Data Compass For Imaging Hard Drives


Published on

This documents tell you how wonderful data compass is and what are the features of it.

Published in: Technology, Business
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Data Compass For Imaging Hard Drives

  1. 1. DATA COMPASS FOR IMAGING HARD DRIVES By Ann LeFlore Easy Access Communication French Polynesia, Tahiti Disk imaging is the second stage of data recovery. It is the most critical part of the recovery process. Data needs to be imaged off a failing drive with degradation, bad sectors, data loss, corrupted data, media damages such as scratches to the disk surface, and physically damaged repaired drives. Many programs are available in the market today to image a hard drive but have limitations when it comes to imaging the complete drive. Industrial software is not designed to read drives with sever media damage and will skip these area when imaging. It is important to image the drive with read instability and these software packages do not allow for this feature. They are designed to image a non-damaged HDD and not one with physical degradation. Data Compass is more than an imager. The built in feature of the data compass allows you to use this device in multiple imaging phases of data recovery. The Data Compass allows for full imaging features in the second stage of data recovery. It is critical to image an unstable hard drive to prevent further data loss to the drive. Important features used in the data recovery process: ● Image hard drives with bad sectors ● Partition recovery ● HDD attached to DC can interface with other Data Recovery & Forensic Applications programs ● Allows two recovery modes; drive imaging by sector (clone), and select only necessary files and folders to recover. ● Checks partition signatures ● Recovery of encrypted files and folders (programs features decrypt the files and folders encrypted by other software programs) ● Allows copy of corrupted data ● RAID recovery and reconstruction ● Single and multi pass imaging of bad sectors ● Image data forwards or backwards ● Performs four passes to image the maximum data possible ● Map of sector views during imaging process ● Error report of time-outs, restarts, and backward read attempts during imaging ● Reads sectors with bad ECC ● Designed with special algorithm for imaging to prevent further damage the HDD ● Cloning or imaging by selective heads, allows to “depop” bad heads for cloning ● Allows cloning by hot swap method ● The Shadow disk Feature ● Emulate SA on Hitachi HDD to directly access the data area
  2. 2. IMAGING DRIVES WITH BAD SECTORS: The Data Compass allows viewing of the drives sectors before imaging and cloning the drive. This can determine the method used in the imaging process. Drives with severe bad sectors can cause weakness to the heads of the drive during the cloning process. During this process the DC takes into consideration the severely defected data area. Before cloning the drive consider to check the data area to determine the process that you will follow during the cloning procedure. After the drive has been correctly attached to the DC enter into Sectorservo. Here we will be able to test sectors individually or by groups on the drive’s surface. This will help to determine the cloning process to use during recovery. If the drive has many bad sectors it will be beneficial during the imaging process to take this into consideration. PARTITION RECOVERY: The DCEXP program opens the drive attached to the DC. If the drive is experiencing partition problems and they are not visible when the drive is opened. The program has a feature to scan the partition of the drive and try to recover the lost partitions. If recovery is not successful; the DC will allow you to work with other software recovery programs such as Partition Table Doctor. The DC interface allows working with damaged drives; when attached directly to the computer can cause the system to hang or have problems accessing the drive. Thus trying to repair the damaged drive that is
  3. 3. connected directly to an IDE cable is impossible. Through the DC interface it is possible to restore the lost partition of the drive. After the restoration of the lost partition it is possible to continue the recovery process through the DC. HDD ATTACHED TO THE DC CAN INTERFACE WITH OTHER DATA RECOVERY AND FORENSIC APPLICATION PROGRAMS: Logical recovery on a failing drive can cause problems when attached directly to the IDE or SATA port on the computer. During this stage other recovery programs are necessary to use for lost data, deleted files, and over written documents. Working directly with a failing drive is not recommended. Clone the drive with the DC before attempting any recovery actions. Once cloned the drive can be attached directly to the DC and used as an interface with other Data Recovery and Forensic programs. The DC interface is less stressful on the drives’ surface and can make recovery of the lost data quicker. ALLOWS TWO RECOVERY MODES: When it is important to retrieve all data on a failing drive a complete image of the drive can be made. Here the program will use a special algorithm to read sever bad sectors. The program has four separate imaging stages it perform on the failing drive. First pass; Quick Forward imaging, second pass; Intensive forward imaging, third pass; Quick reverse imaging, and fourth pass; Intensive reverse imaging. This will ensure the maximum data retrieval possible from the failing drive. When all data on the drive is not needed and only certain files need to be recovered. It is possible to only retrieve the files necessary. The file recovery process allows you to search the Root directory and choose only the files necessary for recovery purposes. CHECKS PARTITION SIGNATURE: In Sector View it is possible to check the drives’ partition signature before recovery. We can view individuals sectors of the drive to assure data can be recovered from the drive before starting the imaging process.
  4. 4. RECOVERY OF ENCRYPTED FILES AND FOLDER: Password encrypted files and folders can be recovered by Commercial Data Recovery programs. This does not always allow access to these documents once saved to your target disk. If files are accessible but the documents inside are not readable it is possible to use the DC to gain back access to these documents. The DCEXP program has a special built in feature that will decrypt these files and allow read access again to the documents. After the drive has been cloned attach to the DC and enter the File Recovery Mode. In the Explorer window locate the encrypted documents, right click on these documents and save to a new target disk. You may now use the Windows explorer to check the documents readability. ALLOWS COPY OF CORRUPTED DATA: Hard drive with sever corrupted data can cause problems during the cloning process. The DC uses a forward and backward read function in these areas to retrieve data from the drive. During the imaging process the drive will encounter corrupted data area. When this happens the program will use a backward read function to retrieve data from these areas. Special attention is given to sever damaged sectors and corrupted data loss areas on the HDD. RAID RECOVERY AND RECONSTRUCTION: The DC is the only imager on the market today that will support full RAID recovery and reconstruction of RAID arrays. The program has two modes of RAID recovery; first automatic mode, and second manual mode. It is now possible to perform recovery on failing RAID disks and image and retrieve data from RAID arrays. SEPCIAL FEATURES IN DRIVE IMAGING PROCESS: Single and multi pass imaging of bad sectors: Depending on the cloning technique you have chosen the program can either make a single attempt or multiple attempts to read and recover the bad sectors on the HDD. If the drive is severally damaged you can limit the number of attempts to read this area of the HDD.
  5. 5. Imaging data forwards or backwards; at times it is not possible to do a forward image of the HDD. It is necessary to image the drive backwards to retrieve the maximum data off the drive as possible. Performs four passes to image the maximum data possible; the imaging process is preformed on the first pass. The program will note all areas in the drive that contain bad sectors or potential data loss. On the next three pass the program will work in these areas only to retrieve the maximum data possible from the failing drive. Map of sector views during imaging process; During the imaging process the program will display each sector being imaged. Thus you can see the condition of the sectors being imaged during the process. Error report of time-outs, restarts, and backward read attempts during imaging; During the imaging process a bad sector is encountered the program will report this condition and the steps it has taken to correct and image this sector. Read sectors with bad ECC; The program has the ability to read all sectors with bad ECC and recover data from these sectors. Designed with special algorithm for imaging to prevent further damage the HDD; Special care and consideration is taken into account when imaging drives with bad sectors or potential data loss. Cloning or imaging by selective heads, allows to “depop” bad heads for cloning; drives with failing heads need to be cloned before the swap out of the MHA to ensure the maximum level of recovery possible. It is possible to clone the HDD with eliminating the damaged head during the cloning process. During the imaging process the most reliable data will be added to the data copy only. During the imaging process the program will build a head map of the drive depending on the type of drive. You may choose the head which will not be used during the imaging process. Thus eliminating the potential bad head; from being used during the reading and cloning process. The program uses a special algorithm program converting LBA to CHS to clone this drive. Allows cloning by hot swap method; After the coding list has been written from the donor drive; to the patient drive; we are able to use the DC to recover data from the HDD. Attach the donor drive to the DC and power on the unit to read the drive. Once the drive has been read; power off the DC; and moves the PCB to the patient drive. Power back on the DC and enter to Sector View. Here we will view the sectors in our data area of the patient drive. To ensure cloning of the drive using the hot swap method it is recommended to clone using the shadow disk technology. The Shadow disk Feature; When the imaging of a damaged disk is not possible but data is needed from the disk a shadow disk can be created. The shadow disk is divided into three sections; reserved, index area, and shadow disk data area. The Data Compass console will establish which LBA is being read for example LBA 1. Thus the data located in this LBA has formed a shadow in the Shadow disk data area and backup. When reading this data it is only necessary to read the data from the corresponding area inside the Shadow disk data area. There is no need to read again the data from the source drive thus reducing the read time to
  6. 6. the source disk and protecting the data stored on this drive. If the LBA is 0 it indicates that the LBA has not found the corresponding LBA in the Shadow disk data area and data from this LBA will need to be read again from the source drive. Emulate SA on Hitachi HDD to directly access the data area; Seriously bad sectors in the SA can hinder the drive from being cloned. The DC has a special Hitachi SA analog technology which can access the SA by uploading built in resources files. With the SA Analog technology it is possible to have access to the SA and retrieve data from the drive. Together with the Shadow disk technology and the SA Analog technology we are able to retrieve data from a drive with sever bad sectors in the SA. Conclusion: The features of the DC are unique and allow for recovery of a failing drive. Special programs and features designed inside the DC allow for easy imaging and recovery using one device. I find that the DC is a very unique tool in the recovery process and has benefited me in recovery of hard drives. The features of the DC are very beneficial in the second stage of the recovery process. This device has saved time, recovered more failing drives, and has more features than other imagers on the market today.