The majority of hard disk drives arriving at the DiskEng data recovery laboratory in London are suffering from a physical problem. It is therefore essential that it is processed correctly, the first step being to assess the condition of the drive and determine which components if any are faulty and the correct action required to overcome the issue. Failure to assess the condition of the drive and just power it up could lead to any issues becoming worse and potentially cause further damage, even a total loss of data.
If the issue with the drive requires it, our hardware data recovery engineers may need to dismantle the drive, clean the components, replace any which are damaged before rebuilding it again. The next step of the data recovery process is to secure a sector-by-sector image copy of the drive, guarding against any possible failures or increase in damage to the drive. While it may be tempting to just plug a drive into a computer and just access the data directly, this can lead to undesirable changes occurring, as most modern operating systems tend to attempt to fix any file system issues.
Hard Disk Drive Failures
With computers now an integral part of life, it is almost guaranteed that somewhere in the world at least person is exclaiming “but it was working only a minute ago!” While many hard disk drive failures are preceded by warning signs, they are often overlooked, meaning that the vast majority of drives appear to fail suddenly. Any drive which has started to fail must be imaged as soon as possible, as the damage may easily become worse and even lead to other failures with the hard disk.
Once physical damage occurs to the surface of the hard disk platters it will become worse over time and may lead to damage of the read/write heads, which is likely to cause further damage of the media. It is therefore essential to secure the raw data sectors as fast as possible, as repeated attempts to access damaged sectors is increases the likelihood of the damage becoming worse.
Handling of Bad Sectors
It is important to monitor the health of the hard disk drive during the imaging process, as the drive may appear to start reading perfectly, but encounter severe issues later on. If these issues become apparent, our hardware data recovery specialists must interrupt the imaging process, allowing any damaged areas of the drive to skipped, ensuring that the maximum amount of good sectors are captured without endangering the health of the drive, particularly the read/write heads and the surface of the platters.
Once the initial scan has been completed, with damaged areas of the drive skipped, our data recovery engineers initiate the patching process, which attempts to read the sectors which have not been captured. This patching processing employs several advanced techniques, usually sees the number of unrecoverable sectors drastically reduced, or in some cases has seen every sector recovered.
Data Recovery From the Drive Image
At DiskEng a sector bitmap is used to denote which sectors have been recovered, making it fast and efficient to keep track of which sectors have not been recovered. This allows the patching process using our in-house developed tools to be as efficient as possible and all the tools to return an easily identifiable bad sector mark. This is important as it makes it easier to handle the presence of any unrecovered sectors while processing the file system and makes it easier to locate which files have been affected by bad sectors.
If the drive has bad sectors or areas which are slow to access, it would make working directly from the drive potentially slow and also increase the chances of further damage, especially if any bad sector needs to be access many times. Using the secured hard disk image avoids this problem and also ensures that any data recovery quote is guaranteed, as not further damage can occur the drive, once this imaging has been completed.
