Jan 01, 2010

A Guide for IT/IS Professionals

James Cadden, CIFI
Capsicum Group, LLC

Introduction: IT/IS professionals are often faced with the necessity to recover data from physically damaged hard drives or storage devices, however; they often lack the training required to complete this task.  This paper will cover details and symptoms concerning common hard drive mechanical failures. Additionally, this paper will discuss certain methods known to be effective in countering these hard drive failures.  This paper assumes that you have applied the skills of your craft and checked the data and power cables or tried common methods of dealing with damaged partitions, boot records...etc.

A few words of caution:  A data loss incident can be a very emotional time for anyone who values the data or has the responsibility of safeguarding it well being. A company’s entire digital portfolio or person’s lifetime of hard work may be in the balance between a successful data recovery attempt and a failed attempt. The proper implementation of data recovery techniques is a methodical and delicate practice. Attempting to apply data recovery techniques while in an emotional state or without the proper training is a recipe for disaster.

The methods discussed here have proven successful for thousands of data recovery incidents.  Many recovery methods rely heavily on proper diagnosis of the problem(s) affecting the hard drive. If the wrong diagnosis is made and the wrong method of data recovery is applied, total and permanent data loss could befall you or your client.

Taking a look inside: Hard drives are assembled in clean rooms (cleaner than surgical rooms) and then sealed. Hard drive platters spin at a rate of 4,200 to 10,000 rotations per minute. Opening the hard disk drive to inspect the contents, by anyone but properly trained personnel in a controlled environment, could lead to contamination of the magnetic media. Damage can occur because the read/write heads move at a very close distance to the spinning hard drive platters. As the platters spin, it is only a matter of time before the head comes into contact with dust or debris on the platter. At this point, an impact will occur, the surface of the platter containing the magnetic media will become damaged and the data contained within this magnetic media will be lost forever.

Warranties:  Although it is often the last thought on any IT/IS professional’s mind during a crisis situation, you should know that the act of physically manipulating any digital storage media device will, most often, invalidate the manufacture’s warranty. If the warranty is void, the IT/IS director or your client has now lost their valuable data and will be denied warranty coverage to replace the hardware. During most data loss incidents you may only have one opportunity to recover the missing data. You should resist the temptation to try “just one more trick” and know when it is time contact a data recovery specialist.

Symptoms and Techniques:

SYMPTOM #1: The hard disk drive displays no sign of power and/or no sound of the drive "winding up".
DESCRIPTION: In this case, you have a hard disk drive that is properly plugged into a Molex cable of known working order and you have checked the functionality of the data ribbon, but there is no sound of the drive moving within its case. Light indicators (if applicable) on the logic board are not illuminated, indicating that the hard disk drive is not receiving power. You should also check the logic board for signs of rapid oxidation. (Photo A) It is not all too uncommon for a logic board component to begin to smolder and burn. There are several reasons for this, such as sudden increase of power or a failure of a power regulator to function properly. In most cases, it is possible to see the location on the logic board which has received the damage.

SOLUTION: Find a logic board from an identical hard disk drive and replace the damaged board with a known functioning logic board. Matching the make, model, and even the lot numbers of the drives would also be beneficial.  Be certain to check under the damaged logic board. Should you find signs of damage to the spindle data transfer nodes (Photo B) or other parts of the drive unit, you may have an even more serious problem then first anticipated. If you are not comfortable with this practice, contact a data recovery specialist right away.

burn_chip

dsc02566

SYMPTOM #2: The hard disk drive powers up & then spins constantly with a loud winding sound.

DESCRIPTION: In this case the hard drive unit powers up and appears to spin out of control. The drive may or may not mount. If it does mount, it will most likely be sporadic in successful operation. This symptom is often indicative of a severe power regulation failure. The symptom could also be caused by a component malfunction within the drive.

SOLUTION: Locate a logic board from an identical hard disk drive, being certain to match the make, model, and lot numbers if possible.  Replace the problem drive's logic board with a known functioning board. Contact a data recovery specialist if you have any doubts.

SYMPTOM #3: The hard drive powers up and then winds down, non-responsive.

DESCRIPTION:  The hard disk drive will power up, you can hear the unit wind up and then it suddenly powers down. The unit may or may not power up again. It would not be uncommon for a hard drive in this condition to function for a period of time and then fail again. It is likely that a drive in this condition has suffered from an inconsistent power feed. Low or inconsistent power supply can often cause more damage than an over power supply or surge.

SOLUTION (A):  Remove the logic board and ground it separate from the hard drive unit. Ground the hard disk drive to an electrostatic grounding point. Replace the logic board and then attempt to use the drive again. If the drive should power up and mount, begin copying data to a safe place, you will have only a short time to do so before the drive fails again. This condition is often caused by a persistent and reoccurring static charge or the logic board is unable to produce regulated power feeds.

SOLUTION (B): Locate an identical logic board (being certain to match make, model, and lot numbers) and replace the problem logic board. If the unit powers up, begin copying data with great haste, you may not have much time remaining before the unit fails again. A hard disk drive that suffers damage from a power fluctuation can also have damage to the actuator (motor) within the unit itself; these malfunctioning components can cause damage to even a new logic board. Contact a data recovery specialist for additional assistance.

SYMPTOM #4: The hard drive unit emits an OCCASIONAL clicking sound.
DESCRIPTION: This is very common and often an overlooked sign of imminent drive failure. One of the locking points for the Cam/Actuator arm has malfunctioned and the arm swings overly wide, causing it to smack against the inner drive unit housing or stop block, which is usually made out of plastic. The drive most likely works and the volume is mounted and functioning perfectly. This condition promotes a false sense of security and will often cause a user to ignore the obvious warning signs. Data should be copied from this drive without delay. The drive will most likely fail soon, although it could function for many months, failing without warning at an unknown time.

SOLUTION (A): Copy data from the drive if the unit still functions and discard the problem drive.

SOLUTION (B): If the drive stops functioning, the cam/actuator arm has likely become locked in position. To temporarily correct this condition, try lightly tapping the side of the hard drive unit, which coincides with the outer side of the cam/actuator arm, with a hard rubber mallet. In order to do this, you must possess knowledge of the hard drives mechanical design. Consult the manufactures' documentation before proceeding with this solution. Be certain to tap lightly once and then try the drive again. Tapping in moderation is the key.  Do not over tap the drive or strike it too hard, as many hard drive problems can be made worse by hitting the drive too hard and/or too frequently. On several occasions, I have found data reader heads bouncing around within a hard drive housing unit which were caused by improper use of this technique.  This practice is best left to a data recovery specialist.

SYMPTOM #5: The hard drive unit emits a CONSTANT clicking sound.
DESCRIPTION:  In this case a hard drive's cam/actuator arm has likely broken from its locking points and is swinging freely within the drive or swinging wide. This can also be caused by failure of the servo motor. The drive likely does not mount and appears not to function accept for the loud clicking sound. In this state, the drive is unable to read or write, to or from, the digital media on the drive platter.

SOLUTION: It is possible, under controlled conditions, to remove the drive housing case and find the component that has failed. Carefully replacing this component will often times allow the drive to function one last time in order to facilitate data recovery. You guessed it; this hard drive needs to go the data recovery specialist ASAP.

SYMPTOM #6: The hard drive unit powers up, but the drive does not mount, and there is no discernable data read/write sound.
DESCRIPTION: This condition is often caused by overheating and occurs when excessive heat causes one or more of the inner components to expand and stick to another component or to the housing unit itself.  This condition will cause the drive to stop reading or writing data. It is not uncommon for the unit to show up as a mounted drive under windows when this condition exists, however; no folders or files will be displayed. A prompt to format the drive may even be displayed, but the system will most likely lock up when attempting to access the volume.

SOLUTION: In order to free the heat expanded component(s), place the hard disk drive into an antistatic bag ensuring to remove as much air as possible before sealing the bag.  (Using a vacuum-sealing device is recommended.) If the drive unit is hot, allow it to cool to room temperature before placing it into the antistatic bag. Once the hard disk is securely sealed within the bag, place it into a freezer for twenty or thirty minutes. The tightly sealed bag and room temperature drive allows for the reduction of condensation.  After thirty minutes, remove the hard disk drive from the freezer and allow it to sit for five to ten minutes in the bag. Remove the drive from the bag and quickly attempt to recover data from the unit. Be prompt to copy data, as it will not be long before the drive heats up again and fails.

SYMPTOM #7: The hard drive powers up and a scraping sound is audible.
DESCRIPTION: In this case the read/write head or arm has broken or come loose and is scraping the digital media on the drive platter(s).

SOLUTION: STOP using this drive immediately. The scraping sound you hear, most likely, means that it is too late for any meaningful data recovery. The scraping sound is the read/write heads impacting with the drive platter. The read/write heads are scraping the magnetic media from the drive platter and throwing debris all about the inner drive housing unit, increasingly compounding the problem. (See photo C). If this condition just occurred, and little damage has taken place to the drive patter's digital magnetic media, it is possible to remove the broken read/write arm and replace it with a known good arm. Extensive and delicate cleanup will be necessary in order to remove the debris from the drive platters and drive housing unit. Data recovery rates dealing with this type of symptom are very low.  The drive should immediately be preserved and cared for by a data recovery specialist ASAP.

head_impact_hdd

SYMPTOM #8: The hard drive has been exposed to water damage.

DESCRIPTION: In this case you have a hard disk drive that has been immersed in or otherwise exposed to water. Even if the drive has been removed from the water and appears to be dry, do not attempt to power the drive up.   If the drive was running at the time of exposure, it is possible that the logic board has been damaged beyond repair. All hard drives have ventilation ports, they are small and usually regulated by a flap type of control that allows air to escape, but does not allow for dust and debris to enter. Chances are good that this flap prevented water from entering the drive housing unit and reaching the digital media on the drive platters.

SOLUTION: It is possible, under controlled conditions, to properly dry the remaining and unseen moisture on the drive, replace the logic board, and recover data. To increase your probability of data recovery, and decrease your risk of damaging or contaminating the logic board during handling or removal, deliver the drive to a data recovery specialist immediately.
SYMPTON #9: The hard drive unit has been exposed to fire.
DESCRIPTION: In this case a hard drive has been damaged by fire. The most delicate portions of the drive have likely been melted or damaged to some degree. (See photo D). Many individuals simply call it a lost cause at this point but not so fast, there is still hope.

SOLUTION:  This drive is in serious need if examination by a professional data recovery expert. Attempts to replace the logic board and power the unit up could cause an increase in damage. Metal expands when exposed to heat. It sometimes contracts when it cools down, but there is no guarantee. A data recovery expert may be able to manipulate the drive, replacing parts where necessary and even removing the platters for successful data recovery.

Author’s Note: The methods described within this paper are the professional opinions of the author and based on over one decade of experience in data recovery. Although these methods have allowed the author to successfully recover data in many thousands of cases, they are NOT designed to be a replacement for professional data recovery efforts. No warranty or guarantee of any kind is offered or implied.