Some of the most common drives we recover data from are the Western Digital 2.5 inch portable drives in sizes 500GB, 750GB and 1TB. It’s not because they aren’t reliable, it’s because they are portable and people have a tendency to drop them from high places onto hard surfaces. In some cases the drives are not powered on and the heads get mangled. Because the drives are not powered on, the heads typically get stuck in the ramp area, off of the platters. This is good because the damaged heads could cause severe damage if they could get to the platters. This could cause some, if not all, data to be unrecoverable.
Today’s case study is about a laptop hard drive model WD10JPVX-75JC3T0. They are almost the same drive except the portable has a USB interface on the PCB. The laptop drive has a standard SATA interface. The big problem we faced with this laptop hard drive was that it was on and in use when the laptop fell.
I expected to find some platter damage from the drop but you never know how much extra damage has been done when the client tries to restart their device after dropping it. Unfortunately this happens in almost every dropped case. The customer crosses their fingers and hopes the device still works.
The first step was to open the drive in the laminar flow cabinet (Clean-Bench) to see what kind of visible damage there was. On the top platter there was a nice scratch in a 1/16 inch area, it was shaped like a checkmark. It was big enough that you could catch a glimmer of it without a magnifying glass. Right then I knew this was going to be a fun job. I anticipated that it might take more than one set of donor heads to complete but it actually ended up being more complicated than that.
Without going into too much techno-babble detail I will tell you that the service area (SA) was damaged. To simplify, you can just think of the SA as the location that the hard drive operating system and configuration files are located. This area is not accessible to the end user and it is referred to as negative tracks. Typically there is just enough firmware information on the printed circuit board (PCB) to start your hard drive and tell it how to load the firmware from the platters. This information is referred to as modules. There is usually at least 2 copies of the modules and in this case both copy 0 and copy 1 had some damage. If important modules are damaged or unreadable then the drive fails to initialize and you have limited or no access to data. After repairing the necessary modules we achieved 99% personal data recovery.
Unlike dropped drives that were not powered up and have no platter damage, I went straight for file/folder recovery. If I had tried to image this drive the heads could have been damaged before any user data was recovered. The best thing was to go straight for the personal data and make the customer happy.