Disk Diagnostics

Accurately assessing the state of a hard drive and finding the exact points of damage will determine the approach taken to successfully complete the data acquisition.

Table of contents

• Why initial diagnosis is important
• Diagnose hard drives that cannot be recognized
• Start with Automatic Checkup
• Examine media surface and head status with Media Scan
• Current Monitoring
• Diagnose hard drives with multiple malfunctions
• Frequently Asked Questions

Why initial diagnosis is important

With traditional forensic tools you never really know the true state of the media you work with. This means that most data acquisitions are based on an assumption that everything is fine.

This approach works most of the time, until you have a case where the hard drive just stops working in the middle of an imaging session, and after a few hours of poking around you have to conclude: that evidence drive is dead.

Atola Insight Forensic is the only commercially available tool that can automatically diagnose a hard drive and pinpoint the exact failure (if any), and suggest the best course of action.

The tool automatically diagnoses hard disk electronics, motor, heads, media surface, firmware, and even file systems, and provides a clean and easy to read report.

Sample reports

Good drive

Damaged drive

Diagnose hard drives that cannot be recognized

Atola Insight Forensic is able to accurately diagnose hard drives that cannot be recognized or identified by any system including the vast majority of disk imaging, data recovery, and data acquisition products, even the most sophisticated ones. In cases where Atola Insight cannot recognize the hard drive, it can still diagnose the drive by sensing the SATA PHY status, sending low-level, vendor-specific commands into the HDD, and interpreting electrical currents.

Here's how this works: Atola Insight applies power to the hard drive and immediately starts sampling its startup currents. Then, comparing the startup currents to the internal database it can detect a specific failure.

Virtually any defect can be successfully diagnosed using this approach: head stack failure, motor damage, electronic board damage, etc. Since the method relies solely on start-up currents and nothing else, the hard drive does not have to be operational for successful diagnosis.

Start with Automatic Checkup

Atola Insight's automatic diagnostics function evaluates the state of the hard drive, identifies specific errors and then recommends steps for moving forward with HDD recovery and data extraction. This is the starting point for all data recovery or acquisition cases. The operator simply plugs the damaged hard drive into the DiskSense unit and clicks a single button to start the automatic checkup. Real-time status updates are displayed throughout the diagnosis and a full diagnostic report is then generated in less than 5 minutes.

This engine identifies damage in the following areas:

• Circuit Board (PCB)
• Motor
• Heads (status of each head is displayed)
• Media Surface
• Firmware Area
• Partitions and File System

Examine media surface and head status with Media Scan

Atola Insight's Media Scan function displays read-speed for any range of sectors in both milliseconds and megabytes per second. This information enables the operator to assess damaged sectors and read/write heads by analyzing read delays. The color-coded graphic display lists the current read speed, average speed throughout the scan, and number of read errors found (updated in real time). The scan can be set to read sectors in linear (forward) order or backward order. Additionally, a "Fast Scan" mode is available, which reads small select areas throughout the entire media to save time.

Examples:

The Media Scan #1 screenshot shows a drive with degraded Head 6.

Media Scan #2 screenshot shows a pattern of severe read delays and several unreadable sectors. This specific type of pattern strongly indicates head failure, where blocks being read by some heads show no delays and blocks being read by other heads are unreadable or show significant delays.

Note: Atola Insight is also able to identify head damage through its Automatic Checkup function.

Current Monitoring

Atola Insight comes equipped with a Dual Oscilloscope that monitors the 5 volt and 12 volt currents being drawn by the hard drive in real time. This feature gives the operator the ability to track the electrical behavior of the hard drive throughout the entire data recovery process. Any major changes or inconsistencies can then be identified as soon as they occur. This tool is very important to data recovery technicians for the same reason that a heart-rate monitor is important to medical doctors. When a patient is in unstable condition, the doctor must be able to keep track of the patient's vital signs and know immediately if a complication occurs.

Diagnose hard drives with multiple malfunctions

In data recovery, it is quite common for a hard drive to have multiple issues. In some cases, Atola Insight will identify multiple failures at once. In others cases, only one failure will show up during the first diagnosis and further issues will become visible as the recovery process goes on.

For example, if a hard drive has experienced failure in both the PCB and firmware area, only the damage in the PCB will be identified at first because the PCB is needed to relay electrical signals from the hard drive in order to detect firmware damage. Once the PCB is repaired, the HDD will need to be diagnosed a second time in order to identify the damage to the firmware area.

Frequently Asked Questions