[ale] Extreme Practical Data Recovery (Part 2)

Robert Reese~ ale at sixit.com
Wed Jul 23 16:46:46 EDT 2008


> I work with disk drives as a routine part of my job (Computer
> Forensics) but I admit to not knowing the ATA spec. as intimately
> as some might.
>
> for instance I know that hdparm's releases in the last 6 months
> have the best low level sector addressing capability I have seen.
> (ie. you can read and write a true sector including the checksum
> data that you no access to via normal 512 byte sector i/o.)  You
> can now use hdparm to perform fault injection into a specific drive
> sector to see how a raid array etc. responds to failed read.
>
> I really don't think there are any ATA commands that let you tweak
> the positioning of the head, signal strength etc., or I think I
> would have read about it by now.
>
> ddrescue attempts to increase the likelihood of a succesfull data
> read by doing tricks like reading the sectors in reverse order.
> This is an attempt to get the heads to move to a slightly different
> position than if you do it in the normal forward order.
> Supposidely it can help, but if there were real mechanisms to
> control the head positioning, this kind of trick would not have to
> be employed.

 From my understanding, which admittedly is far more limited than yours concerning these drives, spinrite probes and prods the each sector in an effort to read the correct value for it.  Once it has decided on a value it rewrites it as well as possible; my further understanding is that the heads never have the exact same track twice, leading to inconsistencies in the sector.  Particularly in frequently changed sectors, the particles' magnetic fields will not necessarily be aligned to represent the same bit.  In other words, it can get "fuzzy".  And since we're years away from using fuzzy logic this can be problematic. ;c)

I'm not discounting hdparm or ddrescue; indeed I've heard great things about them.  I'm relating my experience first-hand in using spinrite on bad drives.  We all know how effective the diagnostics are from the manufacturers as well as how useful the automatic error correction works on these drives.  And how poorly each work as well.  My experience with spinrite shows that whatever it's doing, it is doing it better than the automatic stuff the manufacturers have stuck on the drives or on their CDs.  (Nor can we discount the obvious financial incentive manufacturers have in not using every resource to extend the life of drives, too!)  In the end all that matters is that the data is more likely to be rescued in combination with spinrite than from using recovery softwares sans spinrite.  Of course, even though there are claims of extending the life of the drive, I only care for it to be extended long enough to get the data off reliably!  Anyone who trusts the drive after this is either desperate or a fool.

Anyway, feel free to write Steve as he'll certainly be able to answer your questions better than I, and in a much higher degree in technicality that I could ever espouse.  sales2008 at grc.com is probably the best place to write him, since it looks like he's removed his private email from his website.  By the way, while I've only written him once I can say he's far more open and approachable than many business people I've encountered.

Cheers,
R~



More information about the Ale mailing list