An Example of a Data Recovery Procedure for a Western Digital WD2500BEVT Drive

The purpose of this short article is give an overview of a typical data recovery job.

In this instance the drive was a Western Digital WD2500BEVT (250GB, 2.5″ S-ATA drive) made in September 2010 removed from a Hitachi external enclosure. The client was in Edinburgh and had reported simply that the drive could not be accessed.

On receipt in the lab the Western Digital drive was removed from the Hitachi external enclosure and inspected. It was found that there were no signs of damage to the outer chassis and the printed circuit board (PCB) check showed that there were no components that appeared to be stressed or burnt.

The next step was to clone the drive but it was found that the drive would not spin-up (although a rhythmic pulse repeated every second or so suggested that the drive was trying to spin). This typically means that either the platter motor is seized or the read / write heads have become stuck to the data platter surfaces. In usual operational conditions the heads will never make direct physical contact with the data area of the platters (they float on cushion of air a tiny, but vital, distance above the platter surface). Sometimes, often during an unexpected shut-down of the drive, the heads fail to reach their correct park position and instead end up stuck (literally) to the platter surfaces. The friction alone is sufficient to prevent the drive from spinning-up when power is subsequently applied.

To determine the cause of the failure to spin-up the drive was opened in our clean room environment, it was discovered that the problem was indeed that the heads were stuck to the platters. The heads were very carefully removed from the platters (this is a procedure that requires at least 3 pairs of hand, careful co-ordination of actions and steel nerves), if great care is not exercised it is very easy to rip-off one or more of the delicate heads from the end of the head arm. This is of course one of the many skills that you as the client are entitled to expect of any data recovery expert.

The visible platter surface (i.e. The uppermost one) and the heads themselves were examined for any signs of damage (where this is the case then almost always it will be necessary to replace the read /write heads with a new set from a closely matching donor drive). In this instance there were no signs of any such damage, it is largely a matter of luck as to how hard the heads crashed into the platters when they originally failed to park correctly.

Subsequently it was possible to clone the drive in its entirety. The clone was then scanned to identify the user data which was subsequently extracted.

After this had been done the data verification stage was carried out. Sadly, just because a file has been pulled from a drive does not necessarily mean that it has been recovered intact and so it is necessary to sample extensively the data to be certain that the files are good. Sample screen shots of the recovered files (i.e. Contact sheets for photographs and first page preview thumbnails for documents) were generated and forwarded to the client along with a complete file list of all recovered data. This file verification is a vital (but often ignored) part of the data retrieval process.

The client subsequently paid and sent in his own hard drive for the recovered data to be copied to. We got his entire recovery back to him within 48 hours of receiving the original defective drive in our labs. We know that this particular client felt that he had made the right decision when he decided to opt for professional data recovery experts.