What you can recover has just as much to do with your equipment and discipline as with how skilled you are. We provide here an honest listing of all the hardware we use at our lab in Belfast; each item’s function and how it changes what can be recovered.
The easy recovery jobs are handled by a simple USB dock and scanning software. All others (bad heads, corrupted firmware, non-functional controllers) require hardware specifically designed for those types of problems.
The single largest factor that separates a professional lab from a software download.
Plugging a failing hard drive into a standard desktop will have the OS treat it as if it were functioning properly and continue to perform extended timeout operations, continuously retry failed read/write operations, allow background communication it had no business being engaged with. The treatment used on damaged media or weakened heads by the operating system often causes further failure. A hardware-based imager (an image capture device) acts as an intermediary between the user and the disk and takes back that control (per sector timing out/reading around damage/individual head control/etc.) over the disk's operation. Additionally, the hardware imager allows the user to safely power cycle the disk when it becomes unresponsive.
The primary reason we have our DeepSpar kit is so that we can extract as much data as possible from a disk while it is continuing to deteriorate at its own rate, capturing the most critical information before loss occurs. The Atola Insight Forensic Imager offers a forensic image of a disk and provides a write-protect feature along with hash verification allowing for legal compliance along with providing the ability to verify that the original data has been preserved and was not modified during the imaging process.
For drives that are spinning properly but are showing no data.
Each hard drive has its own proprietary operating system (the firmware in its service area) which holds all the maps and defect lists needed to convert platters to working storage. When these modules become corrupted, this is where you'll find the "ghost" symptoms: the drive shows itself as 0 GB; identifies incorrectly by name; sits detected-but-unreadable while sounding completely healthy.
A “PC-3000” is the standard tool used by those professionals working at the level mentioned above. This device communicates in all the technical languages supported by each manufacturer of hard drives including Seagate, WD, Toshiba, Samsung etc. As such, it enables us to both read and repair service area modules; we can also bypass failed heads within the “headmap”, and restore a damaged hard drive back to an operational condition so that we may then image the data stored upon it. There is no software program that will enable access to these areas via Windows.
Head swaps and donor parts, performed on our own bench.
If a disk's heads fail or are damaged from being dropped, the repair can be accomplished physically: donor head transplants made to match the original drive of the patient. This transplant operation takes place on the Belfast bench at our facility and is performed by our team of engineers.
The less noisy part of mechanical work is the donor library: the rows of drives purchased and catalogued for their components. In order to be the correct donor, the donors need to be very close in terms of matching: model family, manufacturing location, firmware revisions. Access to the correct donor will often make the difference between a successful recovery this week and a long search for a donor across parts suppliers around the globe.
The tooling for solid-state, and the rules that protect every job.
Solid-state failures require their own set of tooling as well; specifically NAND readers and adapters for pulling data directly out of memory chip(s) when a controller has failed, and the monolith work required by modern one-piece cards/sticks: unscrambling, correcting errors and reconstructing translators to convert raw flash into files.
Surrounding all of this are the consistent practices/habits. All media is copied at read-only prior to beginning any type of activity or process. Every operation performed occurs on a duplicate. Recoveries are validated/verified prior to sending them home. Due to the fact that every read on a failing device is an investment that cannot be recovered, the initial recovery attempt is done as carefully as possible; this is also exactly why there is a free diagnostic test performed before any work is agreed upon.
There are four aspects that distinguish a lab from a "shop" with just software: A hardware imaging solution that controls the sectors of a failing drive; Firmware solutions for drives that incorrectly identify themselves; A library of donor parts in condition to allow safe mechanical work; Write blockers to prevent any changes to the original data. None of the difficult recoveries can be solved using software alone.
These are commercially available. However, a “PC-3000” type of unit costs tens of thousands of pounds (before training) and the device itself is the smaller half of the equation. It takes many years of trial and error to learn what firmware module to contact with which hard drive family, and what “donor” you should have on hand.
Yes. We do all jobs here at Cromac Square, with no outsourcing of work; therefore, nothing is sent abroad. Once you get a quote for recovery, simply pop in on a weekday (you don't need an appointment) or send it via our UK postal service from anywhere in the country.
If you'd like to see how these tools really perform in practice, take a look at our data recovery case files. These include actual recovery scenarios using the PC-3000 and other hardware tools as well as examples of failed devices. Or better still, you could just send us your own failed device and let the diagnostic show you what we can do.