Random Notes and Ideas For Data Recovery
- 1. Drive goes to sleep, replace the board live
- 2. Partitions start on Cylinder Boundaries
- 3. Hard Drives have a Safe Mode
- 4. You can fix LaCie problems with a Mac mounting them in the system
- 5. Drives that you plug in that cause windows to Crash – Use Ubuntu to Read Files
- 6. When problems with MFT then retry smaller blocks
- 7. If drive parts are good then rewriting the SA area is the part that needs repairing
- 8. SA Code can be replaced to do data destruction or encryption
- 9. If you are thinking of a hard drive as 0’s 1’s then you are wrong. The equipment interprets signals to make the representation of 0s or 1s. Designers have taken into account the signal distortion and interface problems to make the work
- 10. Remove a chip from the PCB and re-solder the chip onto a good board to fix specific problems with chips that are burned, cracked, etc
- 11. Soft resets on SATA also need to do a hard reset the controller as it cannot be reset any other way like the bus is reset in a PCI or ATA
- 12. ATA-3 Spec – hard drive read without retry was disabled and now is internal on the drive
- 13. Seagate Drives use a serial interface of which you can find online. It will show you stats on the drive. If you see FFFF mask FFFF mask it is a head error
- 14. If a drive is read with a standard read then it does not need to be read again but it might be good to use ECC to compare in a later pass
- 15. Force the drive to use PIO mode instead of DMA/UDMA modes. Some hard drive failures cause the drive to fail reading UDMA but might still work in PIO
- 16. Powers on good drive, while board is still in use move it to a new drive. Wrong defect tables and can be cleared
- 17. If the platters are misaligned you can write data over the servo wedge and thereby destroying any chance that you can ever read the data
- 18. As the thermal heat increases stability of the bits drop rapidly and with the addition of Areal density – degradation is much higher. There are fewer atoms in each bit to retain the bit orientation. Currently the drive will test for decay and if detected will automatically rewrite the data it detects
- 19. Hard drives stored in heat for long term storage is extremely bad
- 20. Adaptec ATA Raid 1200A Controller in combination with MHDD is great for recovery software.
- 21. To determine if there is an HPA – Look at the LBA Maximum and if it is equal to Maximum Native LBA then there is no HPA
- 22. Partitions created using standard disk partitioning tools, fdisk, Windows Disk Management, Partition Magic, will all be cylinder aligned. You only have to scan cylinder boundaries for partitions. Dynamic disks do not use partition tables, they use LDM which is at the end of the disk and needs to be done backwards. It uses one single partition occupying the entire disk minus one cylinder. When volumes are added or deleted the partition table is not updated. There are only 4 partitions possible with the standard Windows tools
- 23. All partition table signatures end in 55 AA – if this is gone the OS will regard this as not existing. 80 is active 0B fat32 0F extended
- 24. Everything in NTFS is a file – $boot
- 25. Sector is the smallest addressable unit on the disk. You can read more than one sector but you cannot read less
- 26. If doing a head replacement try straws for head stack replacements around the heads to keep them protected. Cut off a small piece of a drinking straw and place it over the head area of each and every head
- 27. Even when the lower part of a head stack does not have heads they are still numbered.
- 28. Increasing numbers of drive have no chance for parts replacement due to changes in the hardware
- 29. Some drives store the lists in the NV Ram on the PCB. The table on one drive will not match the table on another drive and are unique. That might cause the same logical blocks to be mapped to different physical blocks on different hard drives. It is possible to have a swapped board cause a space on the hard drive to be overwritten due to the mapping problem.