The purpose of this brief article is to give an overview of the procedures involved in a typical Western Digital data recovery case.

In this instance the defective drive was a Western Digital WD1600JS drive (160GB, 3.5″ S-ATA drive) made in January 2006. The client was in London and reported that there was no access to the drive and that it was clicking. All in all a fairly standard hdd recovery for us (http://tierradatarecovery.co.uk).

When the drive arrived in the lab the initial inspection showed no signs of damage to the external casing and the printed circuit board (PCB) looked to be in good condition (no evidence of burnt or stressed looking components).

The next step was to attempt to clone the drive. The drive did spin-up and in BIOS identified itself as “WDC ROM Model-Hawke” and with the drive capacity shown as 7GB.

These are classic symptoms of damaged firmware. Firmware is a small amount of code that is stored on the hard drive itself (partly on the data platters inside the drive and partly on the PCB). It is used to get the drive up and running and to present itself to your PC or Mac as a recognised storage volume. Some firmware is specific to the individual hard drive itself as it is built up over the operational lifetime of the drive.

One of the key differentiators between the “cheap and cheerful” data recovery companies and those that take the matter rather more seriously is the investment to acquire the specialist tools needed to work on hard drive firmware and the knowledge and experience to use such tools without endangering the client data.

In this case further investigation showed that the drive firmware had indeed become corrupted, specifically a firmware module referred to as the translator table had been damaged (this is essentially a map to the data area of the drive, without it no access to user data will be possible). The necessary repairs to the firmware were carried out and on subsequent power-up we were able to access the data area of the drive.

At this point the original defect drive was cloned and all subsequent analysis and data extraction work was carried out on that clone.

Once the clone had been completed it was scanned and the user data extracted.

Finally the pulled data was verified. Unfortunately we can’t simply assume that because a file has been pulled it is intact. There is only one way to tell if a file has been extracted intact and that is to open it. Therefore the verification stage of the recovery involved large scale sampling of the data to confirm the quality of the recovery. Sample screen shots were produced (contact sheets for photographs and first page preview thumbnails for documents) and forwarded to the client along with a full file listing of all data recovered. This analysis report also invited the client to request extra screen shots showing any files that were particularly critical to them. This verification stage is a time consuming but essential part of data retrieval.

The client decided to purchase an external hard drive from us on which to have the recovered data returned to him and opted not to have the recovered data encrypted as it was not sensitive (we don’t charge anything extra for encryption it just makes accessing the recovered data a little simpler if it is not encrypted and so many people opt not to encrypt).

The total turn around time in this instance from us receiving the defective drive in the lab to us dispatching by courier the recovered data back to the client was 48 hours.

We also of course kept our copy of both the clone and the extracted data for 10 days after shipment just in case there were any problems.

We believe that the way in which this recovery job was carried out (and all the others that we carry out every day) demonstrates why we are among the most successful data recovery services.