Docstoc

Data Compass Case Study2cdr

Document Sample
Data Compass Case Study2cdr Powered By Docstoc
					                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page1


                                                               Data Compass - Case Study
        Recovery of data from a Hitachi drive with physical defects in Service Area

     Symptom:
     A client reported that their Hitachi 5410 series laptop drive was not being detected by the computer.
     Initial diagnosis suggested that the drive was suffering from firmware failure, as it was spinning up but not
     clicking. Details of the drive were as follows:
     Model:       Hitachi Travelstar 120GB
     Serial No: HTS541612J9SA00 P/N:             42T1030
     MLC         MA2043
     PCB:        OA26798 Da1188
     Solutions:
     There are several possible causes of corruption of the Service Area (SA), including:Bad sectors (logical
     and/or physical) within the service area
     Corruption of address translator
      Overflow of S.M.A.R.T logs
      Erasure of firmware modules and so on
     A drive with firmware corruption will never be visible to the computer system and this will result in the
     data area being rendered inaccessible by conventional means. The Hitachi HD Doctor was used for further
     diagnosis of the drive, and it displayed the following:

C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page2




     As can be seen, none of the drive parameters were displayed. Also the status was shown as 'Error'. The
     initial diagnosis suggested that the drive may be suffering from firmware failure. In order to confirm this,
     the [Load from file] function was used with '5416' (as indicated in the serial number) selected from the
     HDD series table and following this the drive status became 'Ready'. There are two common firmware
     failures that may result in incorrect drive parameters being recognized:



C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page3

        SA firmware corruption
        NVRAM corruption
     To confirm the cause, the [Backup FW] screen was selected and a sample firmware module selected from
     the list. Double clicking the item displayed the following:




     As the content of the module was viewable after a successful [Load from File], this confirms that the drive
     is not suffering from an NVRAM corruption failure. The next stage was to carry out a scan of all the
     modules in Service Areas A and B. This showed:

C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page4




     As can be seen from the result, no error was found in either SA. As those in the Data Recovery field may
     know, there is no CRC algorithm built in to the FW modules of Hitachi drives. All that the [FW Defect Scan]
     can do is to scan for the presence and length of the modules. As the P-list is particularly crucial for access
     to the data area, the next thing to do was to try to view the P-list. When [View P List] was selected it
     showed:


C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page5




     The P-list was viewable and no error was found. This indicated that there was still a chance to recover the data
     from the defective drive. The diagnostic tests up to this point can be summarised as:
          The Drive is not detectable by system,
          The Module content is accessible and NVRAM is not corrupted,
          All the modules are present and have the correct length,
          The P-list is viewable.
     The conclusion implied from the above is that there are physical bad sector defects in the service area. Checking
     each module individually is the only way to confirm the integrity of the firmware as a whole. Performing a scan of
     all the modules revealed an error in Module 32 (PSHT - P List), as shown in the following:

C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page6




     As the errors in the P-list were located within the area where there was no genuine content (only '0000''s), the
     defective '4040's can be replaced with '0000's. Performing a [Direct Write] and [Reload] of the content, showed
     the errors were still present. This indicated that Module 32 could not be overwritten and showed that this
     defective area was physically damaged. As may be known, physical bad sector defects in the firmware service area
     of Hitachi drives could not previously be recovered by any available application. Now however, Data Compass is
     capable of recovering data following this type of drive failure. The drive was connected to the USB console of a
     pre-launch evaluation copy of Data Compass, and starting the program showed the following:


C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page7




     When the drive became 'Ready', the corresponding Hitachi drive family ('5416' indicated in red in the
     picture) was chosen, 'Enable Read' was activated and the rotary controls were adjusted to correctly set
     the reading algorithm parameters. Finally, to confirm that data on the drive could be correctly accessed,
     the Sector View screen was used to view the contents of Sector 0 and this was displayed as follows:




C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page8




      The visibility of Sector 0 indicates a high possibility of recovering data from a defective drive suffering
      physical bad sectors in SA. The next stage in the process was to use the accompanying SalvationDATA -
      Data Recovery Studio software to extract the data. To protect the drive from any further damage due to
      the poor performance of the Read/Write heads, it is recommended that the 'Shadow Disk' function is
      employed, as shown:



C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page9




     The 'Shadow Disk' technique images the data from a defective drive to a functioning drive at the same
     time as data is being recovered, which improves efficiency and limits the possibility of further damage to
     the original drive. A spare drive is connected through the USB interface to the computer and selected
     from the drop-down menu next to [Shadow Disk]. Then, after the connected disk was initialised and
     enabled, the Data Recovery Studio program was started, this displayed the following:



C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page10




     The program had detected the drive and correctly identified it and an 111.79GB NTFS partition. As the
     partition had been detected straight away, the file directory could be displayed by simply clicking 'Open',
     this showed the following:


C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page11




      As a check, the displayed files can be further viewed in various ways according to their nature using the
      [View as .......]buttons at the top of the screen. Files to be recovered are indicated using the tick boxes and
      then clicking on [Save Files]. This prompts the following dialog box:




C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page12




  The destination for the recovered files and any limitations on the type of files to be recovered can be specified
  as shown above. Finally, clicking on [OK] will start the recovery:




C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.
                                       SalvationDATA TM Case Study for Data Compass (Hitachi)                                                                       Page13




     Direct repair of this drive is not achievable due to it being impossible to overwrite any information to the
     physical damaged firmware area. It is also not possible to use 'Hot Swap' techniques to resolve this failure,
     since the NVRAM on the PCB is unique to the specific drive.
     There was no way to achieve recovery of the data from this drive prior to the arrival of Data Compass.
     For further information:
     E-mail:usinfo@salvationdata.com
     Tel:0086-28-68599758
     Http://www.salvationdata.com

C 2001-2008 SalvationDATA Technology, LLC.

For more information, please contact us: South and North America: usinfo@salvationdata.com     Europe and Africa: info@salvationdata.com   Asian Pacific: apinfo@salvationdata.com
Http://www.salvationdata.com                                  Unauthorized copy or distribution of this document is prohibited.

				
DOCUMENT INFO
Shared By:
Stats:
views:6
posted:4/5/2011
language:English
pages:13