What is Data Recovery Imaging – Creating a data recovery image is the single most important process of data recovery. Although there is a slightly different process to image the NAND flash of a smart phone or similar device as compared to a hard disk drive, the basic idea behind imaging is to do what is necessary to read a sector and copy that sector to a good working intermediary device. In our case we use redundant stand alone servers in conjunction with our data recovery machines to hold the image created. Using one of our data recovery machines, the original customers drive (patient drive) usually with the use of donor drive parts is copied sector by sector to create an exact bit for bit image of the original drive which will later be used to perform the actual data recovery. The imaging process is read only and non-invasive to the original drive and is completely isolated from any operating system and outside influences. Our data recovery machines can facilitate the operation of a hard drive even when there are some mechanical/physical malfunctions. They can also access manufacturer specific features/functions of the hard drive that would be inaccessible to the end user. Some of the features of our data recovery machines during imaging include: slowing down, speeding up, reversing direction, and repetitively reading and hovering over problem areas of the drive to read and image problem sectors. This allows us to image sectors that would not normally be readable. There are also many advanced capabilities of our data recovery machines including the ability to image sectors ignoring corrupt header information or imaging ignoring ECC (Error Correcting Code). Sometimes the original drive allows imaging at a very fast rate and other times the machine can reach an area where it has to slow down to a crawl using varying techniques to be able to image the sectors that would otherwise not be readable. Lastly, custom algorithms can be written to provide even more specific functions for interaction between the machine and the original hard disk drive. Keep in mind hard disk drives are very delicate and precision devices micro machined with very small and exact tolerances. When one or more of these parameters change, it directly correlates to the ability of the read/write heads to function correctly. Some typical anomalies associated with imaging are the following:
- Parts Variation- The use of donor parts will vary from the original parts which are factory tuned during manufacturing to the original drive. This results in the scenario where multiple donors might be required to complete the imaging process with some read/write heads more compatible to the originals. This adds additional time to the task and multiple adjustments need to performed to compensate for the variances of the parts
- Platter Degradation – The deposition material on the platter surfaces change on the molecular level over time becoming weaker similar to the magnetic strip on a credit card but on a much smaller scale. As the areas weaken, their ability to yield data to the read/write heads lessens. Even though hard disk drives have a firmware mechanism to allow for the relocation of bad sectors, there becomes more and more areas to be reallocated with eventual failure of the firmware’s ability to keep up.
It is important to note! Data recovery imaging can often take an extended amount of time to complete. Depending on the many variables associated with imaging, the data recovery machines can adjust and compensate to gain access to sectors where under normal circumstances it would not be possible!
Common Problems Associated With Disk Imaging
i. The physical properties (on the molecular level) of the material deposited on the platters can degrade over time losing its ability to “write to” or “read from”. High traffic areas that have been written to and read from many times have a higher incidence of failure.
ii. An exact amount of current is used to move the actuator arm with its respective read/write heads to an exact location of the platters based on the servo tables. If any of the very precision tolerances change in the bearings of the spindle motor or armature, the originally specified parameters will no longer be optimal and result in sectors that can not be read. Keep in mind, hard drives are tuned from the factory to very exact tolerances unique to each and every drive. Also, unique adaptive start-up parameters to each drive are provided during manufacturing.
iii. Donor parts depending on the drive, can be identical in every way but can differ slightly in manufacturing tolerances and thus create read issues when placed into the malfunctioning patient drive because of slight variances.
iv. Dust can often infiltrate the internals of the hard drive over the course of its life causing read instability.
v. Self Encrypting Drives: Many Western Digital drives like the Western Digital Passport, Passport Ultra, Passport Ultra Metal, and My Book are self encrypting drives. Western Digital drives also have a utility included with their drive to add an extra level of encryption with a password if a user decides to install and use the utility. Encryption is a wonderful thing when it comes to security; however, when there is a physical malfunction of the drive, encryption can add a tremendous amount of difficulty to the recovery process if the encryption keys are damaged or no longer accessible.
vi. Mac Encryption: Filevault encryption (which comes enabled by default with some Macs straight from the factory), Apples CoreStorage volumes, sparse bundle images and other types of encryption can also add a tremendous amount of time and difficulty to data recovery if there is any single sector damage to an encryption key.
Conclusion: Data Recovery Imaging is a complex process when donor parts have been utilized. Any failed hard disk drive restored to a functional drive will have some anomalies associated with the replacement (donor drive) parts causing read instability and slowing the image building process. We at Recover It All, do our best to fully image every drive for data recovery completely. In cases of damaged drives or sever platter degradation, we fully image the MFT (Master File Table) or Catalog File for Mac’s to completely map the essential sectors making up the users data to only recover what is necessary.