Selective Head Imaging
The value of imaging head-by-head
A hard drive with a damaged read/write head requires special imaging approach. This is because the sectors in the range of the damaged head will be much more difficult to read than the rest of the data. Trying to read sectors with a damaged head adds a lot of time to the process and can cause more damage to the hard drive.
Using the Atola Insight Forensic, technician can identify the damaged read/write head and then adjust the imaging approach to start by reading from good heads and then going back to the damaged heads.
Imaging with selected heads
First, the technician must be able to identify damage to the headstack and pinpoint which specific heads are damaged. Atola Insight Forensic offers the following methods for identifying this type of damage:
1) The Automatic Diagnostic function tests the headstack and reports which specific head is damaged.
2) The Media Scan function scans the surface and displays the results in a clear, user-friendly format. This allows the user to diagnose the hard drive directly by looking for certain patterns. The Media Scan screenshot on this page shows a hard drive with a damaged head.
Head problem detected in Media Scan
Select heads for imaging
Once damaged head is identified, the operator would open up the Imaging tab and specify which heads have to be skipped during imaging.
Whenever head failure happens during imaging, the Atola Insight software informs the operator about the issue so that the failing head can be disabled immediately before more damage is done.
Head selection in Imaging
Avoid the need to swap heads
Physical head swap is always a challenge. Certain hard drive designs make the process extremely complicated, and in some cases, donor parts can be very difficult or even impossible to acquire. Whatever the case, physical recovery cases can be time consuming and expensive, and being able to image head-by-head can often save a technician the need to attempt a head swap.
The ability to image by specific heads gives forensic investigators using the Atola Insight a significant technical advantage.
Imaging by heads
Frequently Asked Questions
1. What are the benefits from using by-head imaging approach?
When a hard drive has a failing head, in most cases a technician would have to perform a head swap, which is a time consuming, expensive, and risky task. With the ability to image data off selected heads, it is possible to quickly obtain large percentage of data without even opening the hard drive.
2. Sometimes hard drives have seemingly random numbers assigned to each head (example; 0, 1, 4, 5). Does the Insight list the hard drive manufacturer head numbers?
Yes, the Atola Insight Forensic will assign head numbers in accordance with the head numbering scheme used by the manufacturer.
3. Is it ever worth trying to read from a damaged head?
In most cases, yes. A technician’s success reading from a damaged head varies depending on the nature and severity of the damage. Sometimes, it will be able to read sectors if timeouts and retries are increased, and sometimes it will not be able to read any sectors at all.
4. What hard drives are supported?
Imaging head-by-head works for most hard drives. For more specific information, please refer to the Supported Drives List