Case 3 - DAMN YOU VILE DRIVE. DAMN YOU!
So, just another day at the office like any other but occasionally I will get jobs like this one. Something that seems simple at first but ends up complicated much later...
I have a WD here sitting on my desk. When drives are evaluated, they are give various levels based on what is wrong:
Logical (degraded surface)
<- Sometimes the worst jobs in existence
Depending on what is wrong, what is needed to recover the drive or in what combinations there of justifies the pricing given the customer. Simply put: More complicated = More expensive the recovery
This drive is a WD 2.5" which it seemed to just have some bad sectors. No biggy. Using the recovery equipment at hand those can easily be rectified or at least controlled. This one however turned mechanical... Which is the worst. Once a job is quoted you cannot go back and say, "Hey, sorry, but it is going to cost more". That is just bad business.
This all happened after this drive was approved... But let's start from the beginning?
I found an appropriately sized image drive to use and began imaging. Whenever you start an image, you always create a head map. Trust me it makes life easier.
This drive in particular has 4 heads: 0 1 2 3
During the imaging process all is going well. Drive is hitting some bad sectors and occasionally destabilizes. That is fine, just have to tweak things and continue. Each drive is different and each one you can get away with certain things. Other ones I need to do entire scripting to make a drive do as I ask.
I let it continue. This is a 500GB drive so it will should take about 4-8 hours for the imaging complete before I can begin the extraction (which sometimes involves reading and reconstructing from the MFT to get a working file system). So, without further to do, I just let it go.Come the next morning.
The drive is still imaging? O-o odd. I look at the sector map and it is filled with sporadic bad sectors. 28k of them! huh? wut?
Okay, time for a little test. I stop the imaging and try to re-read the bad sectors. Guess what? They read fine. Hm... looks like we got a weak head here.
Lets just turn off the offending head (head 1) and imaging the rest.A while later...
I come back to the job and all the other surfaces are done imaging. Great. Problem is that I still have almost a 4th of the drive that is not imaged. Hard drives don't write data a per platter basis but instead tend to jump around in a certain order. It is usually 50-250k sectors then jump to the next head. In some cases it can be more or less. Other times they move up and down or butterfly (8 heads so 012345676543210 or 01234765401234 etc). Very confusing. But that is what can make recovering data a pain in the butt. Why? You have NO idea where the data is on the drive or what platter(s) it is stored on. That is why if 1 platter cannot be imaged it can result in a completely unrecoverable drive. Fun times. Glad I am not the one who has to talk to the customer. I just talk to my machine and whisper naughty things to hard drives. You know, gotta give them a little motivation!
So, what do we do? Well, we got a couple of things:
1) Image the drive with all other heads but the weak one disabled. During imaging have it automatically skip 256 sectors each time it hits a read error.
2) Find a matching donor and swap heads. Re-read all the bad sectors and continue imaging. Then pray. Yes, there is a lot of praying here. Hope you are devote and loyal to your religion. Your gonna need it sometimes.
Well, first option is a no go. The bad sectors have no order to them. Sometimes when there are bad sectors they come in slivers or clumps. Other times they are just random and have no rhyme or reason. Unfortunately, there is no reason here...
So, we could just keep reading and let it do its own thing. Problem is that there is no way of knowing if and when the weak head will fail. Nor do we know how long it is going to take. Imaging a drive like that could take a month or a weak. Deadlines are set and must be met. Path of least resistance is always best in these situations. Though, sometimes that is not always the easiest...
Well, I guess I have to do it. Head swap is needed. I have to go get a good set of head on this drive and finish reading it. It is the only way to either:
1) Avoid a long drawn out recovery
2) Possibly cause a catastrophic drive failure with possible platter damage occurring. I am in the business of recovering data not loosing it.
Off to our VAST donor library. Nothing like having 6000+ drives on hand. Comes in handy. Really handy. No need to buy a part and wait. Buying parts can be a problem because a lot of times you need a specific drive. Well, if you need a specific drive you go to specific places that sell drives with their specific identification. There are companies out there that specialize in finding, recording and offering hard drives with all their indentification. Cost for said donor from said places? 300. Nope. Not happening. Besides, we have 6000+ drives in stock. Why do I need to order one?
Let's look through the library's indexing system and bam. Found it. Guess what? Near perfect match. Just about 2 months off of the DOM (Date of Manufacture). Couldn't find a better match than this.Cleanroom!
Head swap complete. Plug in the drive and pray. Well hell. Why is this drive not wanting to get ready? Oh.. derp. Screw loose on the PCB. FALSE ALARM!
Drive is imaging better but that surface sure is messed up. I reduced the number of bad sectors from 28k down to less than a 100. Not bad. Still slow going but less painful than before. I will take that thank you very much.
What do i need do from here you ask? For one, this drive is FAT32 formatted and its file system is wrecked. After I am done with the image I will have to do a scan through both of the FAT directory copies and do a composite build of the file system. Then, if it works out, extract data. All in a day's work.
Why is data recovery so expensive? I give you this as my answer. Merry Christmas.
Edit: Fixed some grammar issues and added some clarity.Edited by Lord Xeb - 11/28/16 at 9:17pm