image from hdd with severe bad sectors in data area

13
SalvationDATA Data Recovery Example Application: Image from the HDD with serious bad sectors in the Data Area by Data Compass What failures can Data Compass help to solve? 1.Logical Malfunctions 2. Physical malfunctions What malfunctions Data Compass cannot handle directly Partition Loss File loss or destruction Virus attack Accidental formation Accidental deletion or clone Data recovery from a drive with physical defects within the firmware Service Area, unrecoverable using conventional processes. (Note: IBM/Hitachi drives are currently supported and other brands will come with this feature in the near future) Data Recovery from drives with severe defects in the firmware service area using hot swap by Data Compass Based on that the data area can be accessed by DC and DC can recover data from "clicking" drives caused by poor performance of the Read/Write head assembly or degraded magnetism of the servo information on the platter surface. Data recovery from drives with a wide distribution of bad sectors where Logical Recovery software has been unsuccessful. Data recovery from drives with multiple bad sectors or unstable read caused by poor head exchange Data recovery from drives whose heads or motors are unstable Recover target data fast when there are multiple bad sectors or unstable read or bad sectors caused by poor head replacement. For hard disk image, DC is the best choice. To drives with very severe or complete physical damage, DC cannot recover data directly. The following are some examples: PCB burnt Complete head or motor damage Severe scratches on the disk data areas The HDD was overall cleared or the target data area was covered. The data in the data area cannot be viewed by DC Firstly, Let's examine the disk by its appearance to find out if it was stroke or disassembled. You may ask the customer for detailed information or check if the screws were twisted off. These physical examination on the patient disk is very important and necessary before connecting to power. Because some physical damages to disks are fatal and unrecoverable. SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited. SalvationDATA.com

Upload: selinasalvationdata

Post on 01-Sep-2014

3.792 views

Category:

Technology


2 download

DESCRIPTION

In daily data recovery, we always meet some hard drives that have many severe bad sectors in data area. In many conditions, customers are always asking for the whole information in this hard disk. So a whole hard disk image is needed here. How to image data from the hard drives with severe bad sectors in high sucess rate is the most welcomed techniques.

TRANSCRIPT

Page 1: Image From Hdd With Severe Bad Sectors in Data Area

SalvationDATA Data Recovery Example Application:

Image from the HDD with serious bad sectors in the Data Area by Data Compass

What failures can Data Compass help to solve?

1.Logical Malfunctions

2. Physical malfunctions

What malfunctions Data Compass cannot handle directly

Partition Loss

File loss or destruction

Virus attack

Accidental formation

Accidental deletion or clone

Data recovery from a drive with physical defects within the firmware Service Area, unrecoverable using

conventional processes. (Note: IBM/Hitachi drives are currently supported and other brands will come with this

feature in the near future)

Data Recovery from drives with severe defects in the firmware service area using hot swap by Data Compass

Based on that the data area can be accessed by DC and DC can recover data from "clicking" drives caused

by poor performance of the Read/Write head assembly or degraded magnetism of the servo information on the

platter surface.

Data recovery from drives with a wide distribution of bad sectors where Logical Recovery software has been

unsuccessful.

Data recovery from drives with multiple bad sectors or unstable read caused by poor head exchange

Data recovery from drives whose heads or motors are unstable Recover target data fast when there are

multiple bad sectors or unstable read or bad sectors caused by poor head replacement.

For hard disk image, DC is the best choice.

To drives with very severe or complete physical damage, DC cannot recover data directly. The following are some

examples:

PCB burnt

Complete head or motor damage

Severe scratches on the disk data areas

The HDD was overall cleared or the target data area was covered.

The data in the data area cannot be viewed by DC

Firstly, Let's examine the disk by its appearance to find out if it was stroke or disassembled. You may ask the

customer for detailed information or check if the screws were twisted off. These physical examination on the patient

disk is very important and necessary before connecting to power. Because some physical damages to disks are

fatal and unrecoverable.

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

Salvati

onDATA.co

m

Page 2: Image From Hdd With Severe Bad Sectors in Data Area

What the HDD indicates: Connect this HDD with the PC as slave disk, turn on the power and the relative disk

parameters can be recognized correctly under COMS; however, it's too slow to enter the OS normally and we turn

off the power and start the OS first. After this, we connect to the PC by the USB port, we see the mouse lose

control and all programs stopped. The OS appeared as crashed like the picture below:

SalvationDATA Data Recovery example application

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

Bypassing the OS and scan the bad sectors of the slave disk

From the scan, we know there are a lot of Red and Green squares and "B" symbolizing a wide distribution of bad

sectors. 'Green square' means low access speed while 'Red square' means reading difficultly. 'B' means where

there are bad sectors or errors. We have discussed it is impossible to recover data from slave mode. Because

when the OS is started, it will detect all the hard devices and only if the hard drive is found, all the partitions will be

read. Once there re bad sectors, the bad sectors will be read round and cause the whole system to stop working

or crash.

Salvati

onDATA.co

m

Page 3: Image From Hdd With Severe Bad Sectors in Data Area

To this situation, we will recover data from the patient disk by image method with DC.

Let's connect as following:

Start the DC Panel and enter The 'Hardware Control' Panel.

SalvationDATA Data Recovery example application

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

Turn on the power and wait until the 'HDD Status' indicates 'Ready

Salvati

onDATA.co

m

Page 4: Image From Hdd With Severe Bad Sectors in Data Area

Click "Total LBA" and get the real capacity from the HDD. If the HDD has been serious damaged, please manual

input the HDD LBA instead of click the "Total LBA"

Here, it is suggested that you need change the LBA manually. Normally, the detected drive can automatically read

the LBA once it is loaded; while the drives which have SA error can't be loaded correctly and the LBA can't be read

automatically. Then it will reveal the default LBA­268435455. Special explanation here: if the hard drive cannot be

read normally, then users please change the LBA to the real capacity of this drive. That is because if the default

LBA is smaller than the real capacity, the program only can read the contents out of the defined LBA. For instance,

supposing an undetected 500G drive, after SA Emulation, if we didn't change the LBA manually, then the program

will only read out the front128G contents, the latter will not be read. Whereas, if the default LBA is larger than the

real capacity, change or not both will be insignificant as the latter LBA will be blank.

"Enable Write" controls the writing operation to the source HDD. It is very important to keep the original data on the

Source HDD. Data Compass reserves the writing operation to the source HDD, but needs satisfy two conditions:

1 Turn on the "Enable Write Function"

2 Shut down the "ShadowDisk Function", because when the ShadowDisk Function is running, the data will be

wrote on the ShadowDisk instead of be wrote on the source disk.

In general, we don't suggest you directly write data on the source disk.

"Enable UDMA" controls the reading mode to the source disk. PIO is the default mode. Turn on the function; it will

be changed to UDMA mode. UDMA is the high­speed reading mode. To the HDD which has serious bad sectors,

please choose the PIO mode

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

Usually, it's suggested to turn off the read function to patient disk by the 'Read' button on the DC console. This is

done to avoid the slow reading to patient drive with multiple bad sectors when starting the program. After we enter

the DC panel, we can turn on the 'Read' function manually.

Turn on the 'Read' function, DC can then access the patient disk and read data there now.

Salvati

onDATA.co

m

Page 5: Image From Hdd With Severe Bad Sectors in Data Area

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

The program provides multiple settings to control the source HDD bad sectors reading, including: Waiting for

readiness time; Retry times; Soft Reset times, Hard Reset times and Power supply Reset time. Waiting for

readiness time: sector reading time can't exceed the defined waiting for readiness time. If it exceeds the waiting

for defined readiness time, the system will identify the data reading unsuccessful and return as 0X40

Retry time: in order to gain the data from this sector after the unsuccessful reading within the waiting for defined

readiness time, we should set the retry times to read this sector again. The longest time per reading will not exceed

the waiting for readiness time.

Soft Reset Times: It can't gain the data successfully after many times reading, and also it can't get the

response/can't gain the data successfully on next sector reading. The system will automatically carry out the soft

reset operation send out the reset command.

Hard Reset times: The HDD also can't get the response after achieve the soft reset times. Data Compass will

send out an electric single to do the hard reset without cut off the HDD electricity.

Power supply Reset times the HDD also can't get the response/can't be ready after achieve the hard reset

times. Data Compass will do the power supply reset. The power supply reset will stop the electric power supply to

the HDD, and then turn on the electric power supply to the source HDD.

For average users, they do not need to care for the problem of parameters setting, they only need to use the

default setting. Unless the defective HDD have a severe physical problem, then you can change the default setting

to a more reasonable one by using your data recovery experience. All these default settings are the desired result

of large number of studies and operations which have been done by SalvationDATA's engineers, it is suggested to

use them for those ordinary cases

Select "Default setting" first, and then click "save", it will effective soon after restart

Now you can set hidden LBA into 0, it means Data Compass will work from the first section C/H/S 0/0/1. Also you

can set any LBA as long as it is smaller than the entire HDD LBA, then all the hidden HDD section will be skipped

and will start reading from this LBA. If the defective HDD has severe physical problem, it is recommended to hidden

the first section to avoid the operating system being stuck.

Salvati

onDATA.co

m

Page 6: Image From Hdd With Severe Bad Sectors in Data Area

After setting the parameters, you can switch to Sector View interface and inspect the content of any section. Once

you input any LBA in DEC or HEX (DEC means Decimal number, HEX means hexadecimal), system will

automatically show a corresponding numerical in another frame

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

If the data are all shown as 4040, then it means the current sector is corrupted. It is because that if the data cannot

be read out, the system will define it as 4040.

If the data we see are not 4040, and we can read the content, then we can use Data Compass Explorer

(Abbreviation: DCEXP) to copy the data. Press DC Explorer or double click the DCEXP.EXE file in the installation

directory, this program will be launched automatically.

Salvati

onDATA.co

m

Page 7: Image From Hdd With Severe Bad Sectors in Data Area

After accessing the DCEXP interface, we need select the File Recovery panel. You can view the partitions and the

file directory from this panel, which is called the most vivid way for data view.

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

Click "Open Disk", the logical data recovery software will read all the logical partitions in this drive.

Salvati

onDATA.co

m

Page 8: Image From Hdd With Severe Bad Sectors in Data Area

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

We can see all the partitions in a while due to the layered scan technology of DCEXP. It will first scan the root

directory which can highly shorten the directory read time. Then users can do a selective data recovery for the

usable and important data. One layer to another, this maximally saves the working time. At the same time, you can

directly extract the files or you can do a whole image. During the data recovery, it allows users to image data fully

from the source drive, partition, or any LBA area. As a target, it can reach far to files, or disk. There are also some

handy functions like fast clockwise, fast reverse, exact clockwise and exact reverse functions for you to choose

flexibly. Meanwhile, it can also allow recovering data fast and effectively from any bit of data via "Bitmap

Technology".

All the read partitions will be listed in the left column. Showing the information of the partition or not can be

controlled by clicking "+" or "­".

Shown as the above picture, this defective drives has three partitions. As told by customer, the most important data

is stored in the third sectors. Its content is: NTFS LBA 47407878 SIZE 30732280=15005MB This means

the file system of this drive is NTFS, the start is 47407878 sectors, and the size is 15005MB. Right click this

partition and choose the third line "Image Partition" in the pop menu, namely, to image this partition. Additionally,

right click DCHDD and select "image Partition", then it comes to the "whole hard drive image".

Salvati

onDATA.co

m

Page 9: Image From Hdd With Severe Bad Sectors in Data Area

Then you can see the pop window for you to set the imaging tool. Check below:

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

DCEXP has already calculated the start LBA and the size. This saves a lot of time for the future process. In right

Target setting panel, you can select the Target­ to file or to disk. Imaging to a disk can use together with "Image

Data Area Only". By this cooperative use, DCEXP can automatically judge and calculate the place of effective data,

then image only to this part. A lot of time has been saved and the working efficiency is enhanced.

Salvati

onDATA.co

m

Page 10: Image From Hdd With Severe Bad Sectors in Data Area

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

In this case study, the effective data is imaged to a connected external WD 120G HD. When clicking "Create Task"

to execute the image command, a window will pop up and shows "Creating Bitmap, please wait ". Please note

that when imaging the effective data , it may take some time to be responded, please wait patiently then till the

image is complete. Besides, when imaging effective data, it doesn't mean the capacity of target should be larger

than the effective data. It is because while creating the Bitmap, it will allocate the size according to the partition (not

the disk). So please make sure that the capacity of the target disk is larger than the partition where the effective

data stored.

Till the Bitmap is created successfully, it will redirect to the next screen. Please click "Start" button and begin

imaging. There are parameters of image which you can select on the left "Set Up" panel: Block Size, Timeout (MS).

Also you can choose" Known Bad Sector Retry" option and it can work together with the "Retry Times" in the Data

Compass Panel menu.

Salvati

onDATA.co

m

Page 11: Image From Hdd With Severe Bad Sectors in Data Area

On the right upper panel, the default setting is that the four options are selected: quick obverse image; quick

reverse image; intensive obverse image and intensive reverse image. While running the DC Explorer, it will image

according to the default setting: quick obverse image and skip the bad sectors, then quick reverse image till find the

bad sector again. After the quick obverse and reverse image both are completed, for the non­retrieved bad sectors,

the program will make another the intensive obverse and reverse images.

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

In the process of image, it can show LBA value of any sector by left clicking on any sector on the disk map.

Salvati

onDATA.co

m

Page 12: Image From Hdd With Severe Bad Sectors in Data Area

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

By right clicking on the disk map, there will show up 3 options menu: Lock HDD map, Used count and Sector Skip.

"Lock HDD map can stop scanning statistics map and save the operating system resource; Used Count can figure

out how much percent of the effective of the partition while the last option "Sector Skip" indicates the real­time

image status. As you can see the screenshot below:

You can see clearly the status of obverse and reverse image from the picture below. The target sectors which are

not read yet, the failed read sectors are marked as red and bad sectors as blue. The other colors mean the

different sector respond time.

After the image finished, you can use logical data recovery programs to scan and check the data. ( To protect

client's privacy, mosaic is used.)

Salvati

onDATA.co

m

Page 13: Image From Hdd With Severe Bad Sectors in Data Area

SalvationDATA Technology, LLC. Fax:(+86) 28 68107757 Http://www.salvationdata.com Unauthorized copy or distribution of this document is prohibited.

SalvationDATA Data Recovery example application

So far, the complete data recovery process is done and retrieve the data! Data Compass is a professional data

recovery tool and we have the complete intellectual property rights for this equipment. It is not only designed to

solve the logical malfunction, but also more lean to recover data from defective HDDs which have physical

malfunction. Such as physical damage on sectors, read instability, and firmware corruption

The purpose of our development is to change the traditional data recovery ideas and methodib

Today, the 21st century, we are in a data era more than information era. User's data volume is rapidly increasing

along with upgrading of storage products. The HDD 80G, 120G, 160G, we all thought it was enough for use not

long ago, is disappearing

With the tremendous growth of electronic data, our file container is becoming empty. However, on the other hand,

followed by this, there is more chance to lose data stored in media. Furthermore, as the density of media becoming

higher and higher, the need of data recovery cannot be met by the traditional data recovery method For example a

500G hard drive, and the ordinary imaging speed is 2G per minute, it will at least take 4 hours to complete imaging

work. If the defective hard driver with severe physical problem, the time of imaging will be unable to calculated.

Data Compass applied with 9 patent technologies, especially with Shadow disk technology and SA emulation

technology which laid solid foundation for directly extracting data from defective HDD, it is greatly improve the data

recovery success rate and efficiency

Data Compass will change the traditional data recovery mode, and represent a new data recovery trend

Salvati

onDATA.co

m