Hardware Disk Drive issues for Data Recovery
Understanding Hard drive data recovery
Hard drives are basically mechanical devices; they are delicate, subject to wear, heat and cold, moisture, virus attack and shock. Hard drives are subject to fail, regardless of the amount of time they are used. It may take more than 6 years before hard drive failure begins, or it might happen within the first year!
Common causes of hard drive failure
Hard drive data recovery is an important issue that needs some care. Basically, there are two types of hard drive failure:
Hard Drive failure due to a software problem (easy to recover)
Hard Drive failure due to a physical malfunction (hard to recover)
- With the first failure category, data loss occurs because of; a) Corrupted partition table, b) Damaged boot record, or c) Missing root directory information. It is easy enough to recover a hard drive failure with these problems.
- It is much more challenging to recover data from a physically failed hard drive. In this case, it is highly likely that any normal attempt to access the drive may cause further corruption. One of the safest recovery methods I use is to create an external image of the drive using an special imaging tool.
Our Workshop based Data Recovery Services
My workshop hard disk data recovery procedures are non-destructive - I create a isolated mirror image of a suspect or damaged hard drive - before the recovery process! My workshop service provides data recovery for hard disks, USB drives, flash cards, camera cards, Zip, and floppy disks. This service also covers email data recovery, recovery of lost System files and any other deleted data.
Inside your Hard Disk Drive (Anatomy)
A hard disk drive contains a number of internal disks, called platters, which are coated with a delicate magnetic substance. These platters spin at high speeds under a mechanical arm (the actuator arm) that moves backwards and forwards over the surface of each platter.
On the end of this metallic arm is a small copper wire (read & write head). The computer sends a pulse through this wire - which changes the state of the magnetic surface of a platter as it passes underneath. In this way the files that you store on your computer are encoded into the magnetic substance.
Hard disk disks are very complex. They have a circuit board and a number of moving parts. In terms of data recovery, the first thing that you must evaluate is whether it is a hardware problem that is stopping you from accessing your data. Common hardware problems include a faulty circuit board or problems with the actuator arm.
Hardware Disk Drive Hardware Problems:
faulty circuit board is characterize by a hard drive that does
not "spin up", meaning that the platters are not
turning underneath the copper wire. A faulty actuator arm or
more serious mechanical error is characterized by an audible
(abnormal) clicking noise or a grinding noise. The best advice
whether you have a hardware problem is to listen to the sound
of your hard drive. If you cannot hear the platters spinning
(i.e. the drive is quiet when it is turned on) or if you hear
more serious noises, then you should stop using the drive immediately.
To recover data from a damaged drive, you will need to send
your drive to a hardware data recovery service.
Hardware data recovery can become very expensive if technicians need to disassemble a hard drive to fix the problem. This usually is performed in a special clean room as hard drives are sealed to avoid errors caused by dust or other particles. Because hard drives are both complex and finely tuned, it takes specialized equipment to read the platters from a physically damaged hard drive unit.
Hard Disk Drives can and do Fail:
Your hard disk drive is composed of one or more spinning platters containing tracks of magnetically stored information. The platters are read by delicate read-write heads that hover over the surface of the disk on a cushion of air created by the speed of the platter's rotation. This air gap (cushion) is about 2 to 15 microns. By contrast, a smoke particle or fingerprint is about 30 microns in size. The read-write heads are attached to a Voice Coil actuator armature that can move the head assembly over the surface of the disk.
Platters: Most platters or disks are made of an aluminium alloy, but ceramic or glass platters have also been used. The diameter of the Platters in Inches can be 21/2, 31/2 or 51/4, and the thickness of the media can be from less than 1mm to about 3mm. The platters are coated on both sides wit a magnetic material. Recent hard drives apply the magnetic layer by plating a thin metal film onto the surface through galvanization or sputtering. These surfaces have a shiny chrome-like appearance.
The whole assembly moves incredibly fast. The magnetic platters rotate at either 4800, 5400, 7,200, 10,000 and now as fast as 15,000 (rpm) revolutions per minute, and the movement of the read/write heads to separate areas of the disk is almost instantaneous.
Head Actuators: The head assembly actuator is an analogue system, with the exact amount of head movement controlled by the exact amount of current applied. The actual position of the coil is determined by servo (or indexing) information, which is written to the drive by the manufacturer. The location of the heads over the tracks on the platters is adjusted to different tracks by reading and reacting to this information. The access speed of typical voice coil actuator drives is between 10 and 20 milliseconds.
Preamplifier circuitry: From inside the HDD sealed assembly, there are data and control wires for the spindle, the head actuator motors, and to the read-write heads themselves. This ribbon cable (from the heads) typically has a low-level preamplifier chip placed inside a sealed assembly. This chip takes pulses from the heads (as close to the source as possible) and cleans up and amplifies these signals before transmission to the electronics outside of the sealed housing.
Air Filtering and Ventilation: Minor wear of internal components and occasional contact of the heads with the surface can cause microscopic particles to be loosened within the HDA. A permanent air filter is mounted within the hard drive air stream to remove most particles before they can cause damage to delicate mechanisms. Most drives also have a small vent to allow for minor air exchange from outside of the housing. This allows for equalization of air pressure so drives can be used in different environments without risk of imploding or exploding (humidity changes).
Hard disks will fail eventually because they are mechanical devices, and as such, wear out. It's as simple as that. The most likely reason for a drive to fail before its time, however, is physical shock damage. If a drive is bumped or jostled while it is active (meaning that the read-write heads are busy reading or writing data on the surface of the platters) there is a chance that the heads will make contact with the surface of the platter, which can cause all sorts of problems.
This 'head-crash' can cause damage both to the read heads and the surface of the platter; can knock the read-heads out of proper alignment, and more besides.
Fortunately, modern drives are well protected against this kind of damage while the heads are in motion. All hard drives manufactured in the last decade or so protect themselves automatically when the drive spins down by parking the read-write heads, or lowering them onto a safe area on the surface of the stopped platter.
Protection Measures Against Hard Disk Crashes:
With the advancement of technology, platters manufactured today are guarded with anti-vibration mechanism and head parking technology to prevent the head from making contact with the rotating platter when a drive is shocked. Protective layers are also implemented on the magnetic surfaces of newer disks to withstand a certain amount of head crash abuse before permanent damage sets in. For instance, laptops computer hard disk are manufactured with better shock resistance capability as these machines are typically on the move. However it is always recommended to avoid moving your computer while the disk is still in operation.
A non-powered hard drive is difficult to damage by physical means. For this reason, you should avoid moving your computer around while it is powered on. Laptop hard disks are usually better protected than standard desktop hard drives, but they can still be affected by physical shocks.
The electric motor that powers the platter's rotation is also subject to failure over a long period of use. A failure in the drives motor or bearings can cause slow performance or data read/write errors due to the platters spinning up slowly or rotating at an incorrect speed.
Early indications of pending hard drive failure:
- The hard drive LED indicator (on the computers front panel) is constantly on (usually at boot time). The hard drive may be working hard to perform large amounts of error correction and retries for some data read / write failures.
- CHKDSK (or SCANDISK) give a report of bad sectors. Once this problem is reported, new bad sectors usually increase rapidly. In this case it us important to clone the contents of the drive onto a new unit - without delay!
- Hard drive unit is running hotter than usual. All hard drives generate heat, but a higher than normal temperature may indicate the unit is probably nearly the end of its useful life. Adequate ventilation is important to the life of modern high-speed hard drives.
- Unusual clunking or clicking noise emanating from the hard drive. When a hard drive is initially powered up, an internal start-up procedural check is initiated to ensure that the drive has gained the required spin RPM level before positioning the heads across the platters. If the drive fails to reach a 'Ready' state, the drive logic repeats for a set number of times. This generates a clicking sound. If the set number of re-tries is exceeded, the drive is left in a dormant state. This is often indicative of an internal failure of one or more of the read / write heads in the hard disk.
- Windows displays a blue screen of death (BSOD) with an error message "Error writing to drive C: This error is often accompanied by a mechanical clicking or clunking noise from the hard drive.
- No drive detected error: This often results in this error 'Disk error, please insert a boot disk' See if the computer's BIOS is detecting the drive exists.
- Hard Drive History: Any hard disk drive that has been dropped onto a hard surface (running or not) or has suffered overheating is candidate for failure. Overheating usually occurs when an enclosure's main fan or fans fail.
This is a actual 'inside' view of a damaged hard drive. The platter surface shows clear evidence of the read - write head crashing into the delicate media platter surface. If you look close, you can see the build-up of platter 'scrapings' collecting near the lower left corner.
Insight into the Data Recovery on Solid State Drives
A Solid State Drive is not only much more immune from mechanical issues than it's earlier counterpart, but it performs much better than the traditional drive. Even so, it isn’t flawless. In general, the most common reasons for data losses on solid state drive can be summarized into the following:
- Human Error: Making mistakes with drive formatting, accidental deleting files, etc
- SSD Damage: Even though solid state drive is far more stable than common hard disk drive, it is vulnerable to water, fire damage and excessive mechanical pressure, etc
- Virus Infection: A virus can cause the data to become corrupt and lost
- Deleted Partition: If one of the partitions on the solid state drive is deleted the data on this partition will disappear (possibly recoverable)
TRIM Can Turn Data Recovery on Solid State Drive into a recovery challenge
A Solid state drive has a good performance feature – TRIM, however this also has downsides. Generally speaking, when you delete any files, the operating system will remove the file index only. The files will be thoroughly cleared until you write new data to the drive to take up the place where the deleted files were. But, with the TRIM, deleted files will be immediately removed without waiting for new data. So, from this perspective, compared with the traditional hard disk drive, data recovery on solid state drive is much more complex and difficult.
Is Data Recovery Totally Impossible on Solid State Drive?
Therefore, faced with the TRIM, data recovery is influenced on the following scenarios:
- If data loss happens due to accidental deletion, such as pressing “Delete” key button, the files will be still stored in computer Recycle Bin. Simply restore from the Recycle Bin
- There are some operating systems that don’t support the TRIM. In this case, data recovery on solid state drive will be the same process as for the traditional hard drive.
Why Data Recovery on SSD Is More Difficult than That on a traditional HDD?
Today, most solid state drive come with the TRIM feature enabled automatically. TRIM will automatically and immediately clear drive data when it gets deleted, wether intentionally or accidentally. That is to say, when you delete any files by mistake, TRIM will tend to erase it at once (a performance feature - in one sense). In this respect, unquestionably, data recovery on solid state drive is much harder.
What is TRIM for SSD drives?
TRIM is a special command by which the operating system can tell the solid state drive (SSD) which data blocks are no longer needed and can be deleted, or are marked as free for rewriting. TRIM helps the operating system know precisely where the data that you want to move or delete is stored. Furthermore, whenever a delete command is issued by the user or the operating system, the TRIM command immediately wipes the pages or blocks where the files are stored. This means that the next time the operating system tries to write new data in that area, it does not have to wait first to delete it.
Why is TRIM useful for SSD drives?
TRIM eliminates the need to erase and rewrite large chunks of memory (storage) continually. Instead of managing whole blocks, a TRIM enabled SSD can work with the smaller memory clusters called pages. Even better, whenever a delete command is issued by the operating system or the user, the SSD automatically sends a TRIM command to wipe the storage space being erased. This ensures a faster writing speed when new data is stored in that area.
How to check whether Windows has turned on TRIM for your SSD
To check whether TRIM is enabled or disabled on your solid state drive, use the Command Prompt. In the Command Prompt window, type this command: fsutil behavior query disabledeletenotify.
After the command press Enter on your keyboard. Then a message is displayed that contains one of these two options:
- “NTFS DisableDeleteNotify = 0” - means that the TRIM feature is enabled on your SSD
- “NTFS DisableDeleteNotify = 1” - means that the TRIM feature is disabled on your SSD
Send a email to: Peter Bowey - Data Recovery