Read Write Heads Caught in Orange Keeper or Park Area

The park area is allocated for the read write heads of a hard drive to remain stationary in transit, in the off or sleep position so the heads do not make physical contact with the platter or media surface

In many cases due to slight warping of the platters rotation,  the armatures read write heads flying height above the platters surface will slightly increase or decreases in size…  resulting in an incorrect alignment when being brought back to the park position.

The Result

FIG 1:  The read write heads have bent after being forced off the platters with the wrong alignment

FIG 2: Upon restarting the bent read write heads now scrape the surface of the platter causing data loss

FIG 3:  You can see now see how badly the heads have been damaged when removed

FIG 4:  This shows the worn condition of the orange keeper from when the read write heads jammed

Every now and then the heads will impact on the platters and cause scratching. This is as bad as it gets as the scratches are eliminating ones and zeros. In the photo below, the scoring of the platters is on the very edge of the media. This cuses severe damage to the heads which have to travel over the edge of the platter at every read and write. Even if we replace the heads, the new ones will soon become damaged as well.

Hard Drive data Recovery Options

To learn more about your options when facing a clicking or grinding hard drive. Call us at 727-354-9665 or visit our hard drive data recovery page.

This won’t be an online advertisement for us, but a way for users who need our products and services to stay on top of the updates and feature changes to our line of data recovery software and freeware.

Hard Drives Are Magnetic Media

OK, so what does “magnetic media” mean? If you look at the graphic below it shows the different parts of a hard drive. The platters actually hold your data. They also hold a magnetic charge. The heads float over the platters on a buffer of air created by the spinning on the platters. The heads should never contact the platters since that will damage both the heads themselves as well as the data on the platters. Like the Earth, hard drive platters have a north and south pole. The relationship of where bits are stored according to the poles, determines if the bit contains a negative or positive charge. Each charge plus or minus reflects either a 1 or a 0, which can be translated into data.

Hard Drive Parts Laid Out

The motor spins up the drives to a certain RPM such as 7200, which is the most common rotaion per minute on modern hard drives. Once the platters are spinning at enough velocity to create the proper buffer of air, the heads will unlock and start to access the information on the hard drive. Information like the size of the drive can be sent to the BIOS and the computer can boot up.

Here is an up close look at the heads and actuator arm:

Question:

I have a 1TB Western Digital My book Hard drive. When I plug it in to either the USB or FireWire ports the computer detects and the instillation wizard pops up.
I follow the wizard steps and it says “successfully installed” but I cannot find my hard drive.
-My USB drives all work and I have other hard drives on the computer
-It says “you may safely remove hardware” in the task bar
-I’ve tried it on a different computer and had the same result

Answer:

So this gets a little tricky because just because “My Computer” isn’t seeing the drive it does not mean the computer is not seeing the drive. You would need to go to disk management and then see if it is reporting as a mass storage device in the machine. If it is then it is likely that the drives problem is a MBR (master boot record/partition record) problem that can easily be fixed with something like a remote recovery. The other option is to run data recovery software on it and you should be able to tree the hard drive, move the files off, repartition/reformat, and move the data back. If it is not being seen in disk management then it is likely a communication problem with the USB enclosure (box holding the hard drive) and the computer. Usually popping the enclosure open and then slaving it or putting it in a new enclosure fixes that problem.

Question:

I bought a Western Digital My Book Essential Edition 1TB External Hard Drive in July ‘09. I moved ALL my music, photos and personal files onto this hard drive. My CD-ROM drives quit working right before I got this….so I had not gotten around to “backing them up” on discs. STUPID-I KNOW!!!!
2 weeks ago it just quit working. I used it in the morning and in the afternoon, it wouldn’t work. It appears that it isn’t getting any (sufficient) power. It does not show up as an available drive when it’s plugged in.
Is there ANY POSSIBLE way for me to get my files off of this thing? I plan on sending it in to get it warranted-but I want to recover my files first.

Answer:

Ok, so like the above user he eludes to the face that it just isn’t showing up. it really could be all of the above fixes. My guess would be that if he wanted to get permission from Western Digital to pop open the enclosure he would be able to rule out the insufficient power problem. My guess would again be that the chassis has gone bad since this a very common problem. I always say that a My Book is a good product but only if you are going to plug it in just to back up and then leave it off most times. If you want an external device you can run all the time the best course of action would be to buy a high end USB enclosure and a hard drive in the size you want and build your own. This will give you the option to install fans in it as well as be sure it has good power to the hard drive. Heat is one of the major causes of hard drive recovery.

For 1 month only, DTI Data Recovery is opening this course up to the public. We are offering only 4 online data recovery courses in 2009. Each course will include our full version data recovery software we sell, but also tools that only our engineers use. You will be able to recover everything from lost emails to deleted pictures, data lost from partition corruption and viruses as well as the following:

• Calculating and fixing a partition record for single and multipe partitions
• Restoring a deleted file by hand in FAT32
• Restoring a deleted file by hand in NTFS
• Determining the drive order of a RAID 5
• Restoring a file system using the backup OS Boot Records (NTFS and FAT32)
• Rebuilding a EXTFS2/3 file system using the super block
• Mounting the XFS file system from a NAS device in Linux
• Recovering JPEG files using a file harvesting technique
• Recovering MP3 files using a file harvesting technique
• Recovering a PST file using file harvesting, unused cluster map and scanpst
• Restoring the MFT from the backup
• Reading the block map for an EXTFS2/3 file system.
• Determining Block size of a RAID 5
• Determining RAID data set for a Simpletech NAS device
• Novell NWFS file system
• Microsoft Access Database file format and recovery
• How to configure a Knoppix disk
• How to configure a Bart PE disk
• Recovering data from a DBX file
• Swapping USB Enclosures

The course is discounted from its original price of $2500.00 to $995.00 and will not be held again this year.

Reserve your class now, before it is too late, only 10 members per class!
Call 866-418-3843 or fill out Online Data Recovery Training Sign Up Form

Learn more about online data recovery training here.

Chkdsk.  Say it loud and say it proud.  Chkdsk.  Kind of rolls off the tongue when you say it doesn’t it? One more time.  Chkdsk.  So there is no misunderstanding, chkdsk works EXACTLY AS ADVERTISED.  Chkdsk is not designed to do DATA RECOVERY! Chkdsk is designed to align a file system so that the Windows operating system can read it.  However, in doing so an end user can lose their entire file system.

Chkdsk will run when a volume is considered dirty.  Dirty can be defined as file size not matching the cluster map.  Cross linked files. An INDX record not having a matching MFT record.  Any file not having a parent folder (Orphaned).  The cluster map for the entire volume not matching what is actually allocated. Bad sectors within a cluster.  With that being said seeing this message “The file or directory filename is corrupt and unreadable. Please run the Chkdsk utility.” means that you probably have at least one of the situations I have mentioned.

As an aside, there are other methods for checking the file system to see if it is dirty before chkdsk is run. FSUTIL and CHKNTFS are two other command line utilities that can manage the file system without the use of chkdsk.   Some of the command line parameters for FSUTIL and CHKNTFS will be discussed in other articles.

With all this being said it was pre-ordained that the RAID with a stale drive would be flagged as dirty and therefore a chkdsk would be scheduled.  Since chkdsk is defaulted to run automatically it ran on this RAID and caused a great deal of damage.  Although many of the files were recovered, the PST file had been reset in such a way as the file system handler would not read the file.

Next time I will discuss what chkdsk did, how it affected the PST file, and in doing so saved the data.

Until next time…

1. Software Failure – this can be caused by viruses or file corruption even user error. We consider it a logical problem, in other words there is not a physical problem with the hard drive. Boot files not working, partitions not showing up, or Windows asking to format a drive are all symptoms of a logical hard drive problem. The rule of thumb here is if your BIOS or your operating system can see the drive, but you can’t access the data, then you have a logical or software problem.
2. Physical Failure – the worst case scenario when it comes to hard drive recovery is a physically damaged disk. Common symptoms include noises like clicking or scraping slowness for reading or writing and then absolute failure. In the good old days there were sometimes easy fixes to physically damaged hard drives, but that isn’t the case with these large capacity hard drives. Some of the major problems we run into are due to excessive heat causing platters to swell and contract as the hard drive heats up and cools down when not in use. If your hard drive is not seen by the BIOS then you need hard drive recovery.

Hard Drive Recovery Solutions

Understanding what type of problem you have with your harddisk is the first step in hard drive recovery. In most cases logical or software problems can be resolved either remotely, or with data recovery software. DTI Data Recovery has quite a bit of programs that can help home users and professionals alike. We have full version freeware data recovery software as well as a score of programs for more advanced problems. Our data recovery software page lists all the software and what it does. Feel free to call us at anytime 727-345-9665 or toll free 866-418-3843 if you have questions about which type of software you need. That is also the number to call if you want our fast remote data recovery services Recover It Now.

For all other data loss scenarios the best thing to do is to speak with one of qualified data recovery technicians about hard drive recovery. Feel free to call us at anytime 727-345-9665 or toll free 866-418-3843 with questions about our hard drive recovery services.

With all this being said this kind of design can easily lead to the file system being corrupted.  In other words  if a sector goes bad, or gets overwritten, or the data becomes corrupt, the entire file system may become unusable. As an example, the FAT file system uses a centrally located File Allocation Table which maps every cluster on the hard drive to its appropriate file.  With NTFS there is a Master File Table that is also centrally located that is even more susceptible to corruption and destruction.

In addition there are file system components such as an OS boot record that if corrupted or destroyed will give you the message “File System Not Found. Do you wish to format?”  The Master Boot Record, INDX Records, File Entry Records etc. etc. These components when destroyed or corrupted will cripple your file system and ultimately make hard drive recovery impossible.

With that in mind there are two options that I have added to the NTFS flavor of the View It Now series of software to help view the file system even when some of the components are corrupt or missing completely.  They are as follows.

Under the heading Volume Tools the option NTFS FS Functions is viewed under the drop down menu.  Mousing over that function the following is revealed.

Build Virtual Volume

Clicking on the above function will display a dialog box that reveals three values for you to enter.

1. Sectors Per Cluster:  Valid values for this field are 1, 2, 4, 8, 16, 32, 64, and 128.

2. Total Sectors:  Valid value is from 1 to the total size of the river.

3. Volume Offset: Valid Value is from 0 to total sectors of the river.

Once you have entered the appropriate values for your partition just click on mount and the Volume will be displayed in the lower left hand list box of the main dialog box.  This volume is now usuable for the following function.

Last Resort File System Build

This particular function does not depend on much of the file system being intact in order to tree the river.  This fucntion takes a defined volume and scans it searching for valid MFT records.  Once an MFT record has passed my filtering process it is added to a list of other records found. When the scan has finished or been interrupted by the end user a tree is formed and displayed just like any other river.  This will then give you the chance to view the file names and see if in fact your file is there.

In addition, after the scan is completed and the records treed you can Export File List To Text File.  That file can then be imported into a spread sheet to do searches and sorts on all the fields.

Download View It Now NTFS File System Viewer

If the hard drive is clicking or not seen by the BIOS, you will need hard drive recovery.

In the case of the MY BOOK I recommend that the customer open up the chassis that is holding the hard drive and pull the drive out of it. Now I am going to preface this with saying it is highly likely this will void your warranty with WD, but it can allow you to gain access to your data. Once you open the chassis you and have the hard drive out you can then either put it in another chassis or slave it directly into the machine. Either option will give you the answer you are looking for, which is , is the drive bad or was it just the chassis. In A LOT of cases it is just the chassis. When we buy one of these devices we are paying for the hard drive and not a lot of extra cash goes into the making of the chassis.

Now in the case of the Passport, these are laptop drives inside of little chassis so you will either need special cables to convert down the size of everything in your desktop machine or to buy a chassis that supports laptop drives. These chassis can be picked up for very reasonable pricing at Wal-Mart, Best Buy, CompUSA, Etc. Again opening the Passport will leave you not having a warranty on the device any longer. If your Western Digital external disk is making noises you my need hard drive recovery.

Expanding or compressing platters is not a good idea since the heads are programmed to search for the first sector of a hard drive in a particular place. The larger the capacity of the hard drive, the smaller that sector is physically. While it is true that older drives that were prone to get locked up due to heat, could benefit by being cooled down, that is just not the case with hard drives that have been manufactured in the last 5 to 6 years.

Speaking of older hard drives, that brings us to the second most popular myth about hard drive recovery which states that you can easily swap a damaged circuit board from 1 hard drive of the same model to another of the same model. Again that might have been true of Quantum hard drives 10 years ago, but don’t try it now! A good example of why that doesn’t work is just about any popular Western Digital hard drive. You can take any mass produced model number and search for revisions. You will find that the average WD hard drive model has at least 6 or 7 revisions. Each revision speaks a different language! OK maybe language is too strong a word, but dialect isn’t. They just don’t understand each other when you put a board that has one version of firmware on it and have that try to communicate with a head assembly that has another firmware imprinted on its chip sets. Companies that perform hard drive recovery these days must be able to heat boards and work on chips if they are going to have any hope of repairing electronic problems.

The final myth we are going to look at today I like to call hammer logic. One time long ago I was an electrical contractor and my answer to a lot of problems involved a hammer or using my Kliens as a hammer. Older hard drives used to get locked up and have issues with their bearings. A light tap with a baltine hammer could in some cases unlock the bearings and possible get the motor to spin properly and at the right speed. A hard drive’s motor is intrinsic to the system that makes a magnetic media device like a hard drive work at all.

Hard drives spin at a specific RPM which insures that the heads float just barely above the platters so that they can read the sectors according to the predefined sector map and either read or write your data. Either way, the motor must spin at the right RPM or very bad things will happen. We have been able to resolve quite a few issues when it comes to hard drive recovery involving bad bearings, and one of them involve a hammer. In modern hard drives, any deviation of a micro-millimeter can cause the sectors to move and then be unreadable by the heads. This is even more true in large capacity hard drives that employ perpendicular recording, a sector mapping system that upends the sector at a 90 degree angle making the readable surface of a sector microscopic in size. Hitting these sensitive devices with a hammer is a bad idea.

If your hard drive is making clicking noises, whining or has just plain died, the best thing to do is contact a real hard drive recovery company like us!

To schedule a remote data recovery using Recover It Now call Toll Free 1-866-438-6932 ext. 236 or direct 1-727-345-9665 ext. 236.

Data Recovery For Corporations Computer Repair Stores and Network Maintenance Companies

DTI Data has an aggressive partner program that just about any company large or small can take advantage of. We are extending our partner program discounts to Recover It Now services. Call 866-418-3843 to find out how you can add data recovery services to your company’s line item or add a trained data recovery engineer to your IT staff instantly!

Model numbers of Seagate Barracuda hard drives that have firmware problems (note the bolded 3):
 
1000 GB
ST31000340AS hard drive recovery
 
750 GB
ST3750330AS hard drive recovery
 
500 GB
ST3500320AS hard drive recovery

Challenges Hard Drive Manufacturers Face

Seagate is just the latest victim in the war going on between storage companies. Between lower prices than ever for storage and consumers growing needs for capacity, these hard drive companies are finding it harder than ever to put out a stable product for a reasonable price.

These emerging technologies are still happening now with the advent of high capacity solid state storage, digital data storage without moving parts is the future of backup, the question is: when will the price per MB of flash media and solid state storage change to price per GB?  As far as traditional storage with moving parts i.e. hard disk drives, there has been an explosion of emerging technologies there as well. The release of perpendicular recording was just the first step in the process that has led us to affordable high capacity drives like Seagate’s Barracuda 7200.11.

What To Do If Your Seagate Barracuda 7200.11 Needs Hard Drive Recovery

If you own a Seagate Barracuda 7200.11 500 GB or 1 TB hard drive, what should you do? The first thing is to get a comparable capacity external hard drive and transfer all your data to it ASAP. By using a FireWire or USB external hard drive, you can add storage without restarting your computer. If you are not sure what type of hard drive or what model hard drive you have, there are ways for you to check that out without restarting your computer or looking inside of it.

Step 1 – Right Click On My Computer and choose MANAGE

Step 2 – Choose DEVICE MANAGER in the left window

Step 3 – Expand DISK DRIVES in right window

You should see the hard drive model number in this screen, if you don’t, highlight each drive individually and choose properties to see details on your hard drives.

Step 4 – Choose hard drive in question, right click, and choose properties (if necessary)

If your Seagate Barracuda 7200.11 has failed and you need Seagate harddrive data recovery call us at 727-345-9665 or visit our page: Hard Drive Recovery.

A clicking hard drive is making that noise for one of two reasons:

1. Damaged Heads and/or Platters – if the heads get damaged then they can no longer read the platters and will go into a seek pattern. This will cause a clicking noise as the arms go back and forth. This can also happen when the hard drive has been exposed to excessive heat. If the platters swell then the heads can no longer find sector 0 and again go into a seek pattern. If this is the case, the only recourse is to open the disk and replace the heads. This is hard drive recovery.
2. Loss of communication between electronics and internal ROM chip – there are a lot of electronics and chips on both the outside PCB board as well as internally. These electronics communicate with each other in a language called microcode. Each hard drive manufacturer has their own encrypted version of microcode. Hard drive recovery companies like DTI Data, need to not only be able to repair hard drives, but repair chipsets and unlock encrypted microcode. We have databases full of different hard drive microcode and service area byte maps. When any of the chips fail to properly communicate to the heads, they send the armature into a seek mode, similar to what happens when heads fail. This is the most common misconception in the hard drive recovery industry. 6 out of 10 hard drives that come in for recovery that have been opened by other companies, need never have been taken apart at all. they hear clicking noises and automatically open the drive and change the heads. There is no way that a cheap data recovery company can afford the research and development costs incurred in the hardware and software needed to perform hard drive recovery on high capacity (over 250 GB) disks that entail microcode problems. Beware of where you send your hard drive, make sure they have a clean room and have had success on large capacity hard disk drives. Western Digital is the only hard drive company that authorizes data recovery companies. Type in “western digital data recovery partners” into Google and their page will come up. You will note that DTI Data is on that list. We are a real data recovery company authorized to open disks and do hard drive recovery on Western Digital drives!

Breaking Down Hard Drive Recovery – A Look at Platters, Heads and Internal Parts

The first graphic below is the internal parts of a hard drive laid out and identified by their common industry names. Just about all hard drive repair involves the parts below as well as some specialty software that can write to a service area and replace bad sectors and access the data on a damaged hard drive.

The Parts Of A Hard Drive

The next image is a close up of the heads and the platters:

Hard Drive Recovery Parts

Hard drive recovery is a serious business be sure that you research the company that you send your damaged hard disk to. Feel free to call DTI at 866-418-3843 or visit our hard drive recovery page. There is also information on hard drive repair clicking.

Windows Blue Screen of Death

If you have turned your PC on and received this message the problem can be solved with the following steps. However, before beginning, it is very important to note that the cause of the problem may be the hard drive itself. As with any type of do it yourself recovery this could cause permanent unrecoverable damage to the hard drive and or the data that exist on the hard drive. Like most hard drive recovery processes, physical disk repair isn’t necessary if the hard drive is seen by the BIOS. If your hard drive is recognized by the BIOS, but you get the blue screen of death these steps will help you restore Windows. Be careful and backup if you can! That said, lets continue.

If you have your hard drive manufacturers diagnostic tools, please read the documentation carefully and test the drive to make sure it is functioning properly. If you do not have the manufacturers diagnostic tools you can go to their respective websites to download them. It is important to read the documentation as these tools may perform data destructive tests and procedures to your hard drive. It is also a good idea to try and recover some of the data by making your boot drive a slave drive under another Windows system for hard drive recovery. Please see our previous post “How to slave a hard drive“. Ok, lets proceed with the restoration and hard drive recovery.

Windows Command Prompt

Time for the XP Recovery Console.

You are going to need to get your XP Installation Disk.

You will also need to make sure you can boot from your XP installation Disk. Insert you installation disk in your cd/dvd drive and make sure you see the option press any key to boot from cd: If so, do so and you’re good to go. If you do not see that option you will need to enter your system setup (BIOS) and change the boot order. When your computer boots you should see press delete, F10 or some key function to enter your systems setup. You will usually find the boot order under advanced settings once you are in the setup console. Simply select boot order and choose CD as your first boot device. You may change the boot order back to the original settings after this exercise in hard drive recovery.

When you boot to your Install CD it will take a minute to load all the drivers, then it will provide two options-Setup or Recovery Console; “press r” for the recovery console. It will than ask you which Windows install you want to repair, most users will only have one so just input 1 and press enter. You should now have entered the recovery console of your Windows XP CD.

What you are about to do is basically a minor System Restore via the Recovery Console. We are going to use an older version of the currently curr The text in red will be what you should type and the black text will what the system outputs. READY, SET, GO.

C:\Windows>CD C:\system~1\_resto~1

C:\system~1\_resto~1\>dir

After you enter the DIR command and hit enter you will get a list of folders like rp1, rp2, rp3, rp4, etc.. The “rp” part of the folder name indicates it’s a Restore Point.

What we want to do is use the 2nd or 3^rdhighest numbered folder in that list. For example, if it listed rp1 through rp53 you’ll want the rp52 folder. We will use rp52 to outline the rest of the procedure.

Now, we will use the following commands..

C:\system~1\_resto~1>cd rp52

C:\system~1\_resto~1\rp52>cd snapshot

C:\system~1\_resto~1\rp52\snapshot>copy _registry_machine_system c:\windows\system32\config\system

Overwrite system [y,n]: y

1 file copied

C:\system~1\_resto~1\rp23\snapshot>exit

Remove the installation disk .

Those are the steps to restore Windows after getting The Blue Screen Of Death. If you need help give us a call at 866-418-3843 or visit hard drive recovery.

I am pointing all this out because when I searched Google for hard drive recovery, I found over 800,000 results and started looking at the companies listed as well as those buying ads. The fact is out of all those results and the 30 ads, only about 20 of them are real data recovery companies, and only 8 are listed on Western Digital’s data recovery partner page.

So why is this a big deal? It doesn’t matter much when looking at data recovery software since all of them, like ours, have demos. Our software will show you that it will recover the data before you buy it. Physical hard drive recovery is a completely different ballgame. If your hard drive is no longer recognized by the BIOS or is making noises like clicking or whining or scraping, then you need hard drive repair services to get your data back. That is why it is important to know who you are sending your drive to.

Freeware Data Recovery Hard Drive Software

DTI also has FREE data recovery software that we fully support. Our free software for hard drive recovery can undelete files, diagnose RAID Parity problems and repair NTFS partitions. You can see all of our FREE data recovery software here. You can also learn more about Freeware data recovery here.

There are some problems that need a powerful hard drive recovery tool. While our FREE NTFS Partition Repair tool can sort out a lot of issues, it can’t resolve problems that involve bad sectors on a damaged hard drive. We do have a solution for recovering data from bad sectors called Recover It All. Not only can it work around bad sectors on NTFS partitions, it will also fully recover FAT 32 partitions! We have gotten a lot of questions about why recovering FAT 32 is so important even though Microsoft doesn’t use it for their operating systems anymore. The answer is just about ALL external hard drives use FAT 32 as their file system because it can be seen by Windows, MAC and Linux. While we do have FREE FAT 32 Undelete tools, they won’t work on damaged FAT 32 Partitions. You need a powerful scanning engine for that and Recover It All has one of the best.

You can get the demo version of Recover It All Here or Buy Recover It All Now. The button below will take you to a secure site to purchase the software. You will receive the full version within seconds. Recover It All is on sale for $49.99, a savings of $50!

The bottom line is that if your hard drive is not recognized in the BIOS, is making noise or is not spinning up, you will need hard drive recovery. If the hard drive is seen by the BIOS, but not by Windows or Windows is asking you to format the hard drive, you need data recovery software. Feel free to ask any question about hard drive recovery in the comments below.

   The file entry record has several components that are used to extract the related stored data.  One of these components is the starting cluster number of where the data might be found.  Logic is then used to with the  File Allocation Table (FAT) map to chain the clusters together.  Lets say for instance that the starting storage cluster for file “foobar” is 1000h.  Lets also say that the size of a cluster is 64k.  Finally, lets assume, for illustration purposes that the file is 640k.  With these facts in hand we can say that foobar will occupy ten clusters. If the file had been saved only once and not edited we can make a pretty educated guess that the file is not fragmented. So the following statement may be true “Foobar is stored in clusters 1000h – 1009h”.
The FAT would look like this

    The top table shows the actual cluster number 1000h -1009h. The bottom table shows the value in each one of the FAT cells. The value in the FAT cell points to the next cluster, which in turn points to the next cluster so on and so forth. Finally the final FAT cell has the value 0FFFh which indicates the end of the cluster chain. This method is called a “one way linked list” as it links the clusters forward only, and not reverse.
    Now, this is a FAT representation of a file that is not fragmented. The following set of tables for the same file, but this time the file is fragmented.

    Now, as you can see from the above table the cluster chain looks basically the same until we get to cell 1004h. Instead of the cell containing the value 1005 which would of course point to the next cell, it has the value 100B. This means to look at cell 100B to see if we are at the end of our chain, or if we in fact continue the chain. In our example we see that the chain does continue until it reaches the end of the linked-list in cell number 100F. This is an example of a fragmented file as it is divided into two fragments. The first fragment is from cell 1000 to 1004, and the second fragment is from cell 100B to cell 100F.
    With all of this being said one can see how important it is to keep the FAT cluster map intact. When a drive is formatted for FAT the entire FAT table is destroyed and zeroed out. In the above fragmented file we can see that with the FAT destroyed there is no way to easily recover the data. The simple logic of a FAT recovery is to get the starting cluster from the File Entry record as well as the file size and then read each cluster contiguously until the file size is satisfied. In other words to recover foobarwe would read cluster 1000h since that is the starting cluster and continue for ten clusters since the size of each cluster is 64k and the file size is 640k. Doing this will lead us to cluster 1009h. Looking at our two examples we can see that in the unfragmented file we would get all of the data, however, in the fragmented file we would only get the first five clusters and the rest would be zeroes or garbage.
    I have made several references to the starting cluster number which is found in the File Entry record and then used with the FAT to get all the data for a particular file. In my next installment I will explain the mechanincs of getting the starting cluster from the File Entry record. Until next time…

Related Articles:

• Part 1 Recovering FAT 32 With File Entry Data
• Part 2 Recovering FAT 32 With File System Markers
• Part 3 FAT32 Recover File Entry Table On-Disk Layout Using a C Structure
• Part 4Using FAT32 File Entry Record For Recovering Folders Using Software Logic
• Freeware Data Recovery
• Hard Drive Recovery
  

  The first two elements of the file entry record are the file name which is eight bytes, and the file extension which is 3 bytes.  For the beginning of every folder the first file entry record has the file name “.          “, that is, a period, followed by ten spaces.  In other words the first eleven bytes of the beginning of a sector that stores the beginning of a folder are static and are always the same.  Now this fact is important in as much as we can look for this particular attribute in a sector and when we find it there is a very good possibility that we are looking at the beginning of a folder.  With the being said it is always better to try and refine a filter in order to make sure that you have in fact found the beginning of a folder.  Oddly enough, the second file entry record had the file name “..         “, that is, TWO periods followed by nine spaces. 

   Each file entry record is a static thirty-two bytes long.  That being said we can now assert this.  If bytes zero through seven of a sector are a period followed by ten spaces and bytes thirty-two through forty-two of the same sector is two periods followed by nine spaces then there is a high probability that we have found the beginning of a folder.

   The pseudo logic for this might look like:

     The chances of a sector slipping by that may not be a folder entry is very slim.  This is good in as much as it can be difficult to define a filter that will give you the most optimal results without flooding you with a set of worthless data.

     In my next installment I will explain what this ‘.’ and ‘..’ mean.  If there are some old DOS command line users out there I am sure you are well aware of what I am talking about.  Until next time…

Related Articles:

• Part 1 Recovering FAT 32 With File Entry Data
• Part 2 Recovering FAT 32 With File System Markers
• Part 3 FAT32 Recover File Entry Table On-Disk Layout Using a C Structure
• Freeware Data Recovery
• Hard Drive Recovery
  

Recover It All is one of the few fully featured data recovery tools that can recover data from damaged or corrupted FAT 32 file systems as well as NTFS. If your external hard drive is giving you trouble, Recover It All can fix those problems. The demo version will show you your data before you buy it. See all of the features here.

Buy Recover It All Now!

The first place to start figuring out if your hard drive has a physical problem is in the BIOS. When you boot the computer it shows you the storage devices in order of where they are in the boot chain, as well as if they are master or slave devices. If you have multiple hard drives inside your computer, they will be either set up as master slave or as a RAID. It is important for you to know which drive is doing what for you to understand what you are seeing in the BIOS. If your computer starts up and it shows you your hard drive (s) then your problem is more than likely a logical problem. If your hard drive is not recognized by the BIOS, you will need hard drive recovery services. Call 727-251-2058 for immediate information about hard drive recovery prices. DTI Data offers free quotes on hard drive recovery, and only charges you if we recover your data.

Logical Hard Drive Recovery Prices

If your hard drive is recognized by the BIOS and boots into Windows, but is not working properly you have a logical problem. A lot depends on if you have one or two hard drives in your system, so we will proceed with what you should do if you have a one drive system that boots, but never loads Windows. Before I go on, there is always the possibility that Windows won’t load and you have physical damage to your hard drive. Newer computers can hold a lot of memory in their cache and can get you to the Windows screen, when in fact they are not able to access your hard drive properly. If that is your issue, visit the How To Slave A Hard Drive article which will show you how to remove your hard drive and load it into another computer, or into your existing machine that you have put a new hard drive into. this is the first step in hard drive recovery that doesn’t involve a deleted file. If all that happened is you accidentally deleted a file, then you can use an undelete utility to recover your data.

If your hard drive is making noises like clicking or grinding, but is still accessible you have very little time to copy off your critical files while you still can. there is a link in the paragraph above that will show you how to slave a hard drive, you can use that method to copy off your data to a good hard drive.

We offer remote hard drive recovery which allows our techs to log into your computer and solve your problems. Either way, whether you send the disk in, or we recover it remotely, DTI can handle you hard drive recovery needs.

Since a small program will be offered at the end of this sequence of articles the on-disk explanation will use ‘C’ notation and a defined record data type using structures. The following is the structure I use in my software to denote a file entry record.

#pragma pack(1)
typedef struct
{
UCHAR FE_Name[8];
UCHAR FE_Extension[3];
UCHAR FE_Attribute;
UCHAR FE_NTReserved;
UCHAR FE_TimeCreatedTenth;
USHORT FE_TimeCreated;
USHORT FE_DateCreated;
USHORT FE_DateLastAccess;
USHORT FE_StartClusterHI;
USHORT FE_TimeLastWrite;
USHORT FE_DateLastWrite;
USHORT FE_StartClusterLO;
UINT FE_FileSize;
}FILE_ENTRY, *PFILE_ENTRY;
#define SZ_FILE_ENTRY sizeof(FILE_ENTRY)
#define FILE_ENTRY_NULL (PFILE_ENTRY)0

This file entry record format has been in use since the inception of DOS FAT File System. There may have been some fields that were at one time referred to as reserved but the size and basic design of the record has always remained the same. The following is a description of the fields used to recover the original folder heierarchy.

1. FE_Name[8] — This is from the old 8.3 notation and the first eight characters of the file name. In later articles I will cover the long file name logic and how we can use that to enhance our search routines. It is important to note that if the file name is less than eight characters the rest of the name is space filled (0×20)

2. FE_Extension — The second part of the 8.3 notation that has the same rule set as the FE_Name field. When displayed the data in this field is after the period ‘,’.

3. FE_StartClusterHI — Stored here is the binary high short value of the starting cluster of the file, and or folder.

4. FE_StartClusterLO — Stored here is the binary low short value of the starting cluster of the file, and or folder

5. FE_FileSize — Lastly the file size. If this file entry record defines a folder then this value is zero (0×00). In addition you can see that the file size is an unsigned int, so the largest file size that can be stored is 4,294,967,295 bytes, or 4GB.

Now the time of file creation and last update are important as well but the five fields that I have outlined are necessary to recover the folders.

In my next installment I will outline the attributes of the file entry record that can define a folder entry.

Related Articles:

• Part 1 Recovering FAT 32 With File Entry Data
• Part 2 Recovering FAT 32 With File System Markers
• Freeware Data Recovery
• Hard Drive Recovery
  

In the FAT file system the index records for each file and folder are not stored in one static area. As an example of an alternate technique, if you were to format a drive using Windows XP then, of course, the default file system would be NTFS. One of the characteristics of NTFS is that it uses a Master File Table to store all the information about each file and folder. The MFT is stored almost exclusively in the same place every time a drive is formatted. Normally the MFT will start at cluster 786432 (LBA 6291456 assuming a 4K cluster) and will extend contiguously for several thousand records. In other words, the entire index for your file system is stored in an area approximately 150MB to 200MB in size. If this area were zeroed out it would destroy all of the information as to where your files are stored and in most cases hamstring the end-users ability to recover their data, especially if the data is fragmented. One may think that 200 MB of data is a lot of data to zero out, but I can assure you with Windows XP optimized for disk I/O and hard drives using a blazing fast DMA the destruction of the MFT would almost be transparent. You would never know it happened until it was too late.

That being said, conversely the FAT file system stores their folder and file information in clusters using a file entry record. As the file system matures the clusters that are used move farther down the drive since data is now occupying the clusters closer to the beginning of the drive. The FAT chaining system is used for folders that have more files than can be stored in a single cluster. It is easy to see that the folder information can be scattered across the drive. Although this plays havoc with hard drives and access speeds it makes it difficult to destroy the file system. This cluster scattering was not by design and to this day is considered a drawback to the file system, however, it does make data recovery much easier when major file system components are lost.

So now that we know that file entry records are used to index the file system for FAT the problem arises as to how best to identify a file entry record from the billions of other bytes on the hard drive. In my next installment I will outline a file entry record and reveal the attributes that allow us to filter a folder storing file names from all of the other data.

Related Resources:

Recovering FAT 32 with File Entry Records – the first part of this series.

External Hard Drive Recovery

Hard Drive Recovery

In theory, this sounds like a great marketing idea having the ability to sell external USB and Fire Wire hard drives to three different operating systems. In theory. In practice, it presents some unique problems. As an example; a real life example, I have in my posession a Western Digital My Book that was formatted originally as a FAT32. However, this particular My Book was used for video editing and storage for a documentary on a Mac. For whatever reason this particular client decided to format the drive. In speaking with the client, this was not the intention. That being said, the drive was formatted using an EFI format that destroyed huge chunks of the FAT as well as destroying the OS Boot record, and the back-up OS Boot Record. In addition, the Master Boot Record had odd data for the partition starting points, and file system type on the external hard drive.

Now, with the MBR in the wind, both the OS boot records destroyed, and the beginning markers of both FATS gone, has does one reconstruct the original configuration of the FAT32 file system? In the next installment I will illustrate how Microsoft leaves little remnants of the file system all across the drive, and how these remnants can be used to recover the file system.

Related Resources:

hard drive recovery

external usb firewire hard drive data recovery

As you can see my external hard drive has no partition and because of this I will need to enter all of the numbers that go in the fields. Each line is equivalent to a different partition on the hard drive. For this How To I am only worried about single partition hard drives.

When I do a remote data recovery of a partition I would have WinHex available in order to have the ability to look at multiple facets of the file system. Once in WinHex with the target hard drive open I will then go to sector 0, where the Master Boot Record (MBR) resides.

This is a view of the MBR on my hard drive that has no partition record, and therefore no access to the data on that drive.

I will then go up to view and then choose the template manager. In here I will chose Master Boot Record template and apply it.

As you can see there is no information in the partition. Everything is zeroed out. This can be seen a lot with viruses and also with accidentally deleting the partition from the hard drive in the Windows Installer program.

From here I will go up to position and then go to sector. I will input sector 63 and I am now at the NTFS Boot Sector.

Here you can see the NTFS file system and this will help you to know you are in the proper place. I can now go back up to View and then to the Template Manage and apply the Boot Sector NTFS template to this sector.

Now that I have the template open I can look to see what the total sectors of the hard drive are. Now generally speaking for most single partition NTFS hard drives whatever you see in the total sectors in the template plus 1 is what the total sectors of the hard drive are.

With my hard drive, the total sectors are 39086081 add 1 to that and we have 39086082. Now I need to go back to sector 0 and open the MBR template again.

Now that I know what the total sectors are, the other settings are easy enough and pretty standard. They should be as follows. The active partition field is 80 and will l mark the partition as “active”. The next field is the Start Head which should equal one (1). Next we have Start Sector which is also one (1). The starting Cylinder will be left at 0. Partition Type for NTFS is 07. End head is 254 End Sector is 63 and end Cylinder is 1023. The sectors Preceding the Partition is 63. All of these fields are in most cases always the same. Sectors in Partition is equal to the total sectors as reflected in the boot sector plus 1, so for this hard drive it will be the number from above we already figured out, 39086082.

Now we want to close this window and click yes when it asks if we would like to write the MBR. Then we want to close WinHex. It is going to give us a warning about writing to the drive. I would have to say here that if you are not SURE these are the proper settings for your drive, it is not a good idea to be writing them down. You can cause damage to data, and also make it harder for a hard drive recovery technician to fix it later.

Also if you used WinHex to look at the total sectors of the drive and would like to use the Free Partition Recovery Tool to put the partition down to the drive you can do that also. It very simple as the fields from WinHex and from the partition recovery tool coincide with each other. WinHex has a demo view version you can use to find the total sectors and then you can use the free partition tool to write the information down to the drive without having to spend any cash. You should be able to reboot the machine now and have full access to your data. As always if you have any questions please feel free to give me a call. 727-345-9665 and ask for software support. You may also ask questions by leaving a comment below. We try to answer all questions within 24 hours. By asking question in the comments on this page we will be able to help other users that have similar questions.

For more information visit these pages:
Freeware Data Recovery

I did some research and found a really great way to be able to come into the customers computer remotely through a Internet browser with out having to worry about dealing with their routers and firewalls. It is called Log Me In Rescue. I send the customer a link to their email and then they run this little API that hooks up with my computer. I can then take control of the desktop and attempt to do the recovery.

I inevitably need WinHex Sector Editor to view the disk in its raw format, I can easily upload the software to the customers computer and then use it in order to fix the drive. It is nice because the customer can see everything that I am doing so the worries about someone rummaging through their data are gone. This is by far the coolest form of hard drive recovery.

The coolest part about this kind of hard drive recovery is that in most instances I am putting the drive back the way it was before the problem occurred. I can also do adjustments to the system area of the drive to allow drives that data recovery software is not reading correctly to be able to read correctly.

We offer this service for a hugely discounted rate because we don’t have the over head attached to it that we would if you were to ship us the drive. I also use the utility to come in to a hard drive and diagnose problems for no cost to the customer if I don’t actually fix the drive, but that is still hard drive recovery.

If you want more info about our new remote hard drive recovery service: Recover It Now visit our fast data recovery page.