Article by Oded Kuznik – ITLAND Data Recovery https://www.goldcoastdatarecovery.com.au/
Background: Imaging and cloning a hard drive
When we want to copy a source hard drive in a binary level, we are using the imaging process. Imaging is used to create a standalone binary file, or it can be created directly into a physical target hard drive. An image of a drive can be defined as a complete binary image of a drive (a clone) or it can be a compressed file or mapped by the files directory using only the actual used data on the source drive. It can be created as a bootable file as well. It is important to distinguish between imaging of a healthy drive to a faulty/damaged drive.
Imaging a healthy drive – can be executed by IT Technicians
When the source hard drive which we wish to Image is in good electro-mechanical health, it should be a straightforward process and anyone with the right IT skills can image a drive using many commercial software and open-source tools. In many of these cases the image is created as a complete backup of a drive or when migrating an older drive content into a new drive. The key for a successful image is the health of the drive when using these types of tools, if the drive has some level of electro-mechanical fault the process will fail and an attempt to force the imaging process in this case may result in additional damage to the drive and sometimes permanent loss of the data. It is very important to test the health of the drive before starting to image a drive as this action may stress the drive and cause some more damage. It may stress the drive due to the bulk data transfer/copy involved in it.
Imaging a faulty/damaged drive – should be executed by a professional Data Recovery lab
This process is executed mainly when a customer requires the data to be recovered. When a drive is identified as faulty/damaged and can’t read or ID properly, it should be handled by a professional data recovery lab like us (ITLAND Data Recovery) or others
with the same skill set and specialized data recovery equipment like PC3K, DeepSpar, DFL etc. When we receive a faulty drive, first we assess the level of damage and its cause and provide a quote to the customer. Once the customer approves the quote, we repair the fault first - common faults are with the Firmware, Read/Writes heads, or electro-mechanical damage. Some drives have only some mild level of bad sectors and do not need any preliminary repair as they can still ID but cannot read using a standard computer. Once we bring the drive to ID on our specialized equipment, we need to tackle the actual data recovery task.
The data recovery task can be executed using 2 methods when dealing directly with the faulty patient drive – the first is a direct file extraction using a specialized tool like PC3K DE for example via the original file system which is recommended only if the drive is quite stable and doesn’t have many bad sectors – it is the quickest way and can be done only if the file system is still intact and undamaged due to bad sectors. Based on our lab statistics, we use this method only in about 10% of the cases of faulty drives that we get as it’s not safe enough.
The second method and the main one that we use is imaging using specialized hardware imagers like PC3K, DeepSpar, DFL etc. – we use this method in around 90% of the cases that we see. This is the safest method to deal with faulty unstable drives. For this purpose, we are using specialized equipment that can deal with bad sectors and different configurations to tackle the drive issues during the sectors imaging of the faulty drive. While the concept of imaging/cloning is the same as with healthy drive as we image/clone a source drive into a target drive/file, the process is very different when we handle unstable drives. The imaging process using specialized hardware imager (PC3K, DeepSpar, DFL etc.) is one of the main weapons of every professional data recovery lab and it’s important to master it to be able to achieve a good data recovery result.
Generic description of the hardware imaging process
We define a hardware imaging process as a task that includes an imaging/cloning of a faulty/damaged/unstable source patient drive into a good target drive using a hardware specialized imager (PC3K, DeepSpar, DFL etc.) for the purpose of data recovery. For the experienced data recovery professional, the process of imaging is a form of art and requires setting multiple parameters according to the model of the drive and its condition and revisiting that during the imaging process based on the actual progress. Most of the well-established hardware imagers are SATA based, and there are few that support the new generation of drives with native USB and NVME interfaces. The SATA imagers are the most stable and where possible it is recommended to convert the patient drives into SATA to achieve the best possible result – mainly from the original native USB interface.
This is the common process that we use in our lab:
1. If required – convert the patient’s drive PCB from USB to SATA.
2. Connecting the patient source drive + the target healthy drive into the right ports of the hardware imager.
3. Create an imaging process on the hardware imager software – based on the model/family of the drive.
4. Configure the multiple parameters of the task based on our experience with the patient drive model/family and our past experiences with it. This is the most critical stage of the imaging process and the heart of it. We configure the different parameters and scenarios during imaging. It includes setting multiple iterations of reading, read time outs, software/hardware resets and setting default number of sectors to jump once a read error occurs. During this stage we also create the drive heads map where possible – this allows us to disable a bad head if required during the imaging process.
5. Run the process and keep on monitoring it to make sure it runs smoothly.
6. During our on-going monitoring evaluate if it runs well, otherwise go back to stage #3 and re-configure it with different parameters and test again until we reach an optimal imaging process.
7. This process will allow us to create the best possible image from the patient drive into the healthy target drive.
8. The imaging can take anywhere between hours to days and even weeks on highly unstable drives.
9. After we’ll have the best possible image on the target drive where we retrieved the maximum possible sectors from the patient drive, we can use a logical software tool to reconstruct the original file system and extract the user data.
Conclusion
The hardware imaging process is one of the most important processes of the professional data recovery field. While some drives with minor damage may be straightforward to image, some highly unstable drives may be very challenging and complex to image and will required high level of competence and a lot of experience with imaging configurations and using the right tools. It can make the difference between a successful recovery to a partial recovery or no recovery at all. We do our own clean room class-100 work in house and have a large inventory of hard drives to be used for parts. Most professional data recovery labs including us (ITLAND Data Recovery) use the same specialized equipment (PC3000 DeepSpar, DFL, etc.). We have extensive knowledge performing data recovery from faulty/damaged media. When we experience issues that are new, we will use the DR manufacturer’s support team, as well as our peers in the industry, to find the answers we need. We are a proud member of the recently formed group called, Data Recovery Professionals.
