk Picture 16 Enable Shadow Disk

9 After Enable Shadow Disk, we can use the top level software DC Explorer to recover data. Click "DC Explorer", the program will select "DCEXP.EXE" software automatically, or we can double click "DCEXP.EXE" which is under the installation directory Switch to DC EXP program interface, then select "File Recovery ". Picture 17 File Recovery interface Click "Open Disk" program, then it will find and read the logical sector automatically Picture 18 "Open Disk Picture 19 Find Sector

10 We can see the sector in a short time. The reason is that DCEXP adopts layered read operation, so as to read MFT area directly, access root catalog. Customers are able to recover data effectively via optimal choice, and then deep down into the user data, it maximally saves time from recovering; during the data recovery, it allows users to image data fully from the source drive, partition, or any LBA area. As a target, it can reach far to files, or disk. There are also some handy functions like fast clockwise, fast reverse, exact clockwise and exact reverse for example. Meanwhile, it can also allow recovering data fast and effectively from any bit of data via "Bitmap Technology". All sectors been read will have information at the upper left box. We can click "+"to show the information and click " " to hide Picture 20 Logical sector It will pop up a second class manual after right click, Then click "partition information", sector information will be shown (FAT32 LBA 63 SIZE =29321MB etc) It means the sector format is FAT32, the start place is from number 63 sector, and the volume is 29321MB Picture 21 Second class Manual

11 Picture 22 Sector information Double click the Root directory, the program will read the directory table automatically and on the right the file directory will be displayed. ROOT DELETED LOST SEARCHED Pic.23 Pic.24 catalog tree

12 Double click the category and you can open the subcategories and the corresponding category tree on the left will change as well. Tick those files which require to be recovered. Pic25 Files Pic26 Select files you want to recover After selecting the wanted files, right click and select 'Recover Marked' from the system menu and you will move to the Save file interface.

13 Pic 28 Select The file path(where you want to save your recovered files) From Pic28, we can see on the left it displays the file save path, you can select the path or set up new file directory.

14 Parameter Options on the right Skip files when reading failed: when failing to read the file, skip the file Skip file if it has a entire sector of 40 character : When the file is read all as 40 character, skip it Skip file if it has 00 character only in start se : When the start sectors of the files are all 00, skip the file Skip file if it has invalid file header : When the file header is invalid, Skip the file Reset power when reading failed : When failing to read from the file, reset the power Retry on file failed to be recovered : Try again when you fail to recover the data. When you are copying the data, you can flexibly use the options above and this will save a lot of time and increase the chance of opening the recovered files. After the configuration, click 'OK' and the program will start to recover the data you ve selected. The recovering process can be viewed through the All Logs. Pic 29 View the recovering Process

15 When there is an error of recovering some file, we can analyze the reasons by the previous information. As shown in the Pic30, there are errors with two files, one file error is caused by the 4040 characters in the sectors and the other is caused by invalid file header. And these two files will not be recovered any more. After recovery, open the files to see if it is normally opened with supposed data there. As shown above, all the pictures can be normally opened and this means we have had a successful recovery. Data Compass is a professional data recovery tool and we have the complete intellectual property rights for this equipment. It is not only designed to solve the logical malfunction, but also more lean to recover data from defective HDDs which have physical malfunction. Such as physical damage on sectors, read instability, and firmware corruption The purpose of our development is to change the traditional data recovery ideas and methodib Today, the 21st century, we are in a data era more than information era. User s data volume is rapidly increasing along with upgrading of storage products. The HDD 80G, 120G, 160G, we all thought it was enough for use not long ago, is disappearing With the tremendous growth of electronic data, our file container is becoming empty. However, on the other hand, followed by this, there is more chance to lose data stored in media. Furthermore, as the density of media becoming higher and higher, the need of data recovery cannot be met by the traditional data recovery method For example a 500G hard drive, and the ordinary imaging speed is 2G per minute, it will at least take 4 hours to complete imaging work. If the defective hard driver with severe physical problem, the time of imaging will be unable to calculated. Data Compass applied with 9 patent technologies, especially with Shadow disk technology and SA emulation technology which laid solid foundation for directly extracting data from defective HDD, it is greatly improve the data recovery success rate and efficiency Data Compass will change the traditional data recovery mode, and represent a new data recovery trend