|
What to do when media has failed
|   |
|
What to do when media has failed
| |
A very important rule of data recovery is never to make the situation worse, and never change anything may prevent the next level of recovery being attempted, if the first level fails. Put very simply, this means that one should never write to a media that has failed or become corrupted. With Read Only memory, such as CDs, and DVDs, this is not a problem. For hard disk drives, this message is extremely important.
If the media is failing, such as a hard disk acquiring more bad sectors, the best first stage is to make an image of the disk. This image may then be used without any danger of either making the hard disk fail quicker, or fail so that no more data may be recovered. Forensically, this is also a very good move all time spend with the original media has to be logged and monitored very carefully. A true image of the disk, with relevant MD5 hash value reduces some of the chain of custody issues when dealing with a forensic, or legal recovery situation
Data recovery is required when media either fails due to either hardware issues, or software corruption.
Hardware issues
To recover data first one must be able to read the media. A very simple test is to go to the view sector function and try reading a few random sectors. If sectors can be read, then there is good hope of further recovery. If no sector can be read, then one needs to investigate further, but data loss may be the outcome. See Hardware failure, what next for some ideas
With failure due to hardware issues, the first stage must be to access as much data as possible from the disk, and save on a new storage device, ie another harddisk. The best way to do this is to make a disk image using the Image and raw recovery function. A curious aspect of hard drives is that most modern ones are allways recalibrating themselves. This sometimes shows with a drive that can be extremely slow to read, but after maybe 12 hours suddenly goes quickly. This can also be due to errors being mainly at the start of the disk. See Recovery from a drive with many bad sectors for more details
With a drive that cannot be recognised by a PC, but the disk is still spinning, there may be an issue with the controller board. Replacement of the controller is actually very simple, just unscrew about 5 screws. It must then be replaced with an identical card, with identical version. However, do not expect a high success rate for this. If the heads have failed, then a new controller board will not assist. Also, with reference to the recalibration note above, the controller boards may be calibrated so far apart, that no data will be seen.
Opening the drive should never be done. Unless opened in a special clean room environment (ie not an office or domestic room) the drive will be damaged due to dirt in the air.
Software issues
Unlike hardware issues, software corruption is often easier to handle. As always, it is best to make a copy of the drive, so that there can be an unlimited number of attempts to recover data by using different aspects of CnW Recovery software, and sometimes by trial and error with setting parameters. Much of this manual will guide you through different appropaches that can be tried.
Corruption, and software failure can be caused by one, or many of the following causes
Any many other reasons