Of course, the first thought is that any city is full of various service centers that will vying with each other to offer the service of repairing a drive with data saving, and that you just need to make one call or fill out an order form on the website, a specialist will immediately come home minutes will solve all problems.
But usually after a short period of time, the understanding comes that no one is in a hurry to extract data from a faulty drive at home, and those who agree, upon arrival, insist that the disk should be taken to a workshop for diagnostics. Or they give out a short summary in the spirit of "burned out" and somehow find it difficult to explain the essence of such a diagnosis, but at the same time they insist that the disk should be taken to the workshop for extended diagnostics.
For those who are lucky enough to come across a more or less competent service center, they usually say there that a data recovery service is needed, and are recommended by a few specialized companies. Those who are less fortunate have to go through a thorny path, during which various changes take place with the drive, which do not have the best effect on its condition.
This story will tell the story of a hard drive from a Hitachi HTS547575A9E384 laptop that has come a long way before returning the data to its owner.
Figure: 1 Hitachi HTS547575A9E384 usually looks like this.
Our first acquaintance with this disc took place in early October 2020. A certain young man visited our office. The client was not very talkative and only said that "the broom was knocking, we need a date." The client could not provide any information about the circumstances under which this happened. We were also given a ban on opening the disc.
If we hear from a client that the disc has been hit or makes knocking sounds, then, as a rule, this means that we must remove the cover and assess the nature of the problems inside the HDA. But since in this case we cannot do this, we are forced to deviate from the standard diagnostic procedure, warning the client about additional risks.
Well, in order to minimize the risks of aggravating the problem, we will first check the operability of the controller board and, after making sure that everything is fine with it, connect it to the port of the PC3000 Express complex and perform a short-term start of the drive. It is very important to appreciate the sounds that he makes from the first second. In this case, we hear the shaft spinning up, characteristic airborne noise inside the HDA, calibration attempts are heard, then at some point atypical sounds appear (light tapping), not similar to the knock that this hard drive would have made if it had not it was possible to detect the servo marks, and a cyclic beating against the limiter would occur.
Since the sound does not pose a threat, we will wait about 20-30 seconds (in some cases, more time is possible). Half a minute later, the drive was ready, which was reported in the DRD and DSC registers . Let's try to read the passport.
Figure: 2 Error reading passport.
The disk responded with a refusal to this attempt to send a request command to the passport, setting the ERR error flag and indicating the ABR type in the error register . This usually indicates that the firmware was not loaded or that the download was interrupted at some stage.
In this case, we will forcibly select the required family in the utility and see if the drive can read at least something from the service area after submitting the technological mode key.
Figure: 3 Launching a specialized utility of the complex.
Now we will request a passport again, since in many cases it will play a role in what exactly will be contained in the response data. From this answer, you can often understand the stage at which the firmware download was stopped without in-depth analysis of the contents of the RAM .
Figure: 4 Drive passport Hitachi HTS547575A9E384
The drive issued a full-fledged device passport. This indicates that the firmware download was interrupted at a later stage, and most likely loading a small number of modules into RAM will give full access to the user zone.
Let's check in RAM whether the PSHT (p-list) and RDMT (g-list) modules, which are responsible for translation, are in place.
Figure: 5 RAM address where PSHT should be loaded during normal initialization.
The check shows that these modules were not loaded into RAM . It is necessary to find out the readability of the firmware modules.
Figure: 6 Checking the readability of the firmware modules.
When trying to read modules, no reading errors are observed, except for the WRT test modules (0-3).
Let's load the RDMT and PSHT modules into the drive RAM and set the boot flag. Let's try to read small sections (about 1,000,000 sectors) in different places in the logical range of the disk. This quick test on this family will help assess the read quality of all heads in zones of different densities, and readability at the end of the logical range will confirm the correct translation.
The test results confirmed that the translation is correct, all 4 heads can read.
We see a steady reading of the firmware, but a light tapping at the start of the drive and a lingering release in readiness indicate that there is still a problem.
We know the ideology of the microprogram operation: when the drive starts up during the boot process, it tests the write ability of each of the heads on WRT modules (0-3).
Since there were no problems with reading the service and user zones, it is necessary to check whether the recording works. An attempt to write to the WRT modules results in the same tapping that we heard when the drive was started. This suggests that this drive has a BMG that is not entirely serviceable, but most likely this will not interfere with data extraction, and it will be possible to do without using a donor BMG .
At this, the diagnosis, the duration of which is less than 10 minutes, can be considered complete and the client can be informed of the diagnosis, the procedure for the production of data extraction work, the timing and cost.
The client, having listened to this information, muttered something indistinct under his breath, grabbed the drive and quickly left the office.
After a little over a week, a completely different person brings the same drive and also finds it difficult to report anything about the conditions under which the failure occurred. We carry out repeated diagnostics and make sure that the drive is in an unchanged state, inform about the type of problems, the cost of the service and the term of work. But already this time the client asks in detail about the subject, and if it does not work out to the end to read the original heads, then how much will the option with the transplant costBMG . Having received all the answers, he forgives and leaves.
Almost a month passes, a call comes to the office, in which a potential client is interested: "Is it true that a head change can cost $ 500?" We explain that the cases are very, very different, that the cost of these works depends on the complexity of the transplant operation, the complexity of working with the drive firmware, subtraction nuances, as well as the cost of the donor or several donors that will have to be used. Since the client finds it difficult to give the exact name of the drive model, we inform you about the price of the work associated with the transplant, and we offer free diagnostic procedures within 15-20 minutes, after which we can clarify the situation. The voiced time, which is enough to understand the nature of the drive's problems, for some reason surprised the client that he even asked if he really heard 15-20 minutes correctly.
After a while, this client visited our office. The drive in this form was laid out on the counter in the reception area.
Figure: 7 Appearance of Hitachi HTS547575A9E384 after barbaric intervention.
By the serial number on the sticker and its duplicate on the HDA end face, we recognize an "old friend" who has already visited us twice. True, from that time on, he began to look very, very bad.
We ask the client a question: "For what purpose was the sticker removed from the cover and the sticker at the technological hole was partially peeled off?"
Figure: 8 The sticker covering the technological hole is broken.
We get the answer that this was done in one of the services, where his hard drive was diagnosed for the last week.
We inform the client that now then we will remove the cover, inspect this drive and report the results.
After removing the cover, we find the absence of a recirculation filter, a small grease mark on the pressure washer and on the edge of the upper surface, as well as the presence of substances similar to saliva and dandruff, left, probably, by the person who opened this drive.
In this case, it is necessary to remove the BMGand examine his condition. In the process of removing, we find that the tightening torque of the screws that secure the terminal block is very similar to the factory one. There are no visual deformations of pendants and dangling sliders. Traces of metal dust are also not found when examining the sliders under a microscope.
There is reason to believe that the drive was only barbarously opened, but no one has probably changed the BMG in it. And the absence of metal dust on the sliders can give hope that it is still possible to read BMG to the native ones .
Putting the drive back. We inform the client that it is necessary to carry out procedures for removing contamination, and describe which ones. We also say that there is some probability of obtaining data in a more budgetary way, since the complete unsuitability of the BMG during inspection has not been confirmed. We inform you about the cost of the service if you still need a BMG transplant from a donor. The announced cost of services in both cases turned out to be less than the one asked by the client over the phone. After some deliberation, the client left an order and reported the technical task .
This was followed by a routine procedure for removing dust and dandruff by blowing, dissolving fat and dried saliva by means of chemical compounds, followed by their removal from the surface of the plate, installing a recirculation filter from the donor.
After cleaning and collecting, it turned out that the state of the drive elements remained the same as it was during the first two diagnostics.
The further scenario involves creating a task with sector-by-sector copying in Data Extractor. Let's open the contents of LBA 0
Figure: 9 Partition table.
The partition table describes 3 NTFS partitions.
The first one with the active status starts from 0x00000800 (2048) sector, size 0x00032000 (204 800) sectors. A typical partition for the needs of the boot loader of Windows Vista or Windows 7. The
second partition begins with 0x00032800 (206 848) sector, 0x06176000 (102 195 200) sectors. The size coincides with the size of the system disk, which was indicated by the client when the technical task was voiced.
The third partition starts at 0x061A8800 (102 402 048) with the size of 0x5139D000 (1362 743 296) sectors, and, according to the terms of reference, coincides with the size of the second partition (drive D), where the most important data for the client is located.
We build a map of minispaces, starting from 102 402 048 sectors and up to the end of the logical space.
Figure: 10 Minisone table.
In the scenario of the task, we set a jump larger than the size of any mini-zone and a read timeout of 500 milliseconds, as well as a techno key after a software reset, which will be performed after a read delay. After two reading passes, albeit with some instabilities, the contents of the main section were received in full.
After completing the main part of the technical assignment, we build a map of minispaces for the section with the operating system and read it with similar parameters. After several passes with different reading parameters, we get the following statistical picture:
Figure: 11 Disk read statistics.
After analyzing the MFT on all sections, we made sure that the records are correct and that these structures are not damaged. Comparison of the file location with the defect map revealed that the damage spreads to $ Logfile, pagefile and some index records, that is, if we talk about user data, almost 100% of the result is obtained.
At the acceptance of the result, the client agreed that the data he needed was received in full, and told a short story about how he took the disk to 4 different companies that were in his area, and that after several days of diagnostics, diagnoses of malfunction were voiced everywhere heads and talked about the need to look for the same disk, but the last company was in no hurry for a week to clarify the diagnosis. When the client's patience ran out, he visited that company with the intention of finding out the diagnosis, but there he was informed that all the specialists were very busy and now they could not tell him anything, call tomorrow. The client did not like the answer, and he informed them of his intention to take his hard drive, but even here he was in wait for the answer that the drive needed to be assembled, and the masters were all busy and again the offer to call tomorrow.On the same day, the client used a google search, found a lot of unflattering reviews about companies with similar working methods and decided to go back and seek the return of the hard drive. After a difficult conversation, first with the administrator, and then with a certain person who introduced himself as the director, and the threat to call the police, the case got off the ground. The client was promised that within an hour the wizard would be free and tell everything about the state of the disk. After almost 2 hours, a young man came to the office with a bag, laid out the opened disc in front of the client and said that only replacement of heads would help here and that the cost is equivalent to 500 US dollars, and also that only their specialists in the city are ready to cope with this problem ... The client, after reading the reviews and dissatisfied with this approach, paid for this company "diagnostics",which was free only in case of consent to the work, and took the drive. The client also made an attempt to return to the company he had contacted for the very first time, but when he saw the barbarously opened disc, they refused to accept the order, they say it was too late.
Well, after several days of reading various forums, the client realized that there are not so many companies in the city that provide professional information recovery services as it might seem, and that the market is replete with offers of unscrupulous performers who attract a low price.
Summing up, it can be noted that an ordinary task took the client almost a month and a half instead of 2-3 working days, and also had to pay for "fake" diagnostics, due to barbaric actions to run the risk of irrecoverable data loss, pay a little more for the service, since elimination of the consequences of the autopsy was required.
I would like to wish citizens a more responsible attitude to their data. Do not forget about the need to make backups to different devices. And if trouble comes, then take a responsible approach to the choice of performers so as not to become a victim of deception or unskilled interference.
Previous post: HDD for Mac or the run-of-the-mill case for a data recovery lab