Bad Sector Recovery

With Atola Insight Forensic, you can always create an image of a damaged drive having bad sectors.

Hard drives are designed to never return unreliable data. It means that if a drive cannot guarantee 100 percent accuracy of the requested data, it will simply return an error and will not give away any data at all.

This page explains how bad sector recovery actually works and why it needs to be done with great caution.

Table of contents

Understanding bad sectors

General causes of bad sector formation are physical or magnetic corruption. Physical corruption is easy to understand: it occurs when there is physical damage done to the media surface. Magnetic corruption occurs when a hard drive miswrites data to a wrong location. While the latter may seem to be less damaging, it is actually as dangerous as physical damage, since miswritten data may damage not only adjacent sectors but also servo sectors.

Hard disk drive sector structure

Regardless of the cause of damage, there are several possible outcomes:

What is common in all these types of corruption is that your operating system or normal data recovery tools cannot read the data from those sectors anymore.

Let's find out what exactly happens when a tool tries to read a sector that has one of the above mentioned problems.

Address Mark corruption

When Address Mark is corrupted, the hard drive simply cannot find the requested sector. The data might still be intact, but there is no way for the hard drive to locate it without the proper ID. Some modern hard drives do not actually use sector ID or Address Mark in the sector itself. Instead, this information is encoded in the preceding servo sectors.

Data corruption

To verify data integrity, a hard drive will always validate it with the Error Checking and Correction algorithm using the ECC code written after the data field (see above diagram). When data is corrupted, the hard drive will try to recover it with the same ECC algorithm. If correction succeeds, the drive will return the sector data and will not report any error. However, if correction fails, the drive will only return an error and no data, even if the data is partially intact.

ECC field corruption

Although this is rare, the ECC code can also get corrupted. In this case, the drive reads perfectly good data from the sector and checks its integrity against the ECC code. The check fails due to the bad ECC code, and the drive returns an error and no data at all, because there is no way to verify data integrity.

Servo sector corruption

There are up to a few hundred servo sectors on a single track. Servo sectors contain positioning information that allows the hard drive to fine-tune the exact position of the head so that it stays precisely on track. They also contain the ID of the track itself.

Servo sectors are used for head positioning in the same way a GPS receiver uses satellites to identify current location. When a servo sector is damaged, the hard drive can no longer ensure that the data sectors that follow the servo sector, are the ones it is looking for and will abort any read attempt of the corresponding sectors.

How bad sector recovery works

Once again, hard drives are built to never return data that did not pass integrity checks.

However, it is possible to send a command to the hard drive that specifically instructs it to disable error checking and correction algorithms while reading data. The command is called Read Long. It was introduced into ATA/ATAPI standard since its first release back in 1994. It allowed reading the raw data + ECC field from a sector and returning it to the host PC as is, without any error checking or correction attempt. The command was dropped from the ATA/ATAPI-4 standard in 1998. However, most hard drive manufacturers kept supporting it.

Later on, when hard drives became larger in capacity and LBA48 was introduced to accommodate drives larger than 128 GiB, the command was officially revived in a SMART extension called SMART Command Transport or SCT.

Since the drive does not have to verify the integrity of data when the data is requested via the Read Long command, it would return the data even if it is inconsistent (or, in other words, the sector is "Bad"). Hence, this command quickly became standard in bad sector recovery.

There is also another approach based on the fact that some hard drives leave some data in the buffer when a bad sector is encountered. However, our tests have shown that chances of getting any valid data this way are exactly zero.

Debunking bad sector recovery

So to "recover" data from a bad sector, one would simply need to issue the Read Long command instead of the "normal" Read Sectors command. That is really it! It is so simple that any software developer who is familiar with hard drives can do it. And sure enough, more and more data recovery tools now come with a Bad Sector Recovery option. In fact, if a tool does not have a bad sector recovery feature, it automatically falls into a second-grade category.

Error checking and correction algorithms were implemented for a reason, which is data integrity. When a hard drive reads a sector with the Read Long command, it disables these algorithms and hence there is no way to prove that you get valid data. Instead, you get something, which may or may not resemble your customer's data.

Tests in our lab had shown that this approach allows you to get much more random bytes than anything else. Yes, there are cases where this approach allows recovering original data from a sector. But these cases are extremely rare in real data recovery scenarios, and even then, only a part of the recovered sector will contain valid data.

Even if we get some data from the damaged sector, what exactly should we do with its other (garbled) part? And how exactly do we tell which part of the sector has real data in it and which is just random bytes? Nobody is going to manually go through all the sectors in a HEX editor, judge which bit is valid and which is not. Even if someone did, there is no way to guarantee that what they see is valid data.

And this is where the real problem starts.

Dangers of Read Long approach

Imagine a forensic investigator recovering data off a suspect's drive while the drive has some bad sectors on it. To get more data off the drive, the investigator enabled Bad Sector Recovery option in his data acquisition tool. In the end, his tool happily reported that all the sectors were successfully copied, so he began extracting data from the obtained copy.

While looking for clues, he found a file that had social security numbers in it. He then used these numbers in one way or another for his investigation.

What he did not know was that one of the sectors that contained these numbers, got recovered via the Read Long command, and some bits were flipped (which is very common for this approach). So instead of 777-677-766, he got 776-676-677, and that caused him and other people a lot of unnecessary trouble.

Another example: when recovering a damaged file system, even slightly altered data in an MFT record can mislead the file recovery algorithm and in the end do much more harm than if there was no data copied at all in that sector.

Once again, an error checking and correction algorithm is in place for a great reason. There is absolutely no magic in bad sector recovery. It is impossible to recover something that just isn't there.

There are tools that claim better bad sector recovery. But they utilize a statistical approach, an algorithm where the tool reads the bad sector a number of times and then reconstructs the "original" sector by locating the bits that occur most often in the sector. While these tools claim this approach could improve the outcome, there is no evidence to back up the validity of such claims. Furthermore, re-reading the same spot many times while the hard drive is failing is a reliable way to cause permanent damage to the media or heads.

So what about Atola Insight Forensic?

Like all high-end data recovery tools, Atola Insight Forensic supports bad sector recovery via the Read Long approach.

ReadLong command in the imaging settings

ReadLong command in the imaging settings

However, we are one important step ahead of competition: the locations of recovered sectors are automatically stored in the case management database. After imaging is complete, Atola Insight automatically marks all files that contain sectors recovered with the Read Long command.

This way, the operator has the ability to disregard such "unreliable" files and manually verify file integrity if it is an important one.

Once again, if you are after valid data, avoid using any bad sector recovery algorithms. These algorithms will never offer data integrity no matter how complex their implementation is. If you absolutely must recover data from bad sectors, make sure you use a tool that properly accounts for these recovered sectors.

We always advise our customers to avoid using bad sector recovery option until absolutely required. In Atola Insight, you can always create an image without bad sector recovery. First, try recovering files, and, if unsatisfactory, go back to Imaging and improve the image by enabling new options, including bad sector recovery, and running the imager only on bad sectors.

For testing and research needs, Atola Insight Forenic allows to generate bad sectors.

When it comes to bad sector recovery, make sure your digital forensics data recovery tool offers this level of flexibility.