When a hard disk drive arrives at our laboratory, our hardware engineers assess its condition before proceeding with the data recovery. Before the drive is powered up, it is important to determine if there is a fault present in any of the components of the hard disk, to avoid causing any further failures.
Once any repairs have been affected the data recovery process can then be undertaken. The first part of this process is to take a sector-by-sector image copy of the hard disk drive to secure the data. Attaching a hard disk drive to a Windows machine may also lead to the operating system making undesirable changes to the drive or volumes held on it, so it is important to secure the data without this occurring.
If you are thinking of attaching your hard disk drive as a slave, or via a USB connection to your computer, it is worth reading our article “My Friend Can Recover My Data” to understand how this may risk your data files. Such actions could complicate the recovery process due to additional failures or through changes made by the operating system.
Hard Drive Failure
Even a working hard drive could suffer a failure, which is the reason for securing a sector-by-sector copy of the disk. The failure of any single component of a hard drive could lead to erratic behaviour when attempting to access the disk, which may lead to an additional failure.
A drive which has suffered physical damage to the surface of the drive platters will almost certainly deteriorate over time. It is therefore important to recover all the readable sectors as quickly as possible before this happens. Some conditions can eventually lead to a complete failure of the drive, beyond which no further data can be accessed, so it is important for failing drives to be handled correctly to maximise the data recovered.
Bad Sector Issues
During the imaging process, our hardware specialists are always checking the current health of any drive undergoing data recovery. If a drive should encounter a damaged area of the disk, and in particular start to make scraping and clicking noises, they will interrupt the imaging process, to allow these bad areas of the disk to be skipped.
This is done to maximise the initial yield of good data sectors from the drive, before attempting to a process called patching. The patching process is run after bad sectors have been encountered, attempting to fill in areas of the image which were skipped during the initial imaging phase. This has in some cases where there is minimal damage, led to the recovery of all sectors from the drive.
Data Recovery Using Image
By maintaining a bitmap of all sectors successfully recovered, a proprietary bad sector mark can be returned when processing the image. This allows the data recovery software to detect bad sectors, and perform the appropriate tasks necessary to handle the file system damage, and in some cases overcome the problems such an unreadable sector creates.
By working from an image, a virtual volume can be created, with any necessary data structures which need to be created, placed in a separate data file, so that these changes will not affect the original images.