Toshiba 500G hard drive bruises "1 small point"

The equipment of Tiangong Technology can be widely used in various data recovery laboratories, data analysis institutions, education platforms, big data room, command and dispatch center, multimedia data center and many other scenarios. It is the designated data source recovery technology “efficiency source technology”. Equipment appearance supplier. The following is the specific application of the "Data Analysis All-in-One ED-MD9200" in the efficiency source technology data recovery service.

Equipment Name: DRS Data Analysis Machine ED-MD9200

Function introduction: It adopts aluminum-magnesium alloy casing, military quality, and automotive paint process to design a rugged analytical equipment; the product adopts 21-inch multi-touch display, no need for external control equipment; multi-interface integrated integrated technology design, Ensure that the device connection is more convenient and the overall layout is more coordinated; support I7/I5/I3 processor configuration and SSD solid state drive to ensure efficient data processing; device special physical read-only interface, which can greatly improve the data analysis process Security and normative.

Equipment pictures:

Toshiba 500G hard drive bruises "1 small point"

[Editor's note: "Technology combat - hard disk open" series 4, efficiency source engineers explain the second technical actual case - Toshiba 500 hard drive secondary opening data recovery. Because the hard disk platter involved in this case was seriously injured, the key parts of the platter have small points, the edge of the disk cavity is deformed, and it has been opened by other organizations before (the opening environment, process, method, etc. are unpredictable, It is not clear whether other hardware damage has been caused to the disk, and the data to be extracted is all video. Such a variety is very difficult and typical. 】

In the third phase of "Technical Combat", the situation of stencil scratching was explained in detail. The external violent impact easily caused the disc to collide with the magnetic head or other hard disk components, causing the disc to be scratched. In the case that the motor is not started, it may be a small point and small scratches. If the hard disk is running at a high speed, large areas may be scratched, and data recovery is very difficult.

1, the actual combat object: Toshiba 500G hard drive, as shown in Figure 1 (appearance is intact, no obvious signs of falls):

Toshiba 500G hard drive bruises "1 small point"

[Figure 1 Toshiba 500G hard disk (case disk)]

2. Hard disk preparation (3 N block physical disk):

(1) Recovery disk A: There is a fault, and a large amount of video data that needs to be extracted is stored.

(2) Mirror disk B: mirror copy data, post-analysis

(3) A number of accessory discs C: Replace the magnetic head (the same model and same batch as A)

3. Fault phenomenon: The hard disk cannot be recognized, other organizations open, and data recovery fails.

4, fault detection:

Because the hard disk of this case has been restored in many organizations (including the opening), the failure of the hard disk itself should not be simple, and the degree of secondary damage caused by multiple operations is difficult to predict. The efficiency source has been adjusted for the second opening. The most experienced engineers are fully engaged in data recovery.

(1) Observation: 360 degree view recovery disc A, there is no trace of damage on the appearance, including the most easily deformed hard disk around and corners (the shape must be carefully observed, if there is deformation, the internal fault of the disc may be more serious, the latter Recovery operations need to be more cautious).

(2) Opening: In the double-level clean studio, there is a very obvious point on the disc (Fig. 2). This point can be seen by the naked eye, and it happens to be difficult to recover data at the critical position of the disc. very large.

Toshiba 500G hard drive bruises "1 small point"

[Figure 2 The red arrow is the small point of the bump (the physical disk can be seen directly)]

(3) Analysis: According to this, it can be judged that the hard disk is subjected to severe impact without power supply. If the hard disk is in high-speed operation, a deep “ring runway” may appear again. Fortunately, the hard drive is not powered after the fault, otherwise the consequences will be very serious. According to comprehensive judgment, the hard disk has data recovery conditions, but it takes more time.

At this point, the fault detection of the Toshiba 500G hard disk is completed.

5, data recovery:

After the cause of the fault is determined, the data recovery link is officially entered. First of all, "disc processing and head replacement" are required, and if the head is replaced after normal replacement, the recovery work is successfully completed. If not, you will need to use other solutions, because the previous data recovery operation, not sure whether there are other secondary damage to the disk.

(1) Disc processing and head replacement: In the double-level dust-free studio, the disc is processed, and the head assembly of the accessory disc C is replaced with the recovery disc A (notes required for opening the disc, in "Technical Combat" There will be explanations in the first phase, which are not repeated here);

(2) Power-on detection: The recovery disk A of the replacement head is connected to the DRS data recovery system (Fig. 3), and the power is turned on, and an irregular knocking sound occurs;

Toshiba 500G hard drive bruises "1 small point"

[Figure 3 DRS data recovery system can pre-check hard disk hardware health]

(3) Reopening detection: re-enter the double-level dust-free studio opening detection, compare the recovery disk A with the disk cavity of the accessory disk C, and find that there is some irregular deformation of the disk cavity edge of the recovery disk A, here It is highly probable that the previous data recovery organization failed to open the recovery. Appropriate processing is performed on the edge of the disk of recovery disk A.

(4) Re-energization detection: The recovery disk A is again connected to the DRS data recovery system for power-on, the hard disk is normally found to identify the model, and the sector No. 0 is only made to one partition. The DRS data recovery system attempts to read the partition information (Fig. 4), and the partition information cannot be obtained normally.

Toshiba 500G hard drive bruises "1 small point"

[Figure 4 DRS data recovery system can quickly scan the partition (the interface map is the propaganda map, the real information of the non-recovery disc A, so there are multiple partitions)]

(5) Mirror copy data: Try to mirror the recovery disk A, and restore the disk A and the mirror disk B through the DRS connection, but there is a good period of failure in the mirroring process, and the hard disk firmware may also be faulty;

(6) Repair firmware: power off, convert the USB interface to SATA interface, and access HD Doctor Toshiba hard disk firmware (Figure 5). DRS data recovery system currently supports the firmware repair of Western Digital, Seagate, Hitachi brand hard drives, Toshiba hard drive temporarily need to use the old product HD Doctor Toshiba hard drive firmware to repair, and the device does not support USB interface. After half a day to process the hard disk image for a bad period of time, access the DRS data recovery system again to directly access the partition information and correctly identify the partition.

Toshiba 500G hard drive bruises "1 small point"

[Figure 5 HD Doctor can fully repair the 7 major brand hard drive firmware]

(7) Extract data: Communicate with customers and prioritize the most important data. Since the files are all video files, the amount of data is large, and the entire data extraction takes 3 days. During this period, the magnetic head was damaged 8 times, and nearly 10 magnetic heads were replaced. Finally, the data most needed by the customer was successfully exported, and nearly 90% of the important data was obtained.

[Editor's Note: The hard disk failure phenomenon in this case is often encountered in electronic forensics, forensic identification, and data recovery, and is very similar to the case of the first period. However, the difficulty lies in the fact that the disk cavity is deformed, belongs to the second opening, and extracts video data. If the environment, equipment, and operator's professional quality are not up to standard, it is difficult to succeed. This is the reason why many data recovery organizations failed to recover. The main methods used by the efficiency source engineers in this case include opening detection, replacing the magnetic head, repairing the firmware, etc., all of which have high requirements on the operating environment and the overall quality of the operator. If the standard is not met, it is likely to be the same as the previous organizations. Eventually failed.

What needs to be emphasized is that the failure rate of the second opening is very high. It is impossible to predict what the previous operators have done and whether they have serious damage to the hard disk. The efficiency source engineer once again solemnly reminds that the data recovery of important hard disks (especially involving major events or important clues) must be handed over to the professional data recovery organization for operation. Otherwise, the hard disk may be directly “discarded” and the important clues are completely lost. 】

?

Microscope Slide Storage Box

Designed as a concenient solution for temporary storage and transferring slide. Accommodates both the Yushuoda standard Microscope slides in dimensions of 75.0 mm* *25.0 mm with thickness from 0.8 mm to 1.2 mm and also the microscope slides of 76.0 mm*26.0 mm *(0.8 -1.2 ) mm on the market.

Slide Box,Slide Storage Box,Microscope Slide Boxes,Microscope Slide Storage Box

Xinxiang Vic Science&Education Co.,Ltd. , https://www.hnmedicalsciencemodel.com

Posted on