How to learn soft data recovery?

[elmad]

Hi, I'd like to learn something more about data recovery.

For now, I recovered data on my disks and friend's disks with linux tools as dd_rescue and hdparm to remove HPA and things like these. Easy recoveries, because in these cases the disk is working. But many hours recoveries when many sectors are unreadables, because of timeout in retry readings.

Now I'd like to make a little step more. I'd like to image the disk at a lower level, without ata timeouts and retries. For example, MHDD can do this? I have seen in the scan operation it read the sectors, record the time and goes on. Is it possible image the disk in this way? And do you know if is there some linux app that can do this? I mean, talk to ide/sata controller without interacting with the kernel?

[labtech]

The next step in improving the imaging process is using some sort of hardware based imager. These are expensive. Search the forum here for them and you will many posts about this topic.

[elmad]

The next step in improving the imaging process is using some sort of hardware based imager. These are expensive. Search the forum here for them and you will many posts about this topic.

And this is the problem . I cannot afford buying tools, because usually price is very high and I haven't an earning from this activity. Also I'm a little tired to do for free these recoveries (and I cannot ask money to do a simple dd_rescue) because often requires many hours. So I'm thinking at least how I can speed the imaging phase. The other solution is dont do recoveries anymore but anyway I'd want to know if is possible to image the drive skipping the OS procedures.

[fzabkar]

The next step in improving the imaging process is using some sort of hardware based imager. These are expensive.

... at the moment. ;-)

[labtech]

Can you define "skipping OS procedures"?

I doubt the prices will go down enough where individuals like the OP and other with similar constraints will be still be interested, unless the case volume increases. The amount of clients will dictate how much to invest in expensive tools. Unless one builts their own somehow.

In fact the prices have gone up as the imaging technologies have and will continue to improve.

[networks]

YES you can ask $$$ for recovering their valuable data YES SIR YOU CAN !!! I would say keep doing what your doing and start charging for your time and use the money to buy a DDI4 when you get enough from the work. My guess is the people your doing this work for free wouldn't pay for Pro Recovery if they needed their data back and of course "free" is the best bargin they can find but thats disrespectful to you at the same time. Stop working for FREE ! Really !

[elmad]

Can you define "skipping OS procedures"?

I mean, for example: linux programm dd calls some kernel function to perform a read or a write. Instead MHDD talks directly to IDE controller and not to MS-DOS if I understood well. So, if dd read a damaged sector (wrong ECC for example) I have seen in the kernel messages that the kernel, for 1 read, perform 3 attempts with 1 second timeout, if I remember well.

So I'd like to use some application that can read sectors just 1 time and, if possible, goes on if the reading time is more than a settable timeout. But I dont know if the last point depends also on disk internal firmware.

YES you can ask $$$ for recovering their valuable data YES SIR YOU CAN !!! I would say keep doing what your doing and start charging for your time and use the money to buy a DDI4 when you get enough from the work. My guess is the people your doing this work for free wouldn't pay for Pro Recovery if they needed their data back and of course "free" is the best bargin they can find but thats disrespectful to you at the same time. Stop working for FREE ! Really !

You are right, but people who I helped until now was friends that had not so important data and I did some experience. Only one time, a friend's friend situation, I was disappointed and probably next time I will ask some money in these situations, because as you say, I loose time and I'm not learning (about simple imaging) anymore.

[labtech]

Linux dd_rescue as an imaging tool is just about as effective as all other tools, but on the flip side is just as poor as all other software based tools, when dealing with severely damaged drives that can become unstable and unresponsive.

[fzabkar]

Linux dd_rescue as an imaging tool is just about as effective as all other tools, but on the flip side is just as poor as all other software based tools, when dealing with severely damaged drives that can become unstable and unresponsive.

AISI, a hardware imager appears to be little more than a software tool with a hardware dongle. About the only indispensible thing that it does is to cycle power to an unresponsive drive. That's a feature that could easily by incorporated in ddrescue by way of a cheap (~US$20) PCB add-on. All you would need would be couple of high-side MOSFET switches, two polyswitches for short circuit protection, and some logic for interfacing via RS232, parallel port, or USB. Of course ddrescue can't do such things as imaging by head, but that's still just a software feature that could be added if the right information were available.

[BlackST]

Linux dd_rescue as an imaging tool is just about as effective as all other tools, but on the flip side is just as poor as all other software based tools, when dealing with severely damaged drives that can become unstable and unresponsive.

HW imagers and other more sophisticated tools do a lot more, there is a reason if they cost a lot.

[BlackST]

Can you define "skipping OS procedures"?

I mean, for example: linux programm dd calls some kernel function to perform a read or a write. Instead MHDD talks directly to IDE controller and not to MS-DOS if I understood well. So, if dd read a damaged sector (wrong ECC for example) I have seen in the kernel messages that the kernel, for 1 read, perform 3 attempts with 1 second timeout, if I remember well.

So I'd like to use some application that can read sectors just 1 time and, if possible, goes on if the reading time is more than a settable timeout. But I dont know if the last point depends also on disk internal firmware.

YES you can ask $$$ for recovering their valuable data YES SIR YOU CAN !!! I would say keep doing what your doing and start charging for your time and use the money to buy a DDI4 when you get enough from the work. My guess is the people your doing this work for free wouldn't pay for Pro Recovery if they needed their data back and of course "free" is the best bargin they can find but thats disrespectful to you at the same time. Stop working for FREE ! Really !

You are right, but people who I helped until now was friends that had not so important data and I did some experience. Only one time, a friend's friend situation, I was disappointed and probably next time I will ask some money in these situations, because as you say, I loose time and I'm not learning (about simple imaging) anymore.

Actually there's NO alternative to dedicate HW imagers OR other professional tools that have proprietary algo and communicate directly with the disk taking into account BRAND and FAMILY. Power cycle is not healthy on unstable drives.
All the software around the net are basically same stuff, some can be configured better and some not (retries, etc.) but for them each drive is the same.
Side note : DDI is about 4000 EUR + extras, add another amount for TS and updates.
Final consideration : I always wonder why comes out that people ask someone else to "clone" a drive with free tools instead of doing it by themselves. Either it is laziness or lack of "experience" ( ? ) , but math doesn't add up.
I have witnessed a lot of horror stories of "unimportant data, if you succeed it's Ok otherwise it doesn't matter" on drives that have been DDrescue'd / Internet'ed / Free-stuff-ed to death and then suddenly the drive contained irreplaceable data / valuable data / accounting data / memories , with the owner yelling and menacing or doing further actions against the poor "helper" (who in turn had finally to resign and ask and pay professional recovery).
Especially nowadays, when people are in search of the right time to make troubles and "pull an easy one" out of it (sad but true), it is NOT a good idea to "offer such services" (free attempt with free stuff on someone else data) if you are not sure about what's going on with the drive and without a shift of responsibility. It is different if you are a professional (you suppose you are also insured against such problems) and you own the state-of-art tools , in a nutshell if you did your best with the best in good faith. Just today's 0.02.

[elmad]

Can you define "skipping OS procedures"?

I mean, for example: linux programm dd calls some kernel function to perform a read or a write. Instead MHDD talks directly to IDE controller and not to MS-DOS if I understood well. So, if dd read a damaged sector (wrong ECC for example) I have seen in the kernel messages that the kernel, for 1 read, perform 3 attempts with 1 second timeout, if I remember well.

So I'd like to use some application that can read sectors just 1 time and, if possible, goes on if the reading time is more than a settable timeout. But I dont know if the last point depends also on disk internal firmware.

YES you can ask $$$ for recovering their valuable data YES SIR YOU CAN !!! I would say keep doing what your doing and start charging for your time and use the money to buy a DDI4 when you get enough from the work. My guess is the people your doing this work for free wouldn't pay for Pro Recovery if they needed their data back and of course "free" is the best bargin they can find but thats disrespectful to you at the same time. Stop working for FREE ! Really !

You are right, but people who I helped until now was friends that had not so important data and I did some experience. Only one time, a friend's friend situation, I was disappointed and probably next time I will ask some money in these situations, because as you say, I loose time and I'm not learning (about simple imaging) anymore.

Actually there's NO alternative to dedicate HW imagers OR other professional tools that have proprietary algo and communicate directly with the disk taking into account BRAND and FAMILY. Power cycle is not healthy on unstable drives.
All the software around the net are basically same stuff, some can be configured better and some not (retries, etc.) but for them each drive is the same.
Side note : DDI is about 4000 EUR + extras, add another amount for TS and updates.

But for example MHDD scans the disk in a way that is more "direct" than linux + dd, or windows and other free tools. I mean, is there a program that talks to the disk with ATA commands without the OS in between? Or is possible cloning a disk with MHDD?

Final consideration : I always wonder why comes out that people ask someone else to "clone" a drive with free tools instead of doing it by themselves. Either it is laziness or lack of "experience" ( ? ) , but math doesn't add up.
I have witnessed a lot of horror stories of "unimportant data, if you succeed it's Ok otherwise it doesn't matter" on drives that have been DDrescue'd / Internet'ed / Free-stuff-ed to death and then suddenly the drive contained irreplaceable data / valuable data / accounting data / memories , with the owner yelling and menacing or doing further actions against the poor "helper" (who in turn had finally to resign and ask and pay professional recovery).
Especially nowadays, when people are in search of the right time to make troubles and "pull an easy one" out of it (sad but true), it is NOT a good idea to "offer such services" (free attempt with free stuff on someone else data) if you are not sure about what's going on with the drive and without a shift of responsibility. It is different if you are a professional (you suppose you are also insured against such problems) and you own the state-of-art tools , in a nutshell if you did your best with the best in good faith. Just today's 0.02.

I get the point, and I got ever in account the problem of responibility. I say ever who ask me an help that if the data are important they have to go to a professional with the right tools. I dont ask money also for this reason. I cannot take any responsibility and I dont work on important data.

After that, I have a question about these stuff. I image the disk with dd in a linux environment for two reasons: I prefer work on linux and I scare that Windows do some write dont asked at the disk. As I've seen one time with 1 disk of mine, windows run chkdsk on the disk without the user permission. So my "method" of work is: plug the disk in a linux enviroment, not mounting it (better could be to use a hardware write blocker) and if the disk identifys try to cloning it to get an image. After that I make a backup's copy of the original image and I work only on the image.

Do you think that it's dangerous anyway what I do? I mean, power cycle the disk is one thing that the normal user do many times before to understand that have need of assistance. And anyway, if there is a mechanical problem, usually the disk's firmware doesnt respond at all, so if I clone the disk without write on it, I dont think that I can ruin the disk. Am I wrong?

[Vulcan]

Too many questions for me to reply to all, so just a couple of comments:

I mean, is there a program that talks to the disk with ATA commands without the OS in between?

One example is Media Tools Pro (commercial) or write your own.

Or is possible cloning a disk with MHDD?

Realistically, no (e.g. ATOF functionality doesn't leave a gap for unreadable sectors).

if I clone the disk without write on it, I dont think that I can ruin the disk. Am I wrong?

There are ways that you could "ruin" a drive (especially some types of failing-but-not-yet-completely-dead drives) even without writing on them.

[elmad]

if I clone the disk without write on it, I dont think that I can ruin the disk. Am I wrong?

There are ways that you could "ruin" a drive (especially some types of failing-but-not-yet-completely-dead drives) even without writing on them.

Interesting. But can you be a little more specific? Or say an example? I'd like to understand how in these cases professional tools or hardware tools are more safe to clone the disk. Or you mean that in these cases a professional DR opens the disk and fixes hardware problems before to clone?

[Vulcan]

Or you mean that in these cases a professional DR opens the disk and fixes hardware problems before to clone?

Yes - for example, when a repair is needed before an unstable or damaged head scratches the platter. In a DIY situation with this problem, that repair isn't done and the platter(s) could be permanently damaged causing (avoidable) loss of data, even when the "problem" disk is only reading.

[elmad]

Or you mean that in these cases a professional DR opens the disk and fixes hardware problems before to clone?

Yes - for example, when a repair is needed before an unstable or damaged head scratches the platter. In a DIY situation with this problem, that repair isn't done and the platter(s) could be permanently damaged causing (avoidable) loss of data, even when the "problem" disk is only reading.

Ok. And is it frequent that a firmware modern disk doesnt detect a scratching head and let the user use the disk?

[Doomer]

Ok. And is it frequent that a firmware modern disk doesnt detect a scratching head and let the user use the disk?

There is currently no way to detect "a scratching head" for a drive. It can only detect weak or no signal coming from a head. Usually it is too late

[Vulcan]

And is it frequent that a firmware modern disk doesnt detect a scratching head and let the user use the disk?

I didn't say that the head was already "scratching". Remember that mechanical things can change after a drive's firmware has successfully initialised. As always, answers depend on the specific situation...

[elmad]

I have read in this forum that part of firmware is in track -1 of platters (if I have not misunderstood). So my question was related at this fact. Better question is:
is possible that a head can read -1 track and then scratches other zones of platters?

But maybe Vulcan already answered me at that question:

Remember that mechanical things can change after a drive's firmware has successfully initialised. As always, answers depend on the specific situation...

[labtech]

Scratching can occur anywhere on the platter, but typically it will start in the firmware area (- track #) as that is where the head will try to read first (since a drive can't operate without firmware running it) whether on power on or after a reset when the drive will have become unstable.