claumarius

How to recover data from a hard drive platter

Recommended Posts

Does anybody knows some information about the procedures and devices used for direct reading a hdd platter, to recover the data from it?... instead of sending to companies specialised in this kind of stuff?? I rather want to try myself, I am also a technician but I don't posess information... so please help!!! Thank you in advance.

Share this post


Link to post
Share on other sites
Does anybody knows some information about the procedures and devices used for direct reading a hdd platter, to recover the data from it?... instead of sending to companies specialised in this kind of stuff?? I rather want to try myself, I am also a technician but I don't posess information... so please help!!! Thank you in advance.

First, refer to the SR FAQ here for some basic information.

Data recovery firms have highly specialized (and expensive) equipment. You will not have the tools necessary to do your own recovery it if it's more complicated than maybe a board swap. Even disk drive manufacturers send out failed drives for professional recovery.

Share this post


Link to post
Share on other sites
[...]

Data recovery firms have highly specialized (and expensive) equipment.

[...]

Do they really? What kind of equipment do you think they have?

Please be more specific then "highly specialized (and expensive)".

My position is that they don't, but use similar equipment to swap parts and if something really mechanically or electronically difficult comes along they hand you back your drive and still charge you a hefty fee for "checking it out".

They use pretty good software for analysis but that kind of software like "Ontrack Recovery..." is available to persons who dig in a little.

Share this post


Link to post
Share on other sites
[...]

Data recovery firms have highly specialized (and expensive) equipment.

[...]

Do they really? What kind of equipment do you think they have?

Please be more specific then "highly specialized (and expensive)".

My position is that they don't, but use similar equipment to swap parts and if something really mechanically or electronically difficult comes along they hand you back your drive and still charge you a hefty fee for "checking it out".

They use pretty good software for analysis but that kind of software like "Ontrack Recovery..." is available to persons who dig in a little.

Share this post


Link to post
Share on other sites

I think they use regular equipment like a hard drive head to read the sequential 1 and 0 data off the disks. But what would such numbers mean to you? Each drive manufacturer probably has a proprietary way of marking where the sectors are, etc and these markers would be inline with the stream of numbers. Not to mention you'd have to be familiar with how the OS marks pieces of fragmented files. The ways to decode such streams into files and folders are probably the most closely guarded trade secrets of the recovery service firms.

I saw how they did it on TV and it was a riot. I think it was on "CSI" where an agent brought in a drive that had been in a fire. The tech tried to BOOT from it, and failing that, she DISASSEMBLED the drive right at her desk and took out the platters. While HOLDING the platter in her gloved hand, she WAVED what looked like a bar code wand over the disk and wondrous pictures from the drive appeared on her monitor, one of which happened to provide an important clue to the case. Took less than two minutes :rolleyes:

Share this post


Link to post
Share on other sites
Do they really? What kind of equipment do you think they have?

Please be more specific then "highly specialized (and expensive)".

My position is that they don't, but use similar equipment to swap parts and if something really mechanically or electronically difficult comes along they hand you back your drive and still charge you a hefty fee for "checking it out".

Yes, they do. I can't be a lot more specific than "highly specialized (and expensive)" because it will depend on the specific parts they are trying to remove/reinstall. For example, when we manually remove a headstack in the lab (assuming a CSS drive, thus no ramp), there's a very specific order and set of tools we use so we:

1. Don't kill the heads from ESD.

2. Don't damage the heads mechanically.

3. Keep them clean so they don't corrode.

These tools are not something you can buy from your local hardware store or even a specialty electronics shop. In a pinch, I've used broken bits of toothpicks to hold the heads apart, but it's less than optimal and I was only working with mechanical headstacks (ie. I didn't have to worry about ESD). It'd be much touchier with live parts. Normally, we have such tools custom fabricated for a specific drive product so the spacing is correct.

But this order is different depending the exact mechanical design of the parts. Some drives attach the headstack with screws, others nuts, some spring clips, etc, etc. Each of these methods may (and usually do) require custom tools.

Once they remove it, then there's the issue of trying to read back the data. I suspect they use a spin stand since it isn't practical to stock every possible headstack configuration. I don't know how much these cost exactly, but if I had to guess it'd be easily at least 5 figures in US dollars. This allows you to use different slider designs and read one head at a time and not need a physical headstack.

The fees they charge are a combination of the specialized equipment they have, including software, *and* the expertise on how to use it.

Share this post


Link to post
Share on other sites

Yes... thank you for your opinions and advices... Hmmm, it seems that I have to dig further on the net to find a hardware device who is capable to mount the platters and read the sequential data, and with an appropriate software, pair those informations and regain the original data. I already found a pci device with some dedicated software plus some ROM software from few specifical hdd,,, but all function only if the hdd spins up and rotate well... it's name is pci3000 and made from Russia... you can check on the Internet. But they don't do anything if the heads are "broken" or something else I can't replace... so it's a matter of raw reading and after pairing the information... these kind of stuff I look... Anyway, thank you very much for your collaboration and if I'll find something, I'll let you know!!!

Share this post


Link to post
Share on other sites

Please keep in mind that if you actually intend to expose the platters, you should only do so in a clean room environment, lest you contaminate your platters beyond any capacity for data retrieval.

Share this post


Link to post
Share on other sites

To start you need a level 10 clean room (1 cubic meter of air must contain no more that 10 elements of dust)

If you wanna do it on yourself it is possible, but do not expect to succeed, like everything it takes practice, and allot of it in this case...

If you buy 20 used harddrives for cheap and take them apart and manage to put one of them togheter so it works long enough for you to read any information at all from it my hat is off to you...

http://hddguru.com/content/en/articles/200...dstack-Q-and-A/

Share this post


Link to post
Share on other sites

I can't speak for other recovery firms, but yes, for the most part we do utilize highly specialized, expensive tools. Specialized because nearly every drive manufacturer has their own quirks, which means we have tools just for Maxtor, WD, Seagate, etc. Expensive, because what we need is generally fabricated specifically for us. The data recovery industry does not share it's technology among one another for the most part, which means we have to be pretty self reliant. I would say for the most part, all of the big data recovery companies pretty much utilize the same type of software utilities, both commerically available and proprietary since no single solution works in every case. For example, we have at least 14 different recovery methods we utilize.

As far as pc3000 is concerned, this is something that is probably not used nearly as much as people think it is. You can really only use that tool in very specific situations, and even then you have to be extremely cautious, since you can easily render the data completely unrecoverable. I would say that this is probably one of the most dangerous tools out there, but if you have 12-15K to spend and play around with it, then I say go for it.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now