Imaging drives with damaged heads

Diagnose first

The built-in Automatic Checkup module of Atola Insight Forensic automatically checks all major subsystems of the evidence drive: circuit board, heads, media surface, firmware and file system.

To run diagnostics, in the sidebar, go to Diagnostics > Automatic Checkup and click Start.

A diagnostics report provides detailed information about the heads. In addition, it offers recommendations for the optimal imaging strategy for your damaged hard drive.

If an Automatic Checkup report indicates that there is a problem with the heads, look at the status of each head.

Head problem found during Diagnostics.

If the status of a head or multiple heads is Degraded or Damaged, the drive will not be able to read all the data. What’s worse, even more sectors may soon become unavailable due to incorrect functioning of the drive’s hardware.

Image good heads

We recommend that you start by imaging the heads, whose status is OK, as soon as possible. To do that:

1. In the sidebar, go to Imaging and click the Create New Session link.
2. Choose the target device or file and click Select.
3. On the Start new imaging session screen, find the Heads section and unselect the damaged head.
4. Click Start Imaging.

Unselect degraded head.

As a result, you get as much data from the drive’s viable heads as possible before even beginning to work with the damaged head. This way the risk of losing data on the working part of the head stack is minimized.

Imaging result with 3 good heads.

Now that this data has been successfully retrieved, you have two options:

• To have the head stack replaced before imaging the remaining data. However, there is a risk that as a result of head stack replacement, data on the drive can become unreadable.
• To attempt imaging data from the Degraded or Damaged head.

Image damaged or degraded heads

Insight’s sophisticated functionality lets users retrieve maximum data even from severely damaged drives. To image damaged or degraded heads, do the following:

1. In the sidebar, go to Imaging and click the Create New Session link.
2. Choose the target device or file and click Select.
3. On the Start new imaging session screen, go to the Heads line, unselect all the working heads and leave only the Degraded/Damaged one(s).
4. Click Start Imaging.

Unselect 3 working heads.

Imaging degraded head.

Now that you have an image of the source evidence including the data copied from the damaged head, you can take the risk and get the head stack fixed. Afterward, you can start a new session to complete the initially created image with data from previously unreadable sectors.