Recovery Data From Hitachi With Physical Defects in Data Area

8/14/2019 Recovery Data From Hitachi With Physical Defects in Data Area

http://slidepdf.com/reader/full/recovery-data-from-hitachi-with-physical-defects-in-data-area 1/16

SalvationDATA Data Recovery Example Application:

Recovery data from Hitachi with physical defects in data area by DATA COMPASS

What failures can Data Compass help to solve?

1.Logical Malfunctions

2. Physical malfunctions

What malfunctions Data Compass cannot handle directly

Partition Loss

File loss or destruction

Virus attack

Accidental formation

Accidental deletion or clone

Data recovery from a drive with physical defects within the firmware Service Area, unrecoverable using

conventional processes. (Note: IBM/Hitachi drives are currently supported and other brands will come with this

feature in the near future)Data Recovery from drives with severe defects in the firmware service area using hot swap by Data Compass

Based on that the data area can be accessed by DC and DC can recover data from "clicking" drives caused

by poor performance of the Read/Write head assembly or degraded magnetism of the servo information on the

platter surface.

Data recovery from drives with a wide distribution of bad sectors where Logical Recovery software has been

unsuccessful.

Data recovery from drives with multiple bad sectors or unstable read caused by poor head exchange

Data recovery from drives whose heads or motors are unstable Recover target data fast when there are

multiple bad sectors or unstable read or bad sectors caused by poor head replacement.

For hard disk image, DC is the best choice.

To drives with very severe or complete physical damage, DC cannot recover data directly. The following are some

examples:

PCB burnt

Complete head or motor damage

Severe scratches on the disk data areas

The HDD was overall cleared or the target data area was covered.

The data in the data area cannot be viewed by DC

SalvationDATA Technolo gy, LLC.

Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

This case study will take one patient Hitachi HDD for example.

Model HTS424040M9AT00 S/N: Q2JE8JKL

Firstly, Let's examine the disk by its appearance to find out if it was stroke or disassembled. You may ask the

customer for detailed information or check if the screws were twisted off. These physical examination on the patient

disk is very important and necessary before connecting to power. Because some physical damages to disks are

fatal and unrecoverable.



What the HDD indicates: Connect this HDD with the PC as slave disk, turn on the power and the relative disk

parameters can be recognized correctly under COMS; however, it's too slow to enter the OS normally and we turn

off the power and start the OS first. After this, we connect to the PC by the USB port, we see the mouse lose

control and all programs stopped. The OS appeared as crashed like the picture below:

SalvationDATA Data Recovery example application



According to our initial judgment, there might be very serious bad sectors in data area. To view the damage of the

data area intuitively, we start the computer by DOS model. Scan the bad sectors by MHDD.

From the scan, we know there are a lot of Red and Green squares and "B" symbolizing a wide distribution of bad

sectors. 'Green square' means low access speed while 'Red square' means reading difficultly. 'B' means where

there are bad sectors or errors. We have discussed it is impossible to recover data from slave mode. Because

when the OS is started, it will detect all the hard devices and only if the hard drive is found, all the partitions will be

read. Once there re bad sectors, the bad sectors will be read round and cause the whole system to stop working

or crash.



To this situation, we will recover data from the patient disk by image method with DC.

Let's connect as following:

Start the DC Panel and enter The 'Hardware Control' Panel.




Turn on the power and wait until the 'HDD Status' indicates 'Ready

Turn on the "Enable Read"



"Enable Write" controls the writing operation to the source HDD. It is very important to keep the original data on the

Source HDD. Data Compass reserves the writing operation to the source HDD, but needs satisfy two conditions:

1 Turn on the "Enable Write Function"

2 Shut down the "ShadowDisk Function", because when the ShadowDisk Function is running, the data will be

wrote on the ShadowDisk instead of be wrote on the source disk.

In general, we don't suggest you directly write data on the source disk.




"Enable UDMA" controls the reading mode to the source disk. PIO is the default mode. Turn on the function; it will

be changed to UDMA mode. UDMA is the high-speed reading mode. To the HDD which has serious bad sectors,

please choose the PIO mode






The program provides multiple settings to control the source HDD bad sectors reading, including: Waiting for

readiness time; Retry times; Soft Reset times, Hard Reset times and Power supply Reset time.

Waiting for readiness time: sector reading time can't exceed the defined waiting for readiness time. If it exceeds the

waiting for defined readiness time, the system will identify the data reading unsuccessful and return as 0X40

Retry time: in order to gain the data from this sector after the unsuccessful reading within the waiting for defined

readiness time, we should set the retry times to read this sector again. The longest time per reading will not exceed

the waiting for readiness time.

Soft Reset Times: It can't gain the data successfully after many times reading, and also it can't get the

response/can t gain the data successfully on next sector reading. The system will automatically carry out the soft

reset operation -send out the reset command.

Hard Reset times: The HDD also can't get the response after achieve the soft reset times. Data Compass will

send out an electric single to do the hard reset without cut off the HDD electricity.

Power supply Reset times the HDD also can't get the response/can t be ready after achieve the hard reset

times. Data Compass will do the power supply reset. The power supply reset will stop the electric power supply to

the HDD, and then turn on the electric power supply to the source HDD.

For average users, they do not need to care for the problem of parameters setting, they only need to use the

default setting. Unless the defective HDD have a severe physical problem, then you can change the default setting

to a more reasonable one by using your data recovery experience. All these default settings are the desired result

of large number of studies and operations which have been done by SalvationDATA's engineers, it is suggested to

use them for those ordinary cases

Select "Default setting" first, and then click "save", it will effective soon after restart

'

'

Now you can set hidden LBA into 0, it means Data Compass will work from the first section

C/H/S 0/0/1. Also you can set any LBA as long as it is smaller than the entire HDD LBA, then

all the hidden HDD section will be skipped and will start reading from this LBA. If the defective

HDD has severe physical problem, it is recommended to hidden the first section to avoid the

operating system being stuck.



Here, it is suggested that you need change the LBA manually. Normally, the detected drive can automatically read

the LBA once it is loaded; while the drives which have SA error can't be loaded correctly and the LBA can't be read

automatically. Then it will reveal the default LBA-268435455. Special explanation here: if the hard drive cannot be

read normally, then users please change the LBA to the real capacity of this drive. That is because if the default

LBA is smaller than the real capacity, the program only can read the contents out of the defined LBA. For instance,

supposing an undetected 500G drive, after SA Emulation, if we didn't change the LBA manually, then the program

will only read out the front128G contents, the latter will not be read. Whereas, if the default LBA is larger than the

real capacity, change or not both will be insignificant as the latter LBA will be blank.

Click the "Total LBA" in order to get the real capacity.




Owing to the serious bad sectors, it is better to load the ShadowDisk first to maximally reduce the read times

towards the source disk and protect it, avoiding the hang caused by bad sectors.

Surely, if we know that this hard disk is with not too much bad sectors, you also can close the ShadowDisk function

to increase the copy speed.



ShadowDisk technology is different from the traditional disk image technologies. The function of ShadowDisk is not

simply used as image disk, isn't extract the data of the source HDD to the ShadowDisk one-to-one. The traditional

disk image technologies should only recovery data after the whole image been completely established. However,

by using the shadow technology, which needn't wait the shadow be completely established. Building the shadowand doing data recovery are carried on simultaneously. The shadow technology does not extract data directly from

the shadow disk, it extract the data directly from the source disk. When do data recovery, first it will check the LBA

of the resource disk has been established as shadow or not. If the shadow has been established, it will read the

data from shadow disk directly. If the shadow hasn't been established, it will read the data from source disk directly.

Also it will decide to establish the shadow or not by the result of reading. From the traditional image technologies,

data should be extracted after the whole image is successfully established. Also the traditional image technologies

are too weak to read the LBA data from the parts where include some bad sectors, and even affect the data

extraction on the parts where don't include sectors. This problem will never excite by using the shadow technology.

Towards the failed reading LBA, it will not establish the shadow, it will just do special handling fill full of 0x40 to

cheat the Window system. As that the Window system will not do auto scan, which can prevent the Window system

halt from reading the bad sectors. The other advantage of using shadow technology is: the operation is so

convenient, so easy. Users can establish the shadow at the discretionary setting area of LBA. Users can close the

program at any time, no matter the shadow has been established or not in a certain time. When users do the

operation again at next time, it will not rebuild the shadow which had been built. It will read the data directly from

the shadow disk. It will only read LBA which hadn t been established as shadow. And will establish shadow of

corresponding LBA.

Special requirements for ShadowDisk:

1.It is better to choose a hard disk which has a capacity that is at least as large as the source disk.

2.It must make sure that the data in the shadow disk should be backed up to avoid the unnecessary loss.

3.The selected shadow disk must be in good condition and without any bad sector, or the success rate will be

reduced.

Move to the ShadowDisk Control panel; Select the Shadow disk from 'ShadowDisk'. The system will Shield the

current OS disk automatically.









After selecting the Shadow Disk, you can use the button 'Initialize ShadowDisk'. For data recovery from the patient

drives for the first time, one time ShadowDisk initialization is enough.

Note: If it's the first time to set up the shadow disk, it requires initialization. When you need to have a second time

to finish the recovery, you just need to turn off the Shadowdisk function and when you continue recovery at the

second time, you just turn on the ShadowDisk function and then you can continue. Because An index log had been

created for the data retrieved in the first time and when you recover data at a second time from the patient disk, the

program will read automatically the data recorded on the Shadow Disk and therefore the read times on source disk

are reduced and lots of time is saved.

Click the "Initialize ShadowDisk". And the ShadowDisk will be initialized into three parts:

1 Reserve Area

2 Index Area

3 Shadow Data Area

After the Shadowdisk Initialization, we can configure the corresponding LBA value for the source disk and

Shadowdisk by entering the value in the 'Start LBA' and 'End LBA'. "ShadowDisk Label"can set up label for this

shadowdisk to distinguish different shadow disks.

Click "Enable ShadowDisk" to start the Shadowdisk function all the sectors retrieved from the source disk will be

synchronously recorded to the Shadowdisk.






Shadow Technology was designed for unstable heads or sectors to minimize the read times on the source disk in

order to avoid second damage to source disk caused by repetitive head's read and write or sector scratches.

After setting up the Shadow, move to 'Sector View' Panel and we can check data of any sectors. To check the data

is to find out if we can read data from the drive and if there is firmware problem. For example, the hard disk is ready

but there's firmware problem, we cannot see any data; Hitachi drive is able to be ready but there's problem with

NVROM or NVROM doesn't match. There are more examples for which we cannot copy data directly and therefore

need to view sectors to finally decide our operation.

Input the LBA address of the sector which you want to view in the DEC box or HEX box. DEX is the decimal

numbers; HEX is the Hexadecimal numbers. Input the data in one of the boxes, the system will display the

corresponding number in another box.






We ca n see all of the data are displayed as 4040, which means the present accessing can't read out the data. The

system defaults it as 4040.

When the data is not displayed as 4040 and the data in the data area can be read, we can use the DCEXP to

extract the data.

Click the "DC Explorer" from the Control Panel or double click the "DCEXP.EXE" from the install manual, the

system will automatically launch the DCEXP.



Choose "File Recovery". From this panel, you can directly view the system partition and files root. This is the most

vivid way for data view and data extraction.




Click "Open Disk", the logical data recovery software will read all the logical partitions in this drive.






We can see all the partitions in awhile due to the layered scan technology of DCEXP. It will first scan the root

directory which can highly shorten the directory read time. Then users can do a selective data recovery for the

usable and important data. One layer to another, this maximally saves the working time. At the same time, you can

directly extract the files or you can do a whole image. During the data recovery, it allows users to image data fully

from the source drive, partition, or any LBA area. As a target, it can reach far to files, or disk. There are also some

handy functions like fast clockwise, fast reverse, exact clockwise and exact reverse functions for you to choose

flexibly. Meanwhile, it can also allow recovering data fast and effectively from any bit of data via "Bitmap

Technology".

All the read partitions will be listed in the left column. Showing the information of the partition or not can be

controlled by clicking "+"or "-".

Shown as the above picture, this defective drive only has one partition. The contents are FAT32 LBA 63 SIZE

78139025=38153MB . This means the file system of this drive is FAT32, the partition start from sector63 and the

size of the partition is 38153M.

Double click the partition can display the directory under the partition. The directory includes: ROOT, DELETED,

LOST, And SEARCHED.









The process of file restoration can be viewed in Log Viewer

If there is any mistake in file recovery process, the failure reason can be checked from INFO column. As you can

see from the above picture, two mistakes were happened, one is for being verified as 4040 in read section and

another is due to invalid file header. These two files cannot be retrieved.

Inspect the result after file recovery finished

Shown as in the above, all other files are also able to be

opened. This is the end of this data recovery job and it is

successful

Data Compass is a professional data recovery tool and

we have the complete intellectual property rights for this

equipment. It is not only designed to solve the logical

malfunction, but also more lean to recover data from

defective HDDs which have physical malfunction. Such

as physical damage on sectors, read instability, and firmware corruption

The purpose of our development is to change the traditional data recovery ideas and methodib

Today, the 21st century, we are in a data era more than information era. User s data volume is rapidly increasing

along with upgrading of storage products. The HDD 80G, 120G, 160G, we all thought it was enough for use not

long ago, is disappearing

With the tremendous growth of electronic data, our file container is becoming empty. However, on the other hand,

followed by this, there is more chance to lose data stored in media. Furthermore, as the density of media becoming

higher and higher, the need of data recovery cannot be met by the traditional data recovery method For example a

500G hard drive, and the ordinary imaging speed is 2G per minute, it will at least take 4 hours to complete imaging

work. If the defective hard driver with severe physical problem, the time of imaging will be unable to calculated.

Data Compass applied with 9 patent technologies, especially with Shadow disk technology and SA emulation

technology which laid solid foundation for directly extracting data from defective HDD, it is greatly improve the data

recovery success rate and efficiency

Data Compass will change the traditional data recovery mode, and represent a new data recovery trend


Documents

Recovery Data From Hitachi With Physical Defects in Data Area