Approximating a complete low-level image of a HDD?

[ecksemmess]

I'm in the process of archiving some HDDs, all IDE/ATA of various vintages by Maxtor and Seagate, ranging from 1 GB to 300 GB. I'm interested in getting the most complete, lowest-level dump possible, so it would be nice to be able to image the entire physical disk, not merely the Data Area. Is there any way to get a dump of the Service Area? I realize the answer is probably "no", but the SMART section of the Service Area is easily accessible, so it occurred to me that maybe the mechanism that allows access to the SMART data could in theory also allow access to more of the Service Area. Please note that I'm willing to purchase any software or hardware necessary to do this as long as the total cost stays under $1000 or so, but anything involving actual engineering or opening up the drive is out. In the research I've done so far, it seems like I'll probably have to live with a sector-level complete dump of the Data Area, combined with a complete dump of the SMART data, with the rest of the drive being totally inaccessible, but hopefully someone here will have better news

Thanks in advance for all assistance.

[warnerr]

No- begins at ten times your budget. But WHY???? Cant imagine SA of any use to you whatsoever. IMAGED drive is everything normally wanted including deleted data for forensics work.

[ShaneWard]

I have a drive that is cluttered with bad clusters on one side of the platter. There is only one physical head under the platters and I had an Idea that if I clone everything including the system area, then flip the disk around and then clone everything back to the new side, the drive will be as good as new.

Of course the drive cannot be turned off, will have to wait for it to go into standby before flipping the platter and then dumping the cloned data onto the other side.

But I get the feeling it won't work anyway, so that drive is just gathering dust somewhere.

Shane

[deftrue]

You cannot just flip the platter over and spect that the drive would be able to extract any data from it. Data layout, at the lowest level, has some structures that will be reversed if you flip the platter over (address mark, gain correction and servo bursts, the data itself, parity and integrity checks...). I still think that you might be able to do something if you reverse spindle spin's direction, and still, you'll have to deal with head-specific adaptives, which will vary in such circumstances. And also the headstack would be in a mirrored fashion, which I believe is dangerous for the heads themselves.

On the other hand, I believe it is of interest being able to image the whole S.A. for high-level forensic purposes. A few months ago I read a blog entry about a way of hiding data in an HDD, marking sectors as defective in the G or relocation list and reconstructing the translator, or something similar. Such depth in forensics investigations is of real interest, given the fact that you may have a few thousand sectors being relocated or marked as defective during the hard disk's lifetime, and you can logically DOS-erase that hard disk, but you may still be able to get those sectors back, unchanged, because (most/all) overwriting tools work at the LBA level.

Cheers

[ecksemmess]

Yes, I was thinking along the lines of forensic purposes. I'm not surprised that there's no solution in the range of a few hundred dollars, but figured I'd ask. Basically, anything that would allow me to image parts of the drive at a lower-than-sector level (including non-data structures in the data area), or access and image any of the contents of the SA other than the usual SMART reports. I know it probably seems excessive and pointless, and I'll be shocked if there is actually a workable solution in my budget, but figured maybe someone here will surprise me

[ecksemmess]

Thanks Spildit--exactly the information I was looking for. Unfortunately, CT/SD are still a bit over budget. What's strange is that from what I've read, SpinRite (cursed be its name) seems to use methods that are quite capable of imaging data from a drive in a sub-sector, ultra-low-level sense, and it's practically free. I don't know if it can see the negative cylinders, but it supposedly can reposition the heads on the positive cylinders so precisely that it can probably see the servo tracks and such. It almost seems like someone could modify the code to use it for a nice, complete ultra-low-level dump of a disk (turning off the ghastly bad sector "recovery", of course!) Is this a crazy idea? Have I misunderstood what the program is capable of?

[fzabkar]

What's strange is that from what I've read, SpinRite (cursed be its name) seems to use methods that are quite capable of imaging data from a drive in a sub-sector, ultra-low-level sense, and it's practically free. I don't know if it can see the negative cylinders, but it supposedly can reposition the heads on the positive cylinders so precisely that it can probably see the servo tracks and such. It almost seems like someone could modify the code to use it for a nice, complete ultra-low-level dump of a disk (turning off the ghastly bad sector "recovery", of course!) Is this a crazy idea? Have I misunderstood what the program is capable of?

SpinRite was written in the days of stepper motor, MFM drives. In those days the user needed to low level format the drive. Since the platters expanded with temperature, and since stepper motors were affected by gear lash, especially as they began to wear, SpinRite attempted to approach the track from both directions. Today most, if not all, of Steve Gibson's claims are inappropriate, to put it mildly. In fact you just need to look at the screenshots on the SpinRite web site. IIRC, the most recent screenshot is for a 200MB drive. Yes, that's MEGAbytes.

[ecksemmess]

Useful info, thanks again. And thanks even more to Spildit for that tip--tons of great stuff on that site.