The equipment of Tiangong Technology can be widely used in various data recovery laboratories, data analysis institutions, education platforms, big data room, command and dispatch center, multimedia data center and many other scenarios. It is the designated data source recovery technology “efficiency source technologyâ€. Equipment appearance supplier. The following is the specific application of the "Data Analysis All-in-One ED-MD9200" in the efficiency source technology data recovery service.
Equipment Name: DRS Data Analysis Machine ED-MD9200
Function introduction: It adopts aluminum-magnesium alloy casing, military quality, and automotive paint process to design a rugged analytical equipment; the product adopts 21-inch multi-touch display, no need for external control equipment; multi-interface integrated integrated technology design, Ensure that the device connection is more convenient and the overall layout is more coordinated; support I7/I5/I3 processor configuration and SSD solid state drive to ensure efficient data processing; device special physical read-only interface, which can greatly improve the data analysis process Security and normative.
Equipment pictures:
[Editor's note: At the beginning of this period, the topic of "hard disk opening" entered the third phase, and the efficiency source engineers continued to explain the "opening data recovery method for the Western Digital hard disk scratch into a 'ring runway'." In Phases 1 and 2, the "Fault Detection - Opening" and "Data Recovery - Change Head" methods of the case disk (Western 2TB hard disk) have been introduced, including the importance and operational difficulties. In this issue, we will focus on another important data recovery operation for opening data recovery - "hot swapping". This method is used to repair the hard disk and try to recover the hard disk data. 】
Disc scratching is a common situation encountered in hard disk hardware failures, which can lead to bad sectors. The hard disk's own protection mechanism will instruct the hard disk to stop running when it encounters a bad sector. Because the operating system starts, it will automatically check all hardware devices, and when the hard disk is found, it will read all the partition information of the hard disk. If a bad sector is encountered, the damaged sector is cyclically read, causing the entire system to fall into an infinite loop, causing the system to crash.
In this case, you must not "barbaric operation", you should change the idea, copy the data from the fault disk to the normal disk for recovery and extraction. But the premise of mirroring is that the hard disk can be started normally. "Hot exchange" is an effective way to solve this problem. The same hard disk "code table, segment, and adaptation parameters" of the same hard disk microcode is used to steal the normal disk, which provides the basis for hard disk image. .
1, the actual combat object: Western Digital 2TB hard drive, SATA interface, as shown in Figure 1. Normal use on the first night, power off, the next day after connecting to the computer, the hard drive is not recognized, accompanied by abnormal knocking.
Figure 1 Western Digital Hard Drive (Case Disk)
2. Hard disk preparation (2 physical disks, 3 concept disks):
(1) Recovery disk A: There is a failure, and the data to be extracted is stored.
(2) accessory disk D: replacement firmware (same version as A)
(3) Fittings D1: Replacing the firmware (with the same version as A, changing the D table of the decoding table, segment, and adaptation parameters)
(4) Combination disk AD: new disk composed of recovery disk A disk and accessory disk D circuit board
(5) Combination disk AD1: a new disk composed of the recovery disk A disk and the accessory disk D1 circuit board
4, the cause of the failure: the initial test of the efficiency source engineer, the hard disk head is damaged, the disk has serious scars (before the delivery, the hard disk is repeatedly energized, causing damage), this is the reason that the hard disk is not recognized. Specifically, as shown in FIG. 2, B is a real-life picture of the case hard disk, and A picture is an effect of correcting the processing into a normal disk based on the B picture to compare the scratch degree of the disk “circular runwayâ€.
Figure 2 Hard disk platter is seriously scratched
5. Data recovery in the early stage: After the disk is opened or replaced, the hard disk still cannot be started normally. The engineer analyzes and discusses that this phenomenon may be related to the scratch of the disk. The magnetic head stops running because of the bad sectors. I decided to try the "hot plate change" method, directly change the firmware of the recovery disk A and the normal disk, and extract the data by "stealing the beam". See the first and second issues for details.
6. The first hot change plate: Connect the accessory disk D to the DRS data recovery system. After identifying the hard disk parameters, stop the D drive motor through the “off motor†function module. The button shown in the "yellow box" of Figure 3:
Figure 3 Click DRS "Off Motor" to stop the D drive motor
After ensuring that the D disk motor is stopped, the circuit board of the target disk A is removed and placed beside the accessory disk D. Keep D to remove the board screws without powering down, exchange the disc body (except the part of the board) with the disc of the object disc A, and combine them into a new "combination disc AD" to fix the "combination disc AD". Board screws. Figure 4 is a schematic diagram of the internal results of other hard disks. It is not a real-life hard disk, but only presents an "swap" effect.
Figure 4 Schematic diagram of the hot plate change (picture modification)
Click “Open Motor†on the DRS (as shown in Figure 5). At this time, the sound can be found. The head and motor of the “combination disk AD†work normally. The operation of “stealing the beam†is successful, and the defect list of the recovery disk A is read out. The firmware module associated with the decoding table, segment bits, and adaptation parameters.
Figure 5 Click DRS "Open Motor" to start the combination disk AD
After successful reading, remove the circuit board of the "combination disk AD", replace the recovery disk A disk body with the original disk body of the accessory disk D, and the previously read firmware module is written to the accessory disk D, and the decoding is changed. Table, segment, and accessory parameter D1 (The parameter changed at this time is exactly the same as the firmware parameter of the A disk to be restored, and it needs to be hot-changed again to access the A disk data normally).
P table, P-list (perpetual permanent defect table). Nowadays, the density of hard disks is getting higher and higher. The hard disk manufacturers are extremely precise in the process of producing disks, but it is also extremely difficult to achieve 100% perfection. There are some defects in the disk surface. The manufacturer formats all the hard disks in the low-level format before the hard disk is shipped from the factory. In the low-level formatting process, all the defect tracks and the defect sectors are automatically found and recorded in the P-list. And in the process of numbering all tracks and sectors, skip (snap) these defective parts so that users can never use them. In this way, it is difficult for a user to find a problem when partitioning, formatting, and checking a new hard disk that has just been purchased. A typical hard disk records a certain number of defects in the P-list, ranging from hundreds to tens of thousands. If it's a SCSI hard drive, you can find a variety of common software to view the P-list, because the various brands of SCSI hard drives use a compatible SCSI command set. Different brands of IDE and SATA hard drives use different instruction sets. If you want to view their P-lists, you need to use targeted professional software.
7. The second hot plate change: The same method as the "first heat exchange" is used to exchange the discs of the accessory disc D1 and the recovery disc A through the DRS "off motor" and "open motor" function modules. The board screws are combined into a "combination disc AD1". After clicking "Open Motor" again, the combination disk AD1 starts normally and the "hot plate change" is successful.
8, view the sector: immediately through the DRS data recovery system to view the sector, you can see the "combination disk E" before and after the sector. At this point, successfully enter the efficiency source DRS data recovery extraction page, but still can not read the partition information, DRS prompts, bad sectors encountered in data reading, only scanning can read.
9. Image copy data recovery: The combination disk AD1 and the mirror disk B are simultaneously connected to the DRS. Click the "Mirror" button, select the data source "combination disk AD1" and the target location "mirror disk B", and clone all the data of the "combination disk AD1" to the mirror disk B (normal hard disk) to provide conditions for data scanning. As shown in Figure 6:
Figure 6 DRS data recovery system can complete high-speed mirroring
10. Data extraction: After the mirroring is completed, the mirror disk B is scanned, and the directory is complete. Immediately, the data is successfully exported through DRS. After verification, the data recovery and forensics successfully exported 8-9% of the data, and there is almost no loss. At this point, the image data recovery work of Western Digital 2TB hard disk is perfect.
Hot-changing board is a good way to solve the problem that the hard disk is not recognized, but in use, the efficiency source engineer reminds that there are several points to be noted: (1) The hard disk cannot be powered off after the hot-changing, otherwise the board information will be reset. The faulty hard disk will reread the firmware information of the disk, which will result in failure to be ready; (2) the hot swap has to be operated twice, the first time to use DRS to read the important module of the recovery disk A, and the second time to read the data directly.
[Editor's Note: Through the three-phase topic, the series of "Opening Data Recovery Method for Western Digital Hard Disk Scratch into 'Circular Runway"" was successfully completed. This case is a typical scenario often encountered in the field of electronic forensics, forensic identification and data recovery. The related hard disk has a “double†fault: head damage and stencil scratching, and these two faults are often “come with each otherâ€. If it is just a general data recovery method and environment, the success rate will be very low. In this case, the key technologies used by efficiency source engineers include three types: opening, changing heads and hot-changing boards. Among them, opening and replacing the head requires a professional dust-free environment and excellent operators. For hot-changing boards, you need a "professional tool" like the DRS data recovery system. Using the "stop motor" technique, you can trick the failed hard disk into the firmware quality check, enter the working state, and successfully extract the data. 】
Paper Holders,Stainless Steel Paper Holder,Towel Paper Holder
Fucheng Metals Production Co., Ltd. of Jiangmen City , https://www.fcmp.com