Recover Data From Hitachi 4240 With Physical Defects

SalvationDATA Data recovery :

Recover data from Hitachi 4240 with physical defects in both the firmware

Service Area and Data Area by Data Compass

example application

What failures can Data Compass help to solve?

1.Logical Malfunctions

2. Physical malfunctions

What malfunctions Data Compass cannot handle directly

Partition Loss

File loss or destruction

Virus attack

Accidental formation

Accidental deletion or clone

Data recovery from a drive with physical defects within the firmware Service Area, unrecoverable using

conventional processes. (Note: IBM/Hitachi drives are currently supported and other brands will come with this

feature in the near future)

Data Recovery from drives with severe defects in the firmware service area using hot swap by Data Compass

Based on that the data area can be accessed by DC and DC can recover data from "clicking" drives caused

by poor performance of the Read/Write head assembly or degraded magnetism of the servo information on the

platter surface.

Data recovery from drives with a wide distribution of bad sectors where Logical Recovery software has been

unsuccessful.

Data recovery from drives with multiple bad sectors or unstable read caused by poor head exchange

Data recovery from drives whose heads or motors are unstable Recover target data fast when there are

multiple bad sectors or unstable read or bad sectors caused by poor head replacement.

For hard disk image, DC is the best choice.

To drives with very severe or complete physical damage, DC cannot recover data directly. The following are some

examples:

PCB burnt

Complete head or motor damage

Severe scratches on the disk data areas

The HDD was overall cleared or the target data area was covered.

The data in the data area cannot be viewed by DC

This case study will take one patient Hitachi HDD for example.

Model HTS424040M9AT00

Malfunction: Cannot be detected by the PC

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

Firstly, Let's examine the disk by its appearance to find out if it was stroke or disassembled. You may ask the

customer for detailed information or check if the screws were twisted off. These physical examination on the patient

disk is very important and necessary before connecting to power. Because some physical damages to disks are

fatal and unrecoverable.

As shown above, this disk is viewed with intact label and unscrewed appearance.

Next, let's find out if the PCB was burnt, replaced or some electronic components had been damaged. You may

smell it for some judgment. These kinds of malfunctions require suited components exchange or a whole suited

PCB replacement. Please note the word 'suited' here.

As shown above, chips and components are viewed without obvious burnt appearance. So basically we can

exclude PCB malfunction.

Disk label is important to judge the disk model and other disk parameters before connecting to some program.

However, the market is flooded with fakelabel disks. These fake labels will mislead the engineers to do some false

judgment. Here is some experience to recognize the fake labels: incomplete info on fake labels; manual operation

trace on the edge of the disks, cause' fake labels are often stuck manually. Now we can make a simple decision:

disk appearance is intact, the disk is not disassembled and no problem with the PCB.

SalvationDATA Data Recovery example application


Next, let's connect the Hitachi 4240 to the computer and the motor is working normally without obvious clicking and

with track seeking. However, it cannot be normally detected by the computer. And cannot recognize any information;

If connected to other working computers, it is recognized as USB Device in the Device Manager.

Under 'Computer Management' of OS, cannot find any relative information about this patient disk

Next is to connect this disk to Hitachi doctor to find out its malfunction, As shown below, it indicates 'Ready



Next, let's try firstly 'Load from HDD

As shown above, the status bar indicates 'Error' after loading from HDD and no info in the parameters column and

the disk series is not read too ;

Then let's try 'load from files'. We can see the HDD series indicates 4240, after clicking 4240, parameters column

have changes which means the resources are loaded successfully from files.



Then move to firmware area, and we can all modules can be normally viewed

Next move to doctor's sector view interface, enter 63 as the sector address and check the disk MBR, click View

Sector



From above picture you can see the MBR is readable so that data recovery from this disk is with big hope now. To

confirm this, you can check the data area at random to find out if you can read see data.

The result is that we can see the data as well. Next we move back to the firmware backup interface and try to open

one of the modules to see if it is readable. Double click RSVD and open the module, we find the module can be

normally opened:



According to above trial, we can exclude the NVRAM malfunction. And next we can move to firmware Detection

interface to examine the firmware:

After the detection, many modules are not correct, what's more important, there's damage on the Plist. This does

attract our attention why we can see the data while Plist module. Then we need to open Plist module for further

detection



As you can see from the above picture, the first half of the P list module can be read, but the lower half part show

as 4040 and can not be read. Under this circumstance, there is a great possibility that this hard driver have physical

problem on firmware area. Usually, it is very difficult to recover data from this kind of hard driver. However, we also

would like to have a try by using traditional way

When this kind of problem happens on Hitachi drive, first we would rewrite the problem module by using the

corresponding module of Section C. If the P list is damaged and this hard drives have not been dealt by other

company before, we can use back up firmware stored on Section C for rewriting. Therefore, when we meet this kind

of situation, we need to confirm with customer first whether this hard driver has been restored before, If not, the P

list of Section C is original. And we can confirm we are able to restore P list of Section A by using P list of Section C

Switch to Section C first, then click SAC

Then a dialogue box will pop up and demand user to set the jumper into safe model



You need be assured the jumper of safe model has been already set before click OK (please refer to the manual of

Hitachi specialized for this detailed setting operation). Otherwise it will be definitely failed once you setting jumper

after click ok.

Then pop up a dialogue box requesting to remove jumper after this operation. Just same as above, you need to

remove jumper before clicking "confirm".

The hard drive works on Section C after double confirmation, then select firmware C at this load management

interface.

Switch to firmware inspection interface to check if the firmware is perfect



Usually there is little possibility that firmware of Section C is damaged as it has been rarely used. However, as you

can see from the picture, there are so many mistakes and the most part of firmware on Section C is already

damaged. It double confirmed our previous guess about having physical problem at firmware areas.

In order to explain this problem clearly, we would like try to find the matching firmware to rewrite.

First please perform the above operation again: 1. return to the section A 2. switch to firmware rewritten interface, 3.

set the root for back up firmware, 4. select the problem firmware module, click "rewrite".

However, there is still no response after clicking, and soon turn back to status before rewrite



There is same result after trying several times, then check if there is problem on magnet head or magnet head now

only has the read function. In order to check the magnet head, you can change a number (here we change initial 0

to 1) in any unimportant module for test (for instance, number 37 DUMP module)

We can see that it is succeed. It seems there is no problem at magnet head, then we tried to rewrite a few matching

firmware under other directory, and it is also successful. Now, we can confirm that the only reason would be

physical problem existing on firmware.

As the physical problem was positioned on the place for firmware stored, and it seems there is no way in recover

data from this kind of situation.

However, with the official release of Data Compass, this kind of problem can be well resolved.



Actually, the most part of firmware on many defective hard drives have no problem, for example, Hitachi Hard drives

RSVD, RESF, RAMO, ZONE, SRVP, PSHT etc. The hard drives can not be detected once there is a little damaged

on firmware place. An advanced technology, namely SA emulation technology has been intelligently built in Data

Compass. You can load the resource manually via Data Compass, then Data Compass will store the built in

program into Memory and establish a real link with the perfect program. We therefore emulate firmware same as

the real one. And now the entire hard drive can work again by using this SA emulation technology, it is not only able

to read and write, view the data area, but also able to recover data from data area

From the above, we can see that we are able to recover the data from Hitachi hard drivers with severe physical

problem in SA by using Data Compass.

We would like to make a demo

First, connect Computer with Data Compass on one side, and connect defective drive with Data Compass on the

other side, here, we would like to connect the shadow disk by using portable hard drive. Data Compass can be

operated on any notebook computer or desktop computer, please refer to the below picture for correct connecting

ways

After connection, it is the step to open the Data Compass control panel.

The control panel provides effective parameter settings for handling bad sectors in source disk. For instance, delay

read time, repeated read times, soft reset times, hard reset times, power supply reset times, etc. Also, it provides

the read/write control and accessing methods to the source disk. In accordance with the design conceptsimplicity

and utility, all the control parameters are all preset. Therefore, normal users will not waste their time to worry the

parameter setting, but default setting is enough to use. However, for some minority special hard drives, such as

drives with severe bad sectors, the default setting can be revised according to the data recovery experience. In

ordinary data recovery process, the default setting is proposed as all these default setting as all the ideal results

obtained by SalvationDATA engineers by a great deal practical operations.

Note: "UDMA" mode option aims to drives with a few bad sectors, because this function can maximally

enhance the read speed. But for drives with plenty of bad sectors drives, PIO mode is recommended.



Accessing the program, we can see the drive status is ERROR . That is because the Data Compass control

program will automatically load the hard disk resources after it starts, all the hard disk which cannot load normally

will be shown as error.

Next step is to view the sector. We can see all the data are revealed as 4040, which means the present accessing

data didn't read out the data, and then the system will show as 4040.

With Data Compass SA Emulation technology, we can go back to control panel to load the resource. In the HIT/IBM

HDD LOAD option, to choose the hard correct hard disk model4240:



Here, it is suggested that you need change the LBA manually. Normally, the detected drive can automatically read

the LBA once it is loaded; while the drives which have SA error can't be loaded correctly and the LBA can't be read

automatically. Then it will reveal the default LBA268435455. Special explanation here: if the hard drive cannot be

read normally, then users please change the LBA to the real capacity of this drive. That is because if the default

LBA is smaller than the real capacity, the program only can read the contents out of the defined LBA. For instance,

supposing an undetected 500G drive, after SA Emulation, if we didn't change the LBA manually, then the program

will only read out the front128G contents, the latter will not be read. Whereas, if the default LBA is larger than the

real capacity, change or not both will be insignificant as the latter LBA will be blank.

Since the capacity is 40G, then change the LBA manually to 80293248:

After change, the setting to SA Emulation is finished. Then switch to the "sector view" interface, and view the same

sector.



From above, we are surprised to find that the sectors have been successfully read out. Likewise, we can try to read

the subsequent data area.

From the image, we know the data in other sector can also be read as normal.

Because we don't know the how many serious bad sectors on the HDD, we connect a ShadowDisk to computer.

The ShadowDisk Technology can maximally reduces the number of read operations towards the source drive to

effectively prevent further damage to the head and sector as well as avoiding multiple head swap in data imaging.

If you know there are just several bad sectors on the HDD, you don't need to use ShadowDisk. The speed of data

recovery will be faster.



ShadowDisk Requirement:

1.The capacity of the ShadowDisk should be bigger than (or same as) the source drive.

2.Make sure there is no valuable data in the Shadowdisk

3.The ShadowDisk must be a good one without any bad sectors. Otherwise, it will affect the data recovery

successful rate.

Initialize ShadowDisk:

Click "Initialize ShadowDisk", a warning will come out: "The ShadowDisk must be a good one without any bad

sectors! The initialization will cause all data lost! Make sure there is no valuable data in the Shadowdisk."Then click

"Yes"

Remark: If you use ShadowDisk for the first time, you should initialize the ShadowDisk. If you can't finish data

recovery once, you just need to click "disable ShadowDisk". When you continue the data recovery at next time, you

just need to click "Enable ShadowDisk". The data which was read at last time had been established an index in the

ShadowDisk. When you restart the program, the system will automatically read the data from the ShadowDisk,

reduces the read operations towards the source drive.



After the initialization finished, the "Start LBA" and the "End LBA" will be displayed.

At last, click "Enable ShadowDisk". Wait the button turn to "Disable ShadowDisk", the ShadowDisk is started.

Now, the program set has been finished. Then open the DCEXP program to do the data extraction.



DCEXP is made up by "File Recovery" and "Disk Image". From the above interface, we can see the function keys:

Open Disk, Scan Partition, Scan Files, Pause, Skip and Stop.

Install the driver source which connect with DC Open Disk:

The diver is installing. If the partition information can be recognized, the driver information and partition information

will be showed in the left frame.



From the above image, we can see the two partition of the HDD. DCEXP adopt "Layered Scan Technology". It only

read the root directory firstly. User can select the useful data layer by layer. In this way, maximally save time from

data recovery. User can directly extract the file or do disk image. During the data image progress, it allows users to

image data fully from the source drive, partition, or any LBA area. As a target, it can reach far to files or disk. There

are also some handy functions like fast clockwise, fast reverse, exact clockwise and exact reverse. Meanwhile, it

can also allow recovering data fast and effectively any bit of data via "Bitmap Technology."

Double click the partition can display the directory under the partition.

From the control frame, we can see 4 files: Root. Delete. Lost. Searched

root folder which will display all of the files and manuals under the partition.

display all of the deleted files.

display the documents and files which lost the parent folder

display the files which are searched by the "Scan Partition Function". Click the righthand button on

the Partition, a operation manual will be poppedup as below:

ROOT :

DELETED :

LOST:

SEARCHED :



the manual including: View Sector, Partition Information, Image Partition, Open Partition

View Sector:

It is has the same function as "View Sector"in the HD Doctor Suite/DC program Partition Information:

From the partition information, we can see the information of HDD partitions and the files under the root folder.

Image Partition

Choose this function; it will turn to "Disk Image". About the "imaging function", please refer



Open Partition

It is same as double click partition. Open the partition and view the file manuals.

Scan Partition: to the damaged partition, lost partition or the drive which partitions can not be seen, only the driver

can be seen.

As you can see on above screenshot, the patient disk can not be recognized its partitions correctly, it shows

"DCHDD" on the left table, which means the patient drive is loaded. Then user need to execute "Scan Partition"

manually.

Click "Scan Partition" button, it will pop up the following dialog window:

You can input and set the value of LBA in the dialog window. Thus it

can save massive time for experienced data recovery engineers and

technicians. For new learners, they can execute this operation

according to the default setting in the program.

After clicking "Scan", the program

starts to scan the partitions of the

hard drive; see the screenshot

below: Then the partitions will be listed in

the table after the scanning; see

the screenshot below:

Scan Files: After finding the lost partitions, then you can scan the files by double clicking the partition you want to

recover from.

As the screenshot above, the program is scanning

the files in the partition. This operation is often used

on recovering files such as deletion, clone or those

files which can not be tracked back to their parent

folder. All retrieved files will be listed in "LOST"

folder on the left directory.



The buttons of "Pause", "Skip"," Stop" are often used during the process of recovering files. Since the "Pause" and

"Stop" are as easy as their meaning literally, we explain especially the function of "Skip" button. During the

procedure of recovering, an undesirable large file or corrupted document will cost much time, then you can press

this button and skip the file to the next one (same function as the AC button on Data Compass Controller Panel). It

can save massive time if you can use it skillfully according to particular recovery task.

Now, we take one Hitachi drive as case study to demonstrate: Click "Open Disk", and load the patient HD;

As shown on the screenshot, the resource of Patient disk is loading. About 10 seconds later, the patient disk is

ready and the partitions are recognized correctly by the Data Compass Explorer.

Open the desirable partition by double clicking, you can recover data directly.



You can open "Root" folder and the program can read the directory automatically, then you can see the files or

folders in the partition.

Statement: DCEXP adopts the "Stratification Recovery" technique. Its principle is that, when opening one partition,

only the files or folders under Root will be loaded, the user can decide and specify the desirable files and folders,

then the program scan the wanted files in the specified path. The significant advantage of this function is to save up

massive time and recover the exact wanted files. Besides, it can decrease the read attempts and protect the

source drive. For example, there are many MP3 and Films in one partition, but only a few pictures are wanted to

recover, by this Stratification Recovery technology, then there is no need to scan/recover all the files like traditional

logical recovery programs and take much time, accompanied by the risk of further damage to the source disk. See

below:



Select the wanted files by right clicking;

choose the separate files from the right table:

By right clicking, specify the saving path of

the recovered files manually;

Detailed Parameters on the right panel:

Skip files when reading failed

Skip file if it has a entire sector of 40 character

Skip file if it has 00 character only in start se

Skip file if it has invalid file header

Reset power when reading failed

While recovering process, you can make

options according to particular task to save time

and raise the success rate of opening. Clicking

"OK", you can monitor the real time of

recovering to see if the files are recovered

successfully;



For the recovered files, you can open it by double clicking in the specified folder to see if they can be readable;

As the above screenshot shows, the recovered picture is

accessible and readable. That improves the recover y task is

successful.

Data Compass is professional data recovery equipment

integrated with independent intellectual property rights and

innovative technology. Not only can deal with simple logical drive

failure, but also enables you a better data recovery on physical

damaged drive like with severe bad sector, instability of head,

and physical firmware corruption for example. Data Compass

was developed to change the traditional way of data recovery.

Along with fast development of information technology and a

huge population of computer users, data is increasingly

expanding, thus, a wide variety of storage products has been upgraded every now and again, to best satisfy the

market demand. Today 80G, 120G and 160G hard drive will fade away finally since the market is there needs big

storage capacity. As market heads into electronic data, archive cabinet has been less and less occupied by users,

while at the same time, storage media is more and more involved in our daily life, the risk of data loss also surfaces,

so every value cost will be huge. For the bigger storage capacities and higher densities, image as a traditional way

of data recovery is far behind the market, such as a 500G hard drive, normally the image rate is around 2G per

minute, the time cost for that will be at least 4 hours, even worse, comes to the hard drive with severe bad sector.

Data Compass has been empowered with 9 patents like "ShadowDisk Technology" and "Analog Technology" for

example, which allow you to recover without imaging at first hand. These are breakthroughs in data recovery

industry. It means another milestone for repairing defective hard drive, to simplify data recovery procedure, greatly

improved efficiency and success rate for data recovery. Since the day of Data Compass s launch, which was

designed for high performance and perfect match of manual use, it will turn the traditional mode of data recovery

into a brand new start.

