1. Imaging Hard Drives with USB Interface
The data recovery industry is seeing more and more drives with a USB interface. As
a result, imaging processes for unstable/degraded USB drives (especially those that
have an onboard USB connector) are becoming a concern for many data recovery
companies. Let’s look at all the factors that need to be taken into consideration from
a data recovery perspective when dealing with such drives.
Why USB?
Hard drive vendors are moving more toward USB drives mainly because USB 3.0
provides a high data-transfer speed (in practice up to 400MB/s), which is sufficient to
cover the maximum access speed of any modern hard drive (100-150MB/s range).
At the same time, USB offers many advantages over ATA for system builders:
• It connects universally with any peripheral device (not just mass storage
devices).
• Power and data are provided in one connector.
• Ports can be multiplied with hubs.
• The same interface can be used in internal and external devices.
• The device and its drivers are auto-identified by system software.
As of now (fall 2012), the market already offers a number of hard drive models with
onboard USB 2.0/3.0 interface from Western Digital, Seagate, Samsung, and
Toshiba. These drives are in fact SATA drives with a built-in USB-SATA bridge chip.
Current DR imaging processes for USB drives
While the number of USB drives on the market is increasing, the data recovery
industry has rather limited control over imaging USB drives with media damage
and/or read instability issues. The market of DR tools only offers imaging software,
which clearly cannot handle these issues, because it relies on system software
(BIOS/OS) to access the drive.
Lack of USB hardware imaging products forces DR companies to image USB drives
by soldering a SATA interface onto the drive’s board (bypassing the USB-SATA

2. bridge chip) and then imaging the drive using a SATA imager. The problem with this
approach is that most drives that come for recovery, such as My Passport from
Western Digital, have a USB-SATA bridge that encrypts data in real time, which
means that data accessed and imaged on a SATA level is encrypted.
To decrypt data, the recovery process requires a second imaging/copying run,
where the image acquired on the SATA level is accessed back through the original
USB-SATA bridge chip. Clearly, such an imaging process is very time-consuming,
requires imaging of the entire drive (does not allow imaging by files) and involves
extra soldering work.
Also, this current approach is only a temporary solution, because it relies on the fact
that the drive has a built-in USB-SATA bridge chip. Sooner or later, though, hard
drive vendors will implement a native USB interface deployed within the MCU,
therefore voiding SATA wires on the drive’s board at all. Such an onboard interface
bridge design was always deployed during a transitional period while vendors moved
from one interface to another. For example, early SATA drives were actually IDE
drives with a built-in SATA-IDE bridge chip; all modern drives now have a native
SATA interface implemented in the MCU.
Why imaging solutions for USB drives are more complex compared to
SATA/IDE drives
Getting more data in a safer and faster way when imaging unstable/degraded drives
can only be done when a hardware imager has a native support of the interface,
which gives you the full advantage of its extra functionality and performance. In
practice, an imaging product should work with the interface on a hardware level,
bypassing system software, which usually requires building a proprietary hardware
deploying this interface.
We have already touched on this subject for SATA drives in 4 Reasons Why Your
Data Recovery Device Should Support SATA Native Functions. As with SATA
drives, the most critical functionality for imaging USB drives is as follows:
a. To have full control of communication with the device starting from the
Physical (PHY) layer up to the Application layer

3. b. To perform effective and timely device resets at any time so you can keep
imaging the drive when it stops responding occasionally or when a read
operation takes longer than expected
c. To achieve a drive’s maximum data transfer speed using smaller read blocks
so that you localize bad areas on the drive as precisely as possible without
losing good data in skipped areas and/or making extra wear to the drive
Unfortunately, implementing this functionality for USB drives is much more complex
than for ATA drives. The major reason is the multi-layer stateful nature of the USB
Mass Storage Device protocol, compared to one-layer stateless SATA/IDE
protocols. In fact, full native communication to a USB Mass Storage Device, such as
any USB hard drive, involves the following protocol layers: a) ATA over b) SCSI over
c) Mass Storage Device Bulk-Only Transport Protocol over d) USB 2.0 or USB 3.0.
Implementation of native support for a USB imager requires implementation of each
of these protocols.
The situation is complicated by the fact that each USB connection is stateful. USB
protocol incorporates multiple initialization stages – initializing a USB port,
discovering and setting appropriate properties of a USB device, configuring
endpoints, and so on. So almost any type of device reset (from a software reset to a
drive repower) requires a lot of re-initialization to move the connection to an
appropriate state on each protocol layer. All of this re-initialization work was not
necessary for SATA/IDE drives.
The complexity of synchronizing communication states is actually the reason why
system software (BIOS/OS) usually loses connection to a USB drive as soon as it
encounters any temporary desynchronization of the state between the host and the
device. In most of these cases, the only option to regain access to the device is to
disconnect a USB drive from the system and reconnect it back so that the system
software reinitializes the state of the connection. Obviously, this step is simply not an
option for data recovery imaging processes, and therefore imaging software or any
non-native USB hardware becomes much weaker in handling USB drives compared
to ATA drives.
We would also like to add that because communication to USB drives incorporates
so many protocol layers, it becomes practically impossible to implement a USB

4. bridge, such as USB-to-IDE or USB-to-SATA adapter, that could work in data
recovery imaging applications. In fact, you can find a number of such adapters on
the market offered by different vendors, and none of them will actually work if you try
connecting a USB hard drive to your ATA imager using such a USB-to-ATA adapter.
Another requirement of imaging USB drives is getting access to an ATA level and/or
vendor-specific functionality that DR companies get used to while dealing with hard
drives. This functionality includes imaging drives by read-write heads, disabling
SMART or Read Look Ahead features, setting the drive to Sleep mode to perform a
hot swap, and accessing other ATA level functions. This functionality is being used
in the recovery processes of almost every modern hard drive nowadays, so lack of
any of ATA level functions for USB drives would mean a loss of control over the
imaging process, resulting in many unrecoverable cases.
New interface – new features
The USB interface also brings new features that a USB imager should be able to
address. One of the most critical features introduced by USB drives that affects DR
processes is an extra USB-level security system introduced by some vendors, such
as WD SmartWare security. This security feature gives a user the ability to set an
access password to a USB drive, which means thatthe imager should provide
functionality to unlock the drive before the imaging starts, prompting for a user
password. Unfortunately, such security protocols are vendor-specific, so their
implementation requires more tune-ups to work properly compared to deploying any
standardized protocol.
Another aspect of USB security systems such as WD SmartWare is that the drive
creates a dedicated area at the end of its LBA space where it stores all of its
security-related data. Access to this area, which usually takes up to 30-50 MB, is
protected by the drive, so this data is not accessible via USB protocols. In fact, to
hide this area, the drive reports a lower number of sectors via a USB connection, for
example, from LBA0 up to the first LBA of the security data. Certainly, a USB imager
should be able to overcome this limitation, giving access to the entire capacity of the
drive, including the security area. This capability is especially important for cases
that require recovery of corrupted security data and also from a computer forensics
perspective. As one of the possible solutions, access to a hidden security data could
be implemented using an ATA-over-USB protocol.

5. Another new feature of USB drives that is worth looking at from a DR perspective is
the availability of an extensive USB-SCSI Error Messaging system. Such a high-
level error reporting system lets a USB drive report extra diagnostics information,
which definitely helps identify many issues while dealing with unstable or degraded
drives.
Lack of reporting functionality was always a problem when dealing with ATA drives,
so native USB imaging gives an advantage from this perspective. For example,
when a read block timeout occurs during an ATA imaging, there is no information
available about why the drive failed to return data for that block. During a USB
imaging process, the drive may provide more information on why this failure
happened. The drive may be busy with its internal background processes (for
example, the drive is in the process of becoming ready), the drive may have a
media/hardware error, or the data located in this block may be protected.
Good news!
Finally, after such a long time without a proper imaging solution for USB drives . . .
the DR industry now has the first USB hardware imager implementing native USB
support. The DeepSpar USB Add-on PCI-e board adds all of the features mentioned
in this article to DeepSpar Disk Imager 4, once more extending the DeepSpar
market-leading position as a provider of professional data recovery imaging
solutions for the DR industry.
Author contact information
DeepSpar, ACE Data Recovery Engineering Inc.
1884 Merivale Road, Unit 9
Ottawa, Ontario
Canada K2G 1E6
Tel: (613) 225-6771
Fax: (613) 225-7766
E-mail: info@deepspar.com
Web: http://www.deepspar.com