Methodology

1. Evaluation Phase

During the Evaluation Phase we determine how the device has failed and the type of intervention required for a successful recovery.

If the drive is relatively functional and the issue is determined to be loss of partition information or deleted files, it will likely qualify as a Level 1 recovery and move on to the Imaging Phase. Some drives that are inaccessible because of multiple bad sectors will also qualify for a Level 1 Recovery.

If the drive is determined to have a firmware issue, electrical damage, or an internal mechanical problem, it will be quoted at a Level 2 or Level 3 recovery and move to the Repair Phase.

2. Repair Phase

Here we address the issues causing the drive to malfunction in order to manipulate it into at least a temporary state which allows sector access.

Firmware Issues

Many firmware issues are caused by the beginning of an internal mechanical failure. One example of this is when a single read/write head in a multiple-head drive begins to generate an abnormal amount of read/write errors. A hard drive's internal firmware, stored in a hidden service area, is responsible for processing these errors but can become corrupt in a situation like this, causing the drive to malfunction. Using specialized equipment such as the PC-3000, we are able to access the service area and issue vendor-specific commands to repair the corruption, temporarily restore sector access, and image the drive before the head completely fails. This is an example of a Level 2 repair/recovery.

Mechanical Failures

Any drive that requires disassembly and intervention in a cleanroom environment qualifies for a Level 3 recovery. These repairs can range from replacing or cleaning read/write heads to removing contamination from platters to changing platters to a new drive base because of a motor or alignment problem. All cleanroom repairs require extreme precision, can be quite time consuming, and often inspections and repairs must be performed under a microscope.

Head Slider at 80x Magnification
Before Cleaning (Contaminated)	After Cleaning

3. Imaging Phase

Our next step is to create a sector-to-sector mirror image of the patient drive onto a temporary storage device.

At this point, if firmware repair or mechanical intervention has been required, the repaired drive is typically in an unstable condition and would not be properly recognized by a typical computer's operating system.  To manage drive instability and allow consistent sector access, it is necessary to use specialized imaging hardware such as a DeepSpar Disk Imager (shown imaging in picture) or PC-3000 with Data Extractor to complete the imaging process.  These advanced tools issue commands directly to the drive and bypass an operating system "middle man".  The hardware imager is programmed with an algorithm that must be tailored to each drive to allow for optimal copying performance and stability. It is usually necessary to modify the algorithm many times until the imaging process is complete or as many sectors as possible have been recovered.

4. Recovery Phase

In the final phase we begin individual file recovery from the copy of the patient drive created in the Imaging Phase. Recoveries with damaged file systems are scanned with reconstruction software to restore original folder structure. Intact data is then copied to a new storage device which is given to the client.