After Hours·5,428 discussions

HARD DISKS

Locked

blog root

Topic

Data Recovery Techniques and Tools…

In reply to HARD DISKS

Recover magnetic surfaces, that has damages or that was erased
This is possible ? impossible ? what could be ?
A point of view
by Jose Pinto
How is possible to recover a file or some files from a disk that is damaged ? There is only one way; first we need to fix the disk and here in this point we have the big difference between companies, we will find companies that has different skill to fix different damages, we will find professionals that have more experience in phisicals then in logicals and when we say phisicals we are not only talking about damaged heads, we are talking about all things that can in some how stop the funcionality of a hard disk. So we will have not only mechanical damages but also eletronic damages and also System Area damages. All this areas can cause a problem in disk that will stop it. There is no miracles in this work but skill and a big knowledge of disk funcionality, after this job donne ? fixing the physical damage ? there will be a job that most part of the Data Recovery Professionals will do and they will find evrything that is possible to be read. There is no miracle, I do not believe.
I know that people will say that this company say this and that company say that but for real commercially in real world there is no machine to read pattern in a magnetic disk. Not like we suppose to read and hear from some companies. This kind of talk is more marketing then anyother thing. Yes the teshis can be real they can work but not for comercial market not for our daily jobs. People will say ? but Action Front is using this technic , Ibas is using this other. Yes they can say but I have the right to do not believe. I have read a lot not one thing or 2 but hundreds articles for more then ten years and all them about data recover, and I have never really found something that can be comercial that can read magnetic plattes. And here I will put part of somethings that I already saw and that will help me to clarify what I?m saying. I would like to say that everybody have the right to do not agree with me and also to do not believe me I just would like to say what I think what is my opinion.
Here part of an article from Dr. Peter Gutmann from the Department of Computer Science
University of Auckland.

?In the 1980’s some work was done on the recovery of erased data from magnetic media, but to date the main source of information is government standards covering the destruction of data. There are two main problems with these official guidelines for sanitizing media?

?Magnetic force microscopy (MFM) is a recent technique for imaging magnetization patterns with high resolution and minimal sample preparation. The technique is derived from scanning probe microscopy (SPM) and uses a sharp magnetic tip attached to a flexible cantilever placed close to the surface to be analysed, where it interacts with the stray field emanating from the sample. An image of the field at the surface is formed by moving the tip across the surface and measuring the force (or force gradient) as a function of position. The strength of the interaction is measured by monitoring the position of the cantilever using an optical interferometer or tunnelling ?

The article was originally published in the proceedings of The Sixth USENIX Security Symposium, July 22?25, 1996, San Jose, California, USA

Here something that is based in Jim Rice work He is or was involved in Nanotechnology.

NanoTools: The Homebrew STM Page”, Jim Rice,
?Even for a relatively inexperienced user the time to start getting images of the data on a drive platter is about 5 minutes. To start getting useful images of a particular track requires more than a passing knowledge of disk formats, but these are well-documented, and once the correct location on the platter is found a single image would take approximately 2-10 minutes depending on the skill of the operator and the resolution required. With one of the more expensive MFM’s it is possible to automate a collection sequence and theoretically possible to collect an image of the entire disk by changing the MFM controller software.
There are, from manufacturers sales figures, several thousand SPM’s in use in the field today, some of which have special features for analysing disk drive platters, such as the vacuum chucks for standard disk drive platters along with specialised modes of operation for magnetic media analysis. These SPM’s can be used with sophisticated programmable controllers and analysis software to allow automation of the data recovery process. If commercially-available SPM’s are considered too expensive, it is possible to build a reasonably capable SPM for about US$1400, using a PC as a controller?
I also can put here another related job that is named the ?Tunneling Theory?;
Scanning Tunneling Microscopy (STM) tunneling theory is quite complex, but may be simplified greatly by several approximations. STM involves the tunneling of electrons through vacuum from the tip of the STM to the sample. For simplification, this can be considered as tunneling between two metallic electrodes, separated by a vacuum region. The potential in the vacuum region acts as a barrier to electrons. In this simplified form, one can apply the trivial solution of the Schrodinger equation, applied to a rectangular barrier…
So readding all theses articles we can suppose that if IBAS can or if Action Front also can, we all can too. But in my researchs I conclude that this is not for comercial jobs is not for our daily cases, this are Thesis this are cientific jobs to be donne ??N LABORATORIUN? all this are wonderfull but not pratical you can not use this kind of things to read a 80gb disk with 40gb data inside. I also belive that people or better saying companies that wrok with Forensis can use this technics but not DR people.

Here is part of something that I found has along time ago , just read it and them come back to the begin of Dr.Peter words and you will understand a little bit more.

?In the early 1980’s two IBM scientists, Binnig & Rohrer, developed a new technique for studying surface structure – Scanning Tunnelling Microscopy ( STM ). This invention was quickly followed by the development of a whole family of related techniques which, together with STM, may be classified in the general category of Scanning Probe Microscopy ( SPM ) techniques. Of these later techniques, the most important is Atomic Force Microscopy?

Also one interesting part of all this things that you are seeing above is that has people that use this articles to say that erase in needed because people will recover files that evrybody think that is impossible otherwise has people that uses same words to say that they will use this tech to do data recover. Fanny but they have same obejctive ? they are doing advertise of theyer job.
Anyway here , a little bit more of this techs

Scanning probe microscopy is a branch of microscopy that was founded with the invention of the scanning tunneling microscope. It is a microscopy technique where a probe only has a significant interaction with a very small volume of the sample specimen. An image of the sample is obtained by mechanically moving the probe with respect to the sample so that the sample is scanned line by line, and recording the probe-sample interaction as a function of position.
Many scanning probe microscopes can image several interactions simultaneously. The manner of using these interactions to obtain an image is generally called a mode. The best established types of microscopes/modes are:
STM: scanning tunneling microscope
AFM: atomic force microscope
MFM: magnetic force microscope
EFM: electroscatic force microscope
SVM: scanning voltage microscope
KPFM: kelvin probe force microscope
SCM: scanning capacitance microscope
FMM: force modulation microscope
SThM: scanning thermal microscope
NSOM: near-field scanning optical microscope
Advantages of the scanning techniques are:
The resolution of the microscopes is not limited by diffraction, but only by the size of the probe-sample interaction volume, which can be as small as a few picometres.
The interaction can be used to modify the sample to create small structures (Nanolithography).
Disadvantages of the scanning techniques are:
The scanning techniques are generally slower in acquiring images, due to the scanning process.
The maximum image size is generally smaller.

So we can conclude that in paper everything is possible, can you guys imagine the effect that the advertising with some thesis of famous cientist can cause in some companies or professionals that need the data recovered, how safe they can fell ? Did you had the experience of data loss ?.
The people who use this knowledges are professionals they read everything that exist about DR or that one day someone already wrote about DR and they are masters in uses this to get jobs, to say that they know things that most part of professionals and companies do not know, and they are not saying lies because the part that says that the majority of the professionals involved in DR do not know this thesis and technics is true. The most incredible part of all this is to say or write that these techniques are commercial and that they are used for them frequent. Sorry but this… I really do not believe.

What is the best hard disk ?

In reply to HARD DISKS

Hard Disks – who is the best on market theses days ?
To be honest, I need to put here a comment in first place ? “Is not important what is the best hard disk or how fast is it or if its warranty is 1 or 5 years or if the hard disk is 5400 rpm or 15.000 rpm, nothing is most important them the back-up of the data that is inside the hard disk, this is what really matters.
I will say that nobody in the world is a 100% shure or right when he say that this disk is better them this other one, when we are talking about same kind of disk all them are equivalent, the differences when exist are so small that really does not matter.
Today the companies are all bigg companies and they will not compromises theyer position in the market doing a bad disk, we can have a disk with a very small project problem but to say that one is better them other this is a very hard comment and to say this is necessary to have all secret information from factory and I do not believe that professionals that work in DR or in sales have access to this kind of papers. We all know that the HDA are all same , the heads too, the eletronic parts sometimes are so equal that some of us make a lot of mistakes so how is possibe to say what is better ? what we are gonna use ? who has the information ? the real one ? of the MTBF of the disks that is manufactured this year ? and who here can explain to me how the MTBF is calculated ? and why a disk that was projected to be used for 5 years ( at least ) does not work (without have one kind of problem) 2 years ?. Is too dangerous to say that the disk of manufactur X is better then the disk of manufactur Y , without read the manual of them and without know if they are similar and if they have same price, if they was manufactured to compet at same segment , who is at DR business or at hard disk repair business that has the proper knowledge to give me theses answers ? a minor very minor part of people that are involved in hard disk market already read one hard disk manual from page one to last page. So in name of god how they can have the proper condition to say HD Y is better then HD X ?
Data recovery people are all the time looking for solutions to solve hard disks problems not to talk or read about disks comercial market or strategy of manufacturers, so I decide to write this article and to put in it some informations that will help a little.

One way to assess the importance of an item of hardware is to consider how much grief is caused if it fails. By this standard, the hard disk is the most important component by a long shot. As I often say, hardware can be replaced, but data cannot. A good quality hard disk, combined with smart maintenance and backup habits, can help ensure that the nightmare of data loss doesn’t become part of your life.

The next topic is good for end users
So is one hard disk drive better then another?
When purchasing a hard disk drive it is important to understand and verify the hard disk drive is suitable for your uses and has or does not have the options you may or may not need. Unfortunately with hard disk drive technologies changing everyday it is can be sometimes confusing and frustrating when looking to purchase a hard disk drive.
Over the last few years, the reliability and storage capacity of hard disks has increased dramatically to meet the demands of powerful and disk hungry operating systems. However, there are occasions where hard disks fail.
We at Data Recovery have experience with almost every manufacture and do not believe that any one manufacture is better then another. We believe that every company can and will experience issues with their products.
One very good guide is to base your decision on the experience friends or coworkers
This can be a debated question; however, all answers generated are based on the user’s experience that you ask. Users that tend to like one manufacturer when compared to another generally have had a better experience with that manufacturer.
Computer users has had good and bad luck with almost every manufacturer and really do not believe that one manufacturer is better than another. We believe that every company can experience issues with their products regardless of the name of that manufacturer. When purchasing a hard disk drive, you can base your purchase off of other individual’s experience or the overall specifications and available options of the hard disk drive you may be interested in.

Better to say to all end users and companies is ?There are 2 kind of disks and only 2, one that already stops and the others that will stop one day.
To technical people I will write here some things that I already read:

For selecting a new hard drive we can boil the capacity and performance issues down to the following points:
The disk capacity – the size of the drive is an important consideration, bigger drives hold more. At the same time, don’t overspend on an enormous drive unless you do a lot of downloading or working with large graphics, audio and video files.

The spindle speed ? one of the most important differentiators between different drive models from a performance standpoint is the speed at which the spindle spins (and thus the data platters as well). For IDE/ATA, the fastest drives spin at 7,200 RPM; slower ones go at 5,400 RPM and also4,400 rpm in some notebook disk that still are in use. The faster disks provide both higher transfer rates and faster random access to your data.

The seek time – this specification will give in milliseconds refers to how quickly the hard disk’s actuator (the device that moves the head assembly) can position the heads to a random place on the surface of the disk platters. It is a very important performance specification; the lower the number the better and even differences of 1 millisecond can make a difference in performance in some situations.
The areal density ? this specification refers to how much data the drive packs onto each of its platters. It can be found listed in the product manual for the drive, or you can sometimes estimate it for comparing drives of the same form factor by dividing the size of the drive by the number of platters inside the drive. New disks pack data more densely, improving both capacity and performance. (Note that some drive sizes in a family may use half of one platter or even some other fraction, so be careful in doing these calculations).
The sustained transfer Rate – this specification indicates how fast the drive can stream data off the surface of the platters during sustained reads of many megabytes of data in a row. The higher this figure the better, but small differences between models usually are not so significant.
The interface Speed – both IDE/ATA and SCSI operate at several standard speeds. For IDE/ATA drives the current standard is Ultra ATA/133, where the “133” standing for the interface’s maximum potential throughput, 133 MB/s ( normaly the real speed of this disks are no more then 60 ). In theory, faster interface drives are better, but for most PCs the speed of the interface has little impact on overall hard disk performance, as long as the number is above the maximum sustained transfer rate of the drive (see under “magic numbers” below for more).

We also need to use the quality selection criteria since the hard disk is the only component in the computer where failure means that the user will have a much bigger problem on his hands than merely getting some hardware replacement. Users need to take care about data! And for this reason, quality is probably more important for this component than it is for any other.
Here are some specific quality criteria to look at when evaluating models:

The MTBF – as with power supplies and some other components, MTBF for hard disks stands for mean time between failures. It gives an estimate of the quality of the drive by approximating the number of hours that will elapse between failures when a group of drives of this type are run for millions of aggregate hours under ideal conditions. It does not mean how long you should expect any particular drive to continue running. A model with a significantly larger MTBF figure can be reasonably predicted to last longer than one with a smaller value, but remember that these are just engineering estimates.

Some disks has the Service Life, this means the manufacturer’s designed life expectancy of the drive. For the stated number of years, the manufacturer of the drive believes the unit will work reliably and safely; beyond that point the drive may continue to work but the chance of problems increases significantly

The warranty time – the number of years the manufacturer warrants the drive. Watch for discrepancies between this figure and the service life of the drive–whichever is lower is what the prudent person will trust!
The warranty policies – some companies provide much better warranty service and coverage than others, and this is considered a quality indicator.
Observe noise and vibration, as spindle speeds and actuators get faster, drives make more and more noise unless careful engineering is done to counteract it. For some people this is not much of an issue, but for others it is very important. Disks come with objective noise specifications, and most reviewers also assess the amount of noise made by the units they are evaluating.
Quality and Reliability Features most disks come with a number of features that are designed to improve the integrity and reliability of drives. A few of the more important ones you may wish to look for are: “SMART” technology, the enhanced shock protection, head load/unload technology, temperature monitoring, and enhanced automatic defect mapping.

I would like to write here about the importance of the manufactur, we will always find some people who insist in say that one manufacturer makes higher-quality drives than another based on theyer personal experience – – and someone else who says the exact opposite. The reality is that in most cases, quality units are made by any of the half-dozen or so big-name hard disk manufacturs. The biggest differences between manufacturers are related to warranty coverage and warranty policies. Also we can try to read about the components lifetime the reliable service life of a typical consumer-level hard disk drive is around three to five years. Some drives work for a decade or longer, but every year that passes after three or so increases the chances of a failure. Disks go obsolete very slowly: you can plug a 10-year-old IDE/ATA drive into a modern system and make it work. However, bigger and faster drives come out every year..
Now we can start to get some informations that will help us ( since we really read and learn ) to say some words about diks quality and about best choices.

I think that with this article I can give a small contribution to clarify and to help all people about the quality of disks and how someone can choose a hard disk to put in his computer.

Jose Pinto

[Author]

Replies