We received a call from an IT company for whom we routinely carry out hard disk recovery work. They had a very worried client who had some irreplaceable files on a laptop hard drive. In this case a Toshiba model MK2546GSX, which is a 250GB S-ATA. Both the client and the IT company had carried out some initial analysis and the reported conclusion was that the “motor had burned out”. In other words on application of power there was no attempt to spin-up, in fact no signs of life at all. It was time tp pull on the rubber gloves and enter the lab.
The Initial Analysis:
More often than not when a hard disk has been subjected to the incorrect voltage the resulting damage to the printed circuit board (PCB) will leave a short-circuit to the computer’s power supply. A short-circuit can severely damage a power supply and consequently it is always wise to test for such damage. Sure enough initial testing demonstrated that the PCB had developed a short. This usually happens in response to too high a voltage supply. This in turn is usually because it is accidentally connected to the wrong supply voltage by the user; it may be due to a supply spike from a less than reliable power supply unit in the computer or simply down to bad luck with your local mains supply. However the electrical damage has been caused, success will depend upon an accurate diagnosis of the resulting damage.
Having established that the problems were electrical, the next step was to investigate and attempt to repair the PCB itself in isolation. The PCB was duly removed and investigation began. It soon became apparent that there had been multiple component failures (although, as is often the case, there was no outward physical sign of damage). Where electrical damage is relatively slight then it is practical to replace and / or work around failed components in order temporarily to get the PCB working again, at least for long enough to get access to the files. However in instances such as this case where the damage is simply too extensive for this to be realistic it is necessary to source a closely matching donor and use its PCB as a replacement. Unfortunately a simple swap will almost certainly not regain read access. The reason for this is that the PCB holds a chip which in turn holds some configuration information which is specific to this individual device. This information is part of the firmware. Without access to this firmware information the drive may well spin-up but it is very unlikely that there will be file access. For more information about swapping PCBs have a look at our article here.
In this case there was a further complication. Electrical damage will sometimes extend beyond the PCB. Given the extent of the damage evident here it was therefore no great surprise to discover on further testing that the pre-amplifier had also been fried. The pre-amplifier is a built-in part of the read / write head assembly (for more information on basic anatomy try our article). This would therefore necessitate the replacement of the entire read/write head arm assembly with equivalent parts from a closely matching donor. Such extra obstacles are unfortunately very common when electrical damage is involved.
The Second Step, Getting Things Operational Again:
The donor was duly obtained and the read / write head assembly was removed and replaced with the donor parts. The donor PCB was removed and the chip storing the firmware removed. The equivalent chip from the original defect PCB was then removed and installed on the donor PCB. The drive was then re-assembled and powered-up.
The Third Step, Cloning the Defective Unit:
As soon as the drive had initialised, cloning to a fresh, healthy target began. This is a critical step and because it is time consuming and resource-intensive, one that is often omitted by companies working at the budget end of recovery. It essential because there is simply no way of knowing how long a unit that has suffered this kind of damage will last, the analysis and extraction work which will follow is intensive even when fully healthy and so the chances of a severely damaged drive failing while these procedures are under way is relatively high. Of course if the original defective unit fails under these circumstances then the retrieval efforts will have come to a (premature) end. Once a healthy clone has been produced then the subsequent work can be carried out on that clone without jeopardising the data.
The Fourth Step, Data Identification and Extraction:
Once the clone had been obtained the original client-supplied drive could finally be abandoned. All subsequent work would now be carried out on a fully healthy clone.
The drive was scanned using our own in-house software and the user documents extracted. In this case there were no logical complications the file system was NTFS (used with almost all Windows operating systems). It is often the case when the original has cloned only partially that some of the user data is no longer referenced through the still-readable parts of the file table. Where this has happened then deeper scanning is required to locate the remaining user files.
The Final Step, Verification of the Recovered Files:
The final step is another vital one which is often side-stepped at the budget end of the market, the task of verifying that the files recovered will open and are not corrupted. The only way to know whether or not a file has been recovered intact is to open it. For more information about why a file list is not a reliable guide to what has been recovered read this. In a nutshell there is no software which can reliably verify that files will open. Therefore it is incumbent upon any company to open the files in question using the appropriate applications to confirm that they have been recovered intact. Often, of course, the rescue will consist of tens or hundreds of thousands of files, in these situations extensive sampling must be carried out combined with an offer to the end user to check any individually critical files.
Thorough sampling in this case confirmed our faith in the procedure. The end-user did indeed have some specific documents that were critical and after verifying that these were intact we were in a position to conclude successfully.