Hard Disk Recovery

Hard drive recovery is the repair of physically damaged hard drives including heads, platters and a clicking sound. Even though clicking is by far the most common noise that a hard drive will make when failing, there are a few other noises such as whining and phaser noises that indicate electronic problems or worse case, motor issues and failing bearings. This is a common hard drive recovery scenario especially on laptop hard drives.

A clicking hard drive is making that noise for one of two reasons:

1. Damaged Heads and/or Platters - if the heads get damaged then they can no longer read the platters and will go into a seek pattern. This will cause a clicking noise as the arms go back and forth. This can also happen when the hard drive has been exposed to excessive heat. If the platters swell then the heads can no longer find sector 0 and again go into a seek pattern. If this is the case, the only recourse is to open the disk and replace the heads. This is hard drive recovery.
2. Loss of communication between electronics and internal ROM chip - there are a lot of electronics and chips on both the outside PCB board as well as internally. These electronics communicate with each other in a language called microcode. Each hard drive manufacturer has there own encrypted version of microcode. Hard drive recovery companies like DTI Data, need to not only be able to repair hard drives, but repair chipsets and unlock encrypted microcode. We have databases full of different hard drive microcode and service area byte maps. When any of the chips fail to properly communicate to the heads, they send the armature into a seek mode, similar to what happens when heads fail. This is the most common misconception in the hard drive recovery industry. 6 out of 10 hard drives that come in for recovery that have been opened by other companies, need never have been taken apart at all. they hear clicking noises and automatically open the drive and change the heads. There is no way that a cheap data recovery company can afford the research and development costs incurred in the hardware and software needed to perform hard drive recovery on high capacity (over 250 GB) disks that entail microcode problems. Beware of where you send your hard drive, make sure they have a clean room and have had success on large capacity hard disk drives. Western Digital is the only hard drive company that authorizes data recovery companies. Type in “western digital data recovery partners” into Google and their page will come up. You will note that DTI Data is on that list. We are a real data recovery company authorized to open disks and do hard drive recovery on Western Digital drives!

Breaking Down Hard Drive Recovery - A Look at Platters, Heads and Internal Parts

The first graphic below is the internal parts of a hard drive laid out and identified by their common industry names. Just about all hard drive repair involves the parts below as well as some specialty software that can write to a service area and replace bad sectors and access the data on a damaged hard drive.

The Parts Of A Hard Drive

The next image is a close up of the heads and the platters:

Hard Drive Recovery Parts

Hard drive recovery is a serious business be sure that you research the company that you send your damaged hard disk to. Feel free to call DTI at 866-418-3843 or visit our hard drive recovery page. There is also information on hard drive repair clicking.

Blue Screen of Death C:\windows\system32\config\system missing or corrupt.

Windows Blue Screen of Death

If you have turned your PC on and received this message the problem can be solved with the following steps. However, before beginning, it is very important to note that the cause of the problem may be the hard drive itself. As with any type of do it yourself recovery this could cause permanent unrecoverable damage to the hard drive and or the data that exist on the hard drive. Like most hard drive recovery processes, physical disk repair isn’t necessary if the hard drive is seen by the BIOS. If your hard drive is recognized by the BIOS, but you get the blue screen of death these steps will help you restore Windows. Be careful and backup if you can! That said, lets continue.

If you have your hard drive manufacturers diagnostic tools, please read the documentation carefully and test the drive to make sure it is functioning properly. If you do not have the manufacturers diagnostic tools you can go to their respective websites to download them. It is important to read the documentation as these tools may perform data destructive tests and procedures to your hard drive. It is also a good idea to try and recover some of the data by making your boot drive a slave drive under another Windows system for hard drive recovery. Please see our previous post “How to slave a hard drive“. Ok, lets proceed with the restoration and hard drive recovery.

Windows Command Prompt

Time for the XP Recovery Console.

You are going to need to get your XP Installation Disk.

You will also need to make sure you can boot from your XP installation Disk. Insert you installation disk in your cd/dvd drive and make sure you see the option press any key to boot from cd: If so, do so and you’re good to go. If you do not see that option you will need to enter your system setup (BIOS) and change the boot order. When your computer boots you should see press delete, F10 or some key function to enter your systems setup. You will usually find the boot order under advanced settings once you are in the setup console. Simply select boot order and choose CD as your first boot device. You may change the boot order back to the original settings after this exercise in hard drive recovery.

When you boot to your Install CD it will take a minute to load all the drivers, then it will provide two options-Setup or Recovery Console; “press r” for the recovery console. It will than ask you which Windows install you want to repair, most users will only have one so just input 1 and press enter. You should now have entered the recovery console of your Windows XP CD.

What you are about to do is basically a minor System Restore via the Recovery Console. We are going to use an older version of the currently curr The text in red will be what you should type and the black text will what the system outputs. READY, SET, GO.

C:\Windows>CD C:\system~1\_resto~1

C:\system~1\_resto~1\>dir

After you enter the DIR command and hit enter you will get a list of folders like rp1, rp2, rp3, rp4, etc.. The “rp” part of the folder name indicates it’s a Restore Point.

What we want to do is use the 2nd or 3^rdhighest numbered folder in that list. For example, if it listed rp1 through rp53 you’ll want the rp52 folder. We will use rp52 to outline the rest of the procedure.

Now, we will use the following commands..

C:\system~1\_resto~1>cd rp52

C:\system~1\_resto~1\rp52>cd snapshot

C:\system~1\_resto~1\rp52\snapshot>copy _registry_machine_system c:\windows\system32\config\system

Overwrite system [y,n]: y

1 file copied

C:\system~1\_resto~1\rp23\snapshot>exit

Remove the installation disk .

Those are the steps to restore Windows after getting The Blue Screen Of Death. If you need help give us a call at 866-418-3843 or visit hard drive recovery.

Just about the worst thing a Windows user can be told is that Windows wants to format one of your hard drives. This is becoming more prevalent with external hard drives, that can not only be told it needs to be formatted, but can disappear altogether. This article is going to cover what to do when your external hard drive either disappears from Windows, or Windows wants to format your external hard drive.

Why Does Windows Want To Format My Hard Drive

There are a lot of reasons why Windows will ask you to format your external hard drive. The one that surprises me the most is when users tell me that THEY re-formatted their hard drive, changing the file system from FAT 32 to NTFS, or some other file system for Mac or Linux. There is no valid reason for re-formatting your external hard drive that outweighs the risks involved. External hard drive manufacturers chose FAT 32 for a lot of reasons, but mainly because of its ability to be recognized by just about every operating system that exists or has ever existed. It is also capable of managing huge partitions and external hard drives are getting larger and larger. Hard drive capacity has gone from being recorded in MB (megabytes) to GB (gigabytes) and now is being measured in TB (terabytes). FAT 32 can handle partitions up to 2 TB and that is huge! If you have that much storage on an external hard drive, it will probably need to have more than 1 partition anyway. In fact most TB devices have multiple hard drives set up in a RAID anyway. The best bet is to look at devices that have at least a RAID 1 and is a mirror.

When Windows want to format our hard drive, you have a couple of options. The first thing you can do is repair the partition using data recovery software like Recover It All. You can grab the demo and learn more about Recover It All here. The other option is hard drive recovery. Feel free to give DTI a call if you have questions about hard drive recovery or need to ask us a question.

Seagate FreeAgent External Hard Drive

When looking at external hard drives, most reviewers only look at capacity, pricing and performance. DTI Data Recovery looks at these things, but has a focus on the stability of the external hard drive and its ability to withstand heat and not need hard drive recovery. The Seagate FreeAgent Pro is a FireWire400, USB 2.0, eSATA external hard drive that is built to last. Even though Seagate is actually a competitor of ours, they acquired ActionFront Hard Drive Recovery a couple years ago, we would be remiss not to look at their products in the interest of our readers.

All that being said, the FreeAgent Pro is a solid external hard drive. Seagate has always made a good hard drive and this is no different. The FreeAgent line of external hard drives comes in 3 types, the Pro, Desktop and Go. Since we like lots of storage we only looked at the Pro line and we were impressed by its durability and data protection. As far as pricing goes it is comparable to other external hard drives with the 1 TB version under $200.00 from Seagate’s store. The only thing that bugged me was it didn’t come with the eSATA cable, but the Firewire transfer, while not as fast as some like the Western Digital series, it was fast enough for me. I think people should be more concerned with stability and failure or hard drive recovery than speed anyway. All in all the FreeAgent is a good external hard drive.

DTI Data is one of the few data recovery companies that not only operate a clean room, is a certified partner of the only hard drive manufacturer that lists authorized data recovery companies and creates and supports their own hard drive recovery software! We make all of our products, both hard drive recovery software AND Freeware data recovery tools right in our own labs.

I am pointing all this out because when I searched Google for hard drive recovery, I found over 800,000 results and started looking at the companies listed as well as those buying ads. The fact is out of all those results and the 30 ads, only about 20 of them are real data recovery companies, and only 8 are listed on Western Digital’s data recovery partner page.

So why is this a big deal? It doesn’t matter much when looking at data recovery software since all of them, like ours, have demos. Our software will show you that it will recover the data before you buy it. Physical hard drive recovery is a completely different ballgame. If your hard drive is no longer recognized by the BIOS or is making noises like clicking or whining or scraping, then you need hard drive repair services to get your data back. That is why it is important to know who you are sending your drive to.

Freeware Data Recovery Hard Drive Software

DTI also has FREE data recovery software that we fully support. Our free software for hard drive recovery can undelete files, diagnose RAID Parity problems and repair NTFS partitions. You can see all of our FREE data recovery software here. You can also learn more about Freeware data recovery here.

There are some problems that need a powerful hard drive recovery tool. While our FREE NTFS Partition Repair tool can sort out a lot of issues, it can’t resolve problems that involve bad sectors on a damaged hard drive. We do have a solution for recovering data from bad sectors called Recover It All. Not only can it work around bad sectors on NTFS partitions, it will also fully recover FAT 32 partitions! We have gotten a lot of questions about why recovering FAT 32 is so important even though Microsoft doesn’t use it for their operating systems anymore. The answer is just about ALL external hard drives use FAT 32 as their file system because it can be seen by Windows, MAC and Linux. While we do have FREE FAT 32 Undelete tools, they won’t work on damaged FAT 32 Partitions. You need a powerful scanning engine for that and Recover It All has one of the best.

You can get the demo version of Recover It All Here or Buy Recover It All Now. The button below will take you to a secure site to purchase the software. You will receive the full version within seconds. Recover It All is on sale for $49.99, a savings of $50!

The bottom line is that if your hard drive is not recognized in the BIOS, is making noise or is not spinning up, you will need hard drive recovery. If the hard drive is seen by the BIOS, but not by Windows or Windows is asking you to format the hard drive, you need data recovery software. Feel free to ask any question about hard drive recovery in the comments below.

    In my last installment I described what a file entry record would look like if it were in fact a cluster holding file entry data. I went over the fact that the first two entries of the folder cluster would be a period followed by ten spaces, and the next entry would be two periods followed by 9 spaces. This data may seem innocuous, however they do have meaning and can help us in determining how the folders are related to each other.

   The file entry record has several components that are used to extract the related stored data.  One of these components is the starting cluster number of where the data might be found.  Logic is then used to with the  File Allocation Table (FAT) map to chain the clusters together.  Lets say for instance that the starting storage cluster for file “foobar” is 1000h.  Lets also say that the size of a cluster is 64k.  Finally, lets assume, for illustration purposes that the file is 640k.  With these facts in hand we can say that foobar will occupy ten clusters. If the file had been saved only once and not edited we can make a pretty educated guess that the file is not fragmented. So the following statement may be true “Foobar is stored in clusters 1000h - 1009h”.
The FAT would look like this

    The top table shows the actual cluster number 1000h -1009h. The bottom table shows the value in each one of the FAT cells. The value in the FAT cell points to the next cluster, which in turn points to the next cluster so on and so forth. Finally the final FAT cell has the value 0FFFh which indicates the end of the cluster chain. This method is called a “one way linked list” as it links the clusters forward only, and not reverse.
    Now, this is a FAT representation of a file that is not fragmented. The following set of tables for the same file, but this time the file is fragmented.

    Now, as you can see from the above table the cluster chain looks basically the same until we get to cell 1004h. Instead of the cell containing the value 1005 which would of course point to the next cell, it has the value 100B. This means to look at cell 100B to see if we are at the end of our chain, or if we in fact continue the chain. In our example we see that the chain does continue until it reaches the end of the linked-list in cell number 100F. This is an example of a fragmented file as it is divided into two fragments. The first fragment is from cell 1000 to 1004, and the second fragment is from cell 100B to cell 100F.
    With all of this being said one can see how important it is to keep the FAT cluster map intact. When a drive is formatted for FAT the entire FAT table is destroyed and zeroed out. In the above fragmented file we can see that with the FAT destroyed there is no way to easily recover the data. The simple logic of a FAT recovery is to get the starting cluster from the File Entry record as well as the file size and then read each cluster contiguously until the file size is satisfied. In other words to recover foobarwe would read cluster 1000h since that is the starting cluster and continue for ten clusters since the size of each cluster is 64k and the file size is 640k. Doing this will lead us to cluster 1009h. Looking at our two examples we can see that in the unfragmented file we would get all of the data, however, in the fragmented file we would only get the first five clusters and the rest would be zeroes or garbage.
    I have made several references to the starting cluster number which is found in the File Entry record and then used with the FAT to get all the data for a particular file. In my next installment I will explain the mechanincs of getting the starting cluster from the File Entry record. Until next time…

Related Articles:

• Part 1 Recovering FAT 32 With File Entry Data
• Part 2 Recovering FAT 32 With File System Markers
• Part 3 FAT32 Recover File Entry Table On-Disk Layout Using a C Structure
• Part 4Using FAT32 File Entry Record For Recovering Folders Using Software Logic
• Freeware Data Recovery
• Hard Drive Recovery
  

  In my last installment I described the file entry record and its on-disk format.  I used a ‘C’ structure to denote the different fields of the record and defined which five are most important to us when trying to recover a FAT32 file system where all the main file system components have been destroyed or corrupted.  In this installment I will describe what is unique about the file entry record for a folder entry and how we can use that as a filter for the software logic.

  The first two elements of the file entry record are the file name which is eight bytes, and the file extension which is 3 bytes.  For the beginning of every folder the first file entry record has the file name “.          “, that is, a period, followed by ten spaces.  In other words the first eleven bytes of the beginning of a sector that stores the beginning of a folder are static and are always the same.  Now this fact is important in as much as we can look for this particular attribute in a sector and when we find it there is a very good possibility that we are looking at the beginning of a folder.  With the being said it is always better to try and refine a filter in order to make sure that you have in fact found the beginning of a folder.  Oddly enough, the second file entry record had the file name “..         “, that is, TWO periods followed by nine spaces. 

   Each file entry record is a static thirty-two bytes long.  That being said we can now assert this.  If bytes zero through seven of a sector are a period followed by ten spaces and bytes thirty-two through forty-two of the same sector is two periods followed by nine spaces then there is a high probability that we have found the beginning of a folder.

   The pseudo logic for this might look like:

     The chances of a sector slipping by that may not be a folder entry is very slim.  This is good in as much as it can be difficult to define a filter that will give you the most optimal results without flooding you with a set of worthless data.

     In my next installment I will explain what this ‘.’ and ‘..’ mean.  If there are some old DOS command line users out there I am sure you are well aware of what I am talking about.  Until next time…

Related Articles:

• Part 1 Recovering FAT 32 With File Entry Data
• Part 2 Recovering FAT 32 With File System Markers
• Part 3 FAT32 Recover File Entry Table On-Disk Layout Using a C Structure
• Freeware Data Recovery
• Hard Drive Recovery