Information Recovery from Maxtor SATA HDD

Artem Makarov aka Robin
30.05.2008
17192 views

A representative of one commercial bank came to me with the purpose to recover information from a faulty storage disc. Not so long before, during a friendly talk such a question appeared: "Are there data recovery experts of high level in banks, for a example? Or, in case of a problem, the bank people address to you too?" I answered something like that, that the bank would hardly address me, for that simple reason, that if there was a necessity to recover lost information in the establishment of such level, it is necessary to execute all administrators together with members of their families before searching a recovery expert. In case of the information critical importance it is necessary to organize multilevel back-up.

But I was wrong. I just forgot that there were not only database servers, but also usual user computers in the bank. In particular, there was a computer in the advertising department, in which all advertising materials, printer layouts, booklets designs, outdoor advertising materials, and so on and so forth, were stored. Well a hard disc of such a computer failed.

The disk, I should say was a rare one. During all my repair practice I held such a disc in my hands only once. And many of my conversants, dealing with computer sales had never seen it with their own eyes. Maxtor Diamond Max 8S - SATA is a "brother" of a widely known in due time slim Maxtor N40P. In spite of some kind of relationship with the Maxtor IDE, they differ significantly in internal structure (the organization of the microprogram). The mechanism of storage technological start microprogram loading in the RAM of printed circuit board differs a lot.

HDD view from the printed circuit board side

HDD view from the printed circuit board side

At power the engine was accelerated and the actuator monotonously knocked against the stop. The problem reason was a small scratch located in the service zone area of the storage disc. As usual, the scratch put a reading/recording head mr-element out of order. Accordingly, for data recovery from such a disk, at least one donor disk is needed. Fortunately, in the bank many user computers were completed with similar disks, and under my request the customer provided the necessary donor disc.

Features of this HDD model design turn a change of head assembly into a very difficult task connected with a necessity of the subsequent plate centering restoration. After installing a serviceable MHA into the hermetical unit the store could not display readiness at regular start, and fell through knocking. Most likely the scratch in the service area interfered with reading of service data crucial parts for HDD microprogram complex initialization.

As a rule, in such a case a disc technological start is used to analyse the service area, but I did not have enough knowledge for the loader creation. A disk, as I already mentioned, was extremely rare. As the customer wanted to obtain the data as soon as possible, I did not have time for its detailed studying.

So I had to show everyday cunning and sharpness of wits. The matter is that at disks Maxtor, besides the basic service area, have a factory or alternative service area as well. It serves for a disk preparation for the user operating mode at the final stages of factory assembly and testing. The store gave access to the alternative service area. Having loaded with the factory microprogram, one cannot read files and folders as usual. The problem is that an usual ATA 20h reading command could not work with the disk, so other ways were needed. At the given stage unique tables of defects making the logic translation table were not generated at the store and that created additional difficulty at reading.

But I was lucky to find the opportunity of reading some modules concerning the basic service area. The big help in this question was a printed circuit board of IDE disc. In spite of the fact that loading through safe-mode with the IDE printed circuit board did not give a high-grade SA access, many places, from the disc point of view, being accessible, in practice were not formatted, so there was a way to read necessary data. In my case the factory defects table ("p-list") and the zone distribution module were crucial. Having these two modules I could model a virtual translator which strongly simplified reading the user data. I used that possibility and was a success. Without the logic translator the 0-th LBA sector was read as the 0-th sector of the first store zone, the module heading "rctf" instead of the parts table.

Certainly, if after all manipulations you simply opened a disk in the Windows you would not manage to read any data. To read the data a special algorithm was needed with a sector copying on the serviceable disk with the purpose of subsequent logic analysis. Reading of a disk was unstable, but I received access to MFT structures without great problems. And then it was just my patience and time that helped to be a success.

Write a comment