Some of the most common drives we recover data from are the Western Digital 2.5 inch portable drives in sizes 500GB, 750GB and 1TB. It’s not because they aren’t reliable, it’s because they are portable and people have a tendency to drop them from high places onto hard surfaces. In most cases the drives are not powered on and the heads get mangled. Because the drives are not powered on, the heads typically get stuck in the ramp area, off of the platters. This is good because the damaged heads could cause severe damage if they could get to the platters. This could cause some, if not all, data to be unrecoverable.
Today’s case study is about a laptop hard drive model WD10JPVX-75JC3T0. They are almost the same drive except the portable has a USB interface on the PCB. The laptop drive has a standard SATA interface. The big problem we faced with this laptop hard drive was that it was on and in use when the laptop fell.
I expected to find some platter damage from the drop but you never know how much extra damage has been done when the client tries to restart their device after dropping it. Unfortunately this happens in almost every dropped case. The customer crosses their fingers and hopes the device still works.
The first step was to open the drive in the laminar flow cabinet (Clean-Bench) to see what kind of visible damage there was. On the top platter there was a nice scratch in a 1/16 inch area, it was shaped like a checkmark. It was big enough that you could catch a glimmer of it without a magnifying glass. Right then I knew this was going to be a fun job. I anticipated that it might take more than one set of donor heads to complete but it actually ended up being more complicated than that.
Without going into too much techno-babble detail I will tell you that the service area (SA) was damaged. To simplify, you can just think of the SA as the location that the hard drive operating system and configuration files are located. This area is not accessible to the end user and it is referred to as negative tracks. Typically there is just enough firmware information on the printed circuit board (PCB) to start your hard drive and tell it how to load the firmware from the platters. This information is referred to as modules. There is usually at least 2 copies of the modules and in this case both copy 0 and copy 1 had some damage. If important modules are damaged or unreadable then the drive fails to initialize and you have limited or no access to data.
After repairing most of the modules for copy 0 I still had some issues that prevented me from starting the actual data recovery process. I was seeing some errors like Disk_Servo_Actuator_AI_Bad_Wedge error and eventually DISK_SERVO_WRT_FLT_OFFTRACK_ERROR when working with copy 1 of the firmware modules.
After sleeping on it for another night I decided this had to be a head issue. Maybe while repairing the necessary modules the donor heads were damaged. Sure enough, one more set of heads and 99% personal data recovery.
Unlike dropped drives that were not powered up and have no platter damage, I went straight for file/folder recovery. If I had tried to image this drive the heads could have been damaged before I even got past the Windows Operating System files. The best thing was to go straight for the personal data and make the customer happy.