While doing an Open university course on Computer Forensics, I though it might be a good Idea to know a bit more about Hard Disks Drives (HDDs) and what they do. Now I knew the basics and of course there is a lot of information out there on the subject as they have been about for many years.
Here is the obligatory link to the Wikipedia page on Hard Disk Drives that gives very detailed but hugely dense (oh a pun!) information on HDDs.
However, sometimes I find one needs to be shown the information in context so the following set of videos found on youTube by Scott Moulton from My Hard Drive Died . They are really very good at giving very detailed information about data recovery, which of course is very useful when doing a Computer Forensics course. The best thing about these videos is that they are aimed at the normal person, as Scott says, your granny doesn’t have $1000 to get her photos back.
Please note these videos are all about what are commonly call "Hard Disk Drives" or "Hard Disks", specifically the type that have heads and cylinders tracks etc (moving parts). Solid State Disks (SSD) which work in a very different way they are very different beasts under the hood they are much faster than standard HDDs but also cost more and come in smaller sizes. They are a bit like the technology you find in data sticks.
After watching the videos them you can see why data recovery companies charge lots of money for this type of service, it can be extremely involved.
If you want to try a few non-evasive methods to get a drive working again jump into parts 4 and 5.
Remember: Always backup your important information so you don't have pay someone to get your important data back! (Or indeed deal with the processes Scott Demonstrates)
For each video I have added the content descriptions and some extra links for easy reference, mostly so I can find them again!
Videos are Copyright 2006 Scott Moulton (Hacking Hard Drives for Data Recovery). Presented at Toorcon by Scott Moulton of Forensic Strategy Services, LLC
Scott is introduced, he then talks about Actuator Locks and Air Pressure, then goes on to tell us why you should not remove the spindle locks as this will make recovery almost impossable.
We then get an overview of basic HDD make up (the anatomy), Scott then gives us a run down on why the circuit board matters for replacement and that one should get a replacement as close to the production date as the target drive. ECC (Error Correction) is mentioned at the end.
Continuing, we learn more about the Air Flow, and Air Pressure in a HDD and how this is used to keep the Head ‘flying’ or ‘flooding’ above the surface of the Platters, Scott covers the mysterious 'Do not cover this hole' hole and dispels the notion that Hard Drives are hermetically sealed (they are not), he then talks a little about Clean Rooms and why opening up a hard drive is a bad idea unless its is broken as it will soon start to fail if you are not in a Clean Room.
We are then told about the filters and about fragment collection such as the silver fragments from a scratch or Head Crash. More Alignment Servo Information is given that goes deeper into the anatomy of the Platters on the spindle, Scott tells us about the Conner's Voice Coil and how should the alignment of the array move out by 0.5 micrometres this will kill the drive. (0.5 micrometres 40 times smaller than the thickness of a strand of hair), finally in this part such issue as Longitudinal Recording Areal Density and Superpara Magnetic Effect (bit flipping) are mentioned.
Continuing on read/writing function of HDDs, Perpendicular Recording and HAMR (Heat Assisted Magnetic Recording) are mention, Scott then tells us how an OS reads and writes to the drive with an animation showing how the heads move rapidly while working in a OS, the leads into why bit steaming for Images (copies) of drives are better than booting operating system and using that to recover important data, this takes us to Computer Forensics and Data Recovery cross overs. Finally in this part, Scott gives us very useful statistics on recovery issues that he has collected over many hundreds of recoveries, In short Scott tells us that recoveries are broken down to: 85% Software. 15% Hardware. Of the actual hardware issues: 10% Electronic (the Board), 4% Head/Platter issues, with just 1% being motor problems.
In this part, Scott's Laws are given, giving us invaluable tips on the Do’s and Dont’s for recovering a HDD, he talks about targeting the files (data) you actually want to recover, not the system files that are of no value he dispels the commonly given advice that putting a faulty Hard Disk in the freezer will help fix it, but then explains cooling is beneficial due to the contracting HDD parts, as long as the temperature is not low enough for condensation to form. Using eBay for finding replacement boards and parts is mention again in more detail. Finally Scott gives us a run down on a number of things to try before opening the drive up. Remember once the drive is opened it will start to ‘die’ as the platters are exposed to the envioment.
Continuing on tricks to try before opening the HDD such as flipping the drive over, Scott talks about the Mac drive and then show us a custom tool he has been working on using USB powered Cooling devices, normally used for drinks he tells us the basic things we would need to know to make one and how to use it (put the cooling side on the metal, not labels). Moving on, Scott talks about replacement tips on the IDE Logic Boards, and detecting where a short is buy using the heat map of the Broad. Finally in this section he start to talk about more detailed recovery, starting with an overview of what Head Crashes are and moves on two tricky Head Replacement (advanced)
Continuing, Scott deals with the issues of HDD Head replacement and we learn that If heads touch each other they are effectively ruined. For the last part of the presentation Scott shows us how to spot signs that the Platter is damaged and that its non-recoverable. For those of us that have to deal with getting data back, Scott give us a few pointers to dealing with Data recovery firms. He concludes with Alignment issues. The start of the Q&A session is on this part and is well worth watching, Scott Moulton really shows us just how deep his knowledge in this field is buy answering technical questions from the audience.
The Q&A session is continued with some more insights into recovery issues particularly Motor issues and why the speed is important. He also talks about the SMART system (Self-Monitoring, Analysis, and Reporting Technology).
Here is a link to Scott Moulton's YouTube Channel where there are many more excellent videos on the field of Data Recovery and Forensics.
There are many more resources, and business services available at My Hard Drive Died Please note that I am not affiliated with the site and have not used their services (yet!), however, that said, seeing Moulton&quto;s technical expertise in the video he and on his Channel, I would think that should the dreaded day come where I need a dive recovered that’s where I would look first!