How Professional Data Recovery Varies from Non-Professional
Updated: Oct 6, 2022
Professional Evaluation of a Hard Drive: In professional data recovery, the steps taken when a hard drive is first received for evaluation are critical. These steps are built on both experience and knowledge. For example: If a hard drive has been dropped and therefore more than likely has read-write head failure, we would initially open the drive up in the cleanroom and check for damage to the read-write heads. If the drive goes to a location without a cleanroom, the only option they have to 'test' the drive is to power it up, risking further damage to the drive and possibly making the drive unrecoverable.
Cleanroom Work: When a hard drive is opened after mechanical failure it MUST be opened in a cleanroom environment. Professional data recovery companies use Class 100 cleanroom environment (at a minimum) which filters out particulate matter from the air. The read-write heads in a drive travel approximately 3nm (nanometers) over the platter surface. That's smaller than a smoke particle. So any dust getting inside the drive enclosure can make a drive unrecoverable. DO NOT BELIEVE WHAT YOU SEE ON YOUTUBE.
Recovering a Hard Drive: Any recoveries done by a professional data recovery company will start with making an image of the clients drive. This is done at a sector level. Professional data recovery hardware and software combinations allow us to image sectors on a drive in sequential order. So whether we are imaging the file system, or the whole drive, our pro software allows us to sort the data we need into sequential order. We start at the sector containing the first byte of data and image through to the last sector in sequential order. This prevents the read write heads from searching all over the drive for the data. This puts the least amount of strain on the drive, and therefore increasing the recovery chances. When we image a drive, every sector of data (512 bytes) is copied to a different drive or an image file. We never lose the chance of recording a sector as that may be the only time that sector can be read. Professional tools such as PC-3000 allow us to read sectors forwards, backwards, with software and hardware rests, increased read-timeouts and a host of other methods to recover as much data as possible.
Firmware Failures: Some hard drives (especially Seagate) suffer from firmware failures. A hard drives firmware is its own internal OS. Without reading this firmware the drive will not be able to access user data. Professional Data Recovery companies have tools such as PC-3000 which can read and re-write the firmware to regain user data access.
The End of the Recovery: Every professional data recovery company will keep a copy of the recovered data for a set period of time (normally 10 days). So if anything happens to the data when being transported, they do have a backup copy. You would be surprised how many times this backup data is needed.
Tim Homer - Desert Data Recovery