Hard Disk Recovery –Hard disk data recovery
When we talk about hard disk recovery, we first must know how hard disk is designed.
The Hard disk consists of two main parts:
A. Hard Disk Controller (electronic part)
B. Data Storage Area (electro-mechanical part)
The Hard Disk Interfaces controller
The connection between the hard disk and the motherboard is called the disk interface. The data coming from the computer’s processor to the disk must be aranged in a way the disk can understand, and the same transformation must be made when the data goes from the disk to the motherboard. There are currently three popular interfaces in widespread use: Integrated Drive Electronics (IDE), Small Computer System Interface (SCSI), and Serial Advanced Technology Attachment (SATA).
Data storage architecture.
Every hard drive has:
- platters -which store magnetic data,
- sliders with magnetic heads - to read and write data
- actuator arm - to hold the suspension with the slider at the end-
- voice-coil actuator - to move the actuator when the head is accessing data
Basic drive data storage concepts
Track - A concentric set of magnetic bits on the disk is called a track. Each track is divided into 512 bytes (usually) sectors.
Sector - A part of each track defined by magnetic marking and an ID number. Sectors have a sector header and an error correction code (ECC). With modern drives, sectors are numbered sequentially.
Cylinder - A group of tracks with the same radius is called a cylinder (tracks on the picture belong to one cylinder).
Data addressing
there are to methods for Drive's data addressing: CHS (cylinder-head-sector) and LBA (logical block address). CHS is used on most IDE drives, while LBA is used on SCSI and enhanced IDE drives. CHS locates addresses data by simply specifying the cylinder (radius), head (platters side), and sector (angular position). LBA assigns each sector of the drive a sequential number, which is simpler.
If the hard disk crashes there are some possibilities to recover the hard disk and data from it.
Commonly, there are two main reasons of malfunction of the hard disk.
1. Burned or damaged hard disk electronic controllers
2. Physically destroyed hard disk
a) Physically destroyed heads (implicate that the hard disk platters are physically destroyed too) - this happens when the hard disk is old or has had long working hours.
b) Any other physical damage on the hard disk - almost always some human error
(dropping the hard disk even in the working mode)
1.If the hard disk electronic controllers have been burned or damaged there is a more than 80 % possibility that we can recover the hard disk.
If there wasn’t any electrical shock (thunder, high voltage, bad electrical connection to the hard disk or similar), changing the electronic hard disk controller will, in most cases, bring back the hard disk in function.
There are also many possibilities that we can recover most of our data depending on the time the damage had happened.
If the hard disk electronics starts malfunctioning in the full working mode of the computer, then probably neither the MBR or the parttions are damaged. The Hard disk will get some bad sectors .There is a 50%-50% chance the operating system will work after the electronic controllers have been changed.We will lose some data on that bad sectors, but everything else will be accessible.
If the damaged happened when computer had started booting the operating system from the hard disk then MBR, FAT and partition table are damagedUsing some digital forensics tools some of data could be recovered, hoping that there is no bad sectors in MBR. The hard disk can be recovered by low level formatting, but after that no data will exist any more.
2a) If one or more hard disk heads are broken, we can hear some noise when hard disk is working (the most common causes of head crashes are when gets in the thin gaps between the head and the disk, and if shock is applied to the hard disk while in operation.). In those cases there is very rarely anything we can do about it. Also, a data on that hard disk will almost never recover. However, there are some ways to find some data on that hard disk. Using digital data forensics methods it may be possible to access the data. For an average user it would be too expensive to hire a an expert to do that kind of a job.
2b) There is no method that can an otherwise Physically damaged hard disk bring back to life.