Data Recovery from damaged HDD

On the market of data recovery from damaged HDDs there are currently two major brands dominating, Western Digital and Seagate. The smaller part of market is shared among HGST, ST/Samsung, and Toshiba. Despite the relatively high quality, modern hard drives have a wide range of problems. Each of vendors has both typical and specific problems, diagnostics of which is often very difficult.
Any hard disk drive regardless of  vendor, has the same structure, similar schemes of functioning and similar problems. From the standpoint of malfunctions, hard disk can be represented as several structural units:


Printed Circuit Board                                                                                       Head Stack Asembly 

 


Platters                                                                                                         Spindle Motor

 


Firmware

 

All these parts are susceptible to damage on every brand, just with different frequency.
When some of these components becomes damaged, access to data on the drive gets lost. In most cases data still can be restored by applying specialized techniques and special equipment for Data Recovery.
In Data Recovery tasks from damaged drives the most important step is precise diagnostics of damage. In case of an incorrect diagnosis and wrong steps in many cases it leads to irreversible HDD and data corruption either to wasted resources.
The entire process of Data Recovery from damaged hard disk drive can be described as a sequence of steps:

1 - Primary diagnostics

2 - Diagnostics of malfunction

3 - Repair (or temporary repair)

4 - Imaging to target drive

5 - Data analysis and saving

 

At primary diagnostics it's necessary to determine whether data is accessible and drive is able to read surface. If so, it is likely that hard disk drive has no damages, but there may be bad sectors. In this case, it is necessary to image drive-patient to another healthy drive-target using specialized equipment, then analyze file system on target drive and save data. When the drive doesn't have access to surface it is necessary to diagnose the cause of its malfunction. If  drive has mechanical or electronic part damage, spare parts may be required, taking into account that each vendor has its own compatibility requirements and adaptation procedure.
At the heart of HDD functioning it has a Firmware. One part of  Firmware located in ROM chip on PCB, the other bigger part located on the surface of hard disk drive, recorded on special hidden cylinders. This part is called Service Area and access to it is possible only through special technological mode of HDD by means of so-called Vendor Specific Commands (VSC). Each vendor has its own structure of Service Area and various problems.
Service area consists of different functional modules, such as: Translator, Overlays, Adaptives, SMART, LOGs, etc. Corruption of noncritical modules does not influence on drive work and data access, while the damage of critical modules does. A proper diagnostics of Service Area corruption allows to determine and fix the problem in order to re-gain access to user data.
When the cause of damage is fixed, it is necessary to image hard drive-patient to target drive, as the patient may not function stable within a long time. Subsequent analysis of file system and Data Recovery is necessary to run on the target drive.


The precise diagnostics is a key to success!
 

 

Data Recovery from damaged SSD & other Flash storage

Nowadays SSD and Flash storage devices have quite large capacity and high read /write speed. But, unfortunately, reliability and endurance of devices based on non-volatile NAND memory is deteriorating every year. So the problem of Data Recovery from faulty SSD and other devices with NAND memory is becoming more relevant and in demand on the world's market.
Every solid state drive, usb pendrive, or memory card consist of two main parts - controller chip and NAND memory chips. The endurance of memory chips in the past few years has decreased  tenfold. The memory cells of SLC chips were able to withstand around 100000 write cycles, MLC about 10000 write cycles, and the newest TLC about 500-1500 write cycles. When the number of corrupted memory cells (blocks) exceeds the limit, the data storage device fails and access to user data becomes impossible. The controllers used in the flash storage devices are working under extreme temperature conditions and often get damaged.
The controller chip controls read / write operations, optimize data in memory chips and does block mapping (block translation) using a special block translation algorithm, this all known as FTL (Flash Translation Layer). Each controller manufacturer uses a different block translation algorithm  with different steps of data optimization. Thus, in case of solid state drive damage, in particular when controller chip is damaged, access to data gets lost. In spite of this, the data are still stored inside the memory chips. The only way to recover the data in this case is desoldering and subsequent reading of memory chips. After receiving the dumps of memory chips, is necessary to apply special operations to bring data to initial state - to eliminate the influence of data optimization and apply the block translation algorithm of controller. Thereby, the process of data  recovery consists of several steps that allow to emulate work of controller and reconstruct file system with user data:

  • Memory chips desoldering
  • Memory chips reading
  • Elimination of data optimization (data mix)
  • Block translation algorithm (PBA-LBA)

The process of memory chip desoldering is performed using soldering station with hot air gun. For the newest chips such as TLC it's recommended using a soldering iron in order to avoid overheating of crystal because this determines number of read errors and data integrity. When desoldering BGA chips such as TLGA52, BGA100, BGA152 and others, the special preheater is required.
The reading process and further analysis of memory chip's dump is performed with use of special equipment for Data Recovery. Each NAND chip uses different reading configuration, depending on the model. During reading process some errors may appear due to noise and physical peculiarities of the memory chips. When reading is done the error correction is required via specific mathematical algorithms, such as Reed-Solomon, BCH, LDPC.
Before controller writes data to memory chips, the data are being optimized. This process alters the initial data and make it unrecognizable. This optimization process may include such operations as Byte Striping, Inversion, XOR encoding, Encryption, Interleaves, etc. In order to obtain the initial data is necessary to apply the reverse operations to dump of memory chip.
When all the required data transformations are performed it is necessary to apply block translation algorithm that will arrange all blocks with data according to their real place. The result of this algorithm will be an image of data with file system.
If solid state drive had a file system corruption due to controller's fault then further logical recovery may be required on the image with file system.