Mhdd advanced-diag
5 likes1,721 views
Scott Moulton owns two companies that perform data recovery and forensics. He has over 10 years of experience performing data recovery and forensics and speaking at conferences. The document discusses the goals, phases, and fundamentals of data recovery diagnostics, emphasizing that properly imaging drive sectors is crucial and that tools like SpinRite should be avoided on damaged drives as they could make recovery more difficult.
Mhdd advanced-diag
- 1. By Sco' A. Moulton / www.MyHardDriveDied.com
- 2. ì Data Recovery Diagnostics By Scott A. Moulton / www.MyHardDriveDied.com
- 3. ì Who is Scott Moulton ì I own two companies; forensics and data recovery: ì MyHardDriveDied.com ì Forensic Strategy Services, LLC. ì Skills ì Produced hundreds of videos and podcasts for DIY. ì Performing Data Recovery and Forensics for 10 Years. ì Speaking on topics at major conferences for at least seven years. ì Wrote & Teach a “Data Recovery Forensics Class”.
- 4. ì Goals: Identifying Problems Is the problem a: ì Firmware Problem? ì Head Damage? ì Board problem? ì Motor Problem? ì Pla'er Damage?
- 5. ì Details of the Hard Drive
- 6. ì Two Types of Recovery 1. I -‐ Physical: Drive Failure, Controller Failure, Passwords or EncrypVon, and CorrupVon 2. II -‐ DeleVon: Purposeful or Accidental
- 7. ì Five Phases of Data Recovery 1. DiagnosVcs of the drive is the first step. If the drive can be imaged go to step 3, otherwise conVnue with step 2 2. Repair the hard drive so it is running in some form, usually requiring hardware or special equipment 3. Image, Copy, or Recover the physical drive and sectors primarily by bit stream imaging. If the drive is funcVoning, it is possible to do this with so[ware; however, there are some hardware soluVons that work very well with damaged drives 4. Perform Logical Recovery of files, parVVon structures, or necessary items; usually this is by so[ware and is the most common type of applicaVon sold 5. Repair files that might be corrupt or have existed in damaged space or sectors to recover what is possible. This is usually the requirement in Forensics, to be able to re-‐assemble data to display what was there, whether full or parVal data is present
- 8. ì FIRST MISTAKE! Thinking about swapping parts? STOP, UNDERSTAND FIRST!
- 9. ì Our Recovery Goal! Imaging/Cloning the SECTORS is the most important process and can be used for diagnosVcs. Forget about files! (Well, for the most part)
- 11. ì Four things you need to see… I. Serial Number II. Model Number III. Geometry (Size of the Drive) IV. Drive to Come Ready
- 12. ì Does the Drive come Ready?
- 13. ì BASICS: What about??? ì Topics to get out of the way…. ì DiagnosVc Tools like Microscope, & Vendor Tools. ì What about so[ware repairs tools like SpinRite? ì Commercial Imaging Tools? ì USB Devices? ì Doesn’t SMART tell me if the drive is bad?
- 14. ì Claims to be Diagnostics ì Microscope and QT, etc. other tools: ì They don’t do much to tell you anything if the drive is not funcVoning. ì Vendor Tools ì They are easy to use, straight forward test, but usually even the tech support people from the drive manufacture don’t know what the error messages mean!
- 15. ì There are Error Codes for Each Sector
- 16. ì Oscilloscope Current Monitor
- 17. ì Absolutely Never… ì ..run any uVliVes on original or unVl a[er you image (it will only get worse) your drive: ì Chkdsk ì Fixmbr ì fixboot, or whatever other OS tools ì JUST SAY NO TO SPINRITE! ì They are all useless on damaged drives and can possibly do more damage.
- 18. What’s wrong with these next Items? QuesVon:
- 20. ì On damaged hard drives…. Most Off the shelf imaging uVliVes usually FAIL! i.e.: dd, SelfImage, Ghost, Acronis, FTK Imager…
- 21. ì Imaging with USB?? ì USB does not work for data recovery! ì You are relying on some cheap Chinese boards or chips made by the lowest bidder of the day that got installed in that device you have. ì You cannot talk directly to the hard drive unless you have control of the ATA Adapter, which does not happen in USB drives. ì Get a good ATA Controller, or at least connect directly to motherboard and will solve some of your issues!
- 22. ì Adaptec 1200a Controller
- 23. ì What can can help imaging? ì Be'er ATA Controllers, or even using one if you are trying to do things over USB! Use tools that talked to the ATA Controller instead of through the BIOS. ì See Status with MHDD / Victoria (and copy sectors) ì h'p://www.benchmarkhq.ru/english.html?/be_hdd.html ì eSATA works with Victoria for Windows w/Driver Installed ì PIO Mode instead of UDMA – even sepng it in Windows can help with recovery of some drives. ì Reverse Imaging i.e. ì ddrescue & Media Tools Pro, or X-‐Ways Replica ì Hardware Imagers, i.e. DeepSpar, PSIClone, Ninja, etc.
- 24. ì SMART BAD STATUS
- 25. ì SMART SELF TEST
- 26. ì Why S.M.A.R.T. doesn’t work ì Smart compares parameters to predict failure ì SMART lacks standards and much is le[ up to the manufacturer ì The BIOS SMART warning only does basic SMART test and is only capable of a simple OK Status ì SMART and its tests are usually turned off in most hard drives / motherboards due to the fact It decreases boot Vme considerably ì SMART TABLE PROBLEMS – Can actually causes errors making the drive fail!
- 27. ì BUT: what SMART can tell you… If Smart can be read it means you probably made it though the System Area, which means the board, probably the firmware and the System Area Head are good! (there are a few excepVons)
- 30. ì Add one that could help… I. Serial Number II. Model Number III. Geometry (Size of the Drive) IV. Drive to Come Ready V. + Any SMART data?
- 31. Diagnostics
- 32. ì Goals: Identifying Problems Is the problem a: ì Firmware Problem? ì Head Damage? ì Motor Problem? ì Board problem? ì Pla'er Damage?
- 34. ì Special Exceptions To Know ì 3.5” Seagate ì F3 Firmware – 7200.11 and 7200.12 ì Serial Port and you can read status like Head Mask Error ì CPU Usage – Problems with Pending Bug, reads every other sector, slowly ì 3.5” WD ì Head Alignment Issues if lid removed ì Serial chip such as the U12 or U5 need to be soldered swapping boards ì Royal Board Problems – Need firmware copied – Reads Half the drive ì All Can Have ì Bad Heads ì Stuck Heads ì TVS Chip Problems ì Motor Problems ì Board Problems ì Scratched Pla'ers
- 35. Seagate F3 Firmware – 7200.11 and 7200.12 Serial Port Status CPU Usage – Problems with Pending Bug
- 36. ì F3 7200 Firmware Bug hDp://bit.ly/TFrZC
- 37. ì Seagate Serial Cable h'p://bit.ly/nZik5
- 38. ì Seagate Serial Cable Orange Wire Yellow Wire
- 39. ì Example: Seagate Head Mask Error
- 40. ì Example: Seagate Pending Bug Seagate 750 7200.10 drive and terminal – Processor Lock Bug CE Log ErrCode=37 LBA=1e9f69 Type=5 Add To Pending 1e9f69 AT Er 00 Nwt Er 43 RdWr 000c2.06.02ce ATA St 50 Er 00 Op ec a,0000/0/00,00 00 00 Niwot: 9ff79ff7 b6 9ff79ff7.3.640 0000 005f 0000 0000 CE Log ErrCode=43 LBA=1e9f70 Type=4 Remove from Pending 1e9f70 AT Er 00 Nwt Er 37 RdWr 000c2.06.02d2 ATA St 50 Er 00 Op ec a,0000/0/00,00 00 00 Niwot: 9ff79ff7 b6 9ff79ff7.3.640 0000 005f 0000 0000 DiskAccess ReadSector EC=43 at 0000c2.06.02d2
- 41. ì Exampole: Seagate Pending Bug
- 42. Western Digital Head Alignment Issues if lid removed Serial chip such as the U12 or U5 need to be soldered swapping boards Royal Board Problems – Need firmware copied – Reads Half the drive then starts to fail
- 43. ì WD: Alignment Issues
- 44. ì WD: Head Alignment Tool
- 45. ì WD: Resolder U12/U5 Serial Chip
- 46. ì WD NEWER BOARDS
- 47. ì Atola Firmware Recovery
- 48. Head Damage
- 49. ì Sounds Tell You A Lot ì Clunking vs. Clicking Heads ì Might also take 3 to 4 minutes to come ready ì Clunking Sounds for a Bad Head ì Tools That Can get Around Bad Heads ì Problems if you change the heads before someone else does an image ì Hardware to control the heads i.e. Deepspar Disk Imager
- 50. ì Do you have a bad head?
- 51. ì What a bad head looks like!
- 52. ì Zone Tables
- 53. ì Zoned Constant Angular Velocity Test h'p://www.coker.com.au/bonnie++/
- 54. Motor Problems
- 55. ì Does the Motor Spin? ì If Not then Look At: ì Do you hear Phasers? ì Does it have TVS Chips? ì Are electronics or a chip burnt? ì Does it smell burnt, even with no visible damage? ì If it does then: ì Does the Motor Sound Correct? ì Or whine?
- 56. ì Special Tool for Stuck Platters
- 57. ì Repairing Motor Problems
- 58. ì Drilled Hole for Lubrication
- 59. ì Lubing up for the Recovery
- 60. ì Star Trek Phaser Sounds
- 61. Testing a Board
- 62. ì Cover Pins from PCB Board Head
- 63. ì Hotwire a hard drive
- 64. Board Problems: Does it have TVS Chips? Transient Voltage Suppressor (TVS)
- 65. ì Transient Voltage Suppressor (TVS)
- 66. ì Transient Voltage Suppressor (TVS)
- 67. ì Burnt TVS Resistor Replacement
- 68. ì The End and Information Links
- 69. Other Damage to Drives
- 70. ì Damaged drive? ì Does the Drive come Ready? ì Can I see Serial Number or Smart InformaVon? ì Does the Drive Click? Or Clunk? ì Does the Motor Spin? ì Does the Motor Sound Correct? Or whine? ì Do you hear Phasers? ì Electronics or chip burnt? ì Does it smell burnt? ì Does it have TVS Chips? ì Does it make a sound? ì Is it scraping? ì Check the Silver Label?
- 71. ì Heads Seeking System Area
- 73. ì Damaged System Area
- 74. ì The End and Information Links