When a hard disk drive arrives at our laboratory for data recovery it is important to make an assessment of condition of the drive by our hardware engineers. This first step in the data recovery process is important as it will determine if there are any faulty components in the drive. To power a hard disk up without checking the condition of the drive could risk causing further unnecessary damage.
Before the imaging process begins any faults with the drive need to be fixed which may include replacing parts or completely cleaning and rebuilding drive, depending upon the nature of the problem. This minimises the risk of causing further damage when a sector-by-sector image copy of the hard disk drive is secured. It may be tempting to attach a hard disk drive to your machine, but this may result in undesirable changes to the drive or volumes held stored on it. In the case of a Windows machine the operating system may attempt to resolve any problems with the file system which could result in data loss.
Hard Drives Will Fail
It is all too common for someone to utter the phrase “it was working before I rebooted the computer” which amply illustrates how quickly a hard disk drive which appears to be operating correctly can fail. It is therefore important that a sector-by-sector image copy of the drive is secured as quickly as possible following a failure. When a hard drive starts to fail, but remains in an operational condition it is extremely critical to secure a sector-by-sector image as soon as possible as any erratic behaviour when attempting to access the disk, could result in an additional failure or data loss.
Any physical damage which has occurred to the surface of the drive platters, will inevitably increase over time, making it imperative to secure all readable sectors are as quickly and safely as possible. Eventually it is possible that a complete failure of the drive will occur where it not possible to recovery any further data, making it extremely important that the raw data sectors are recovered as quickly as possible.
Bad Sector Handling
During the imaging process it the health of the hard disk is constantly monitored to ensure that any faults which may develop or when a severely damaged area of the drive platters is encountered, the imaging process can be interrupted. As required the engineer will skip damaged areas of the drive in order to minimise the chances of causing further damage, in particular the read/write heads and the platters.
By skipping the damaged areas of the disk allows the maximum initial data yield before any attempts to read sectors from the damaged regions of the platters. Once the initial scan is complete the patching process attempts to read previously unrecovered sectors and patch them into the secured image. The patching process has in some cases been able to recover all sectors from the drive, leading to a complete recovery of the entire drive.
Data Recovery Using an Image
To ensure the imaging process is as efficient as possible a bitmap is used to keep track of which sectors have been successfully recovered. This ensures the patching process is efficient and allows all in-house software to be able to return a proprietary bad sector mark. By returning a proprietary bad sector mark the in-house developed data recovery software is able to detect bad sectors in an efficient manner while allowing the damage to file system to be handled elegantly in order avoid any issues that such an unreadable sector can create.
By using the secured image it avoids any further potential damage occurring to the hard disk drive, particularly where an unreadable bad sector could potentially be accessed many times during the file system scanning process. If working directly from the disk such a bad sector would not only increase the risk of further damage, but also increase the time required to complete the scan as each read attempt of any bad sector may take several seconds to complete.