Imaging freezing damaged drives
When Atola Insight Forensic performs imaging, it can succeed even with the drives that freeze.
Why do damaged drives freeze?
When a drive receives and runs a Read sectors command, and comes across a physically or logically damaged sector, the device is unable to read any data from that sector. So it goes into Retry mode, trying to get data from the damaged area again and again.
However, often the drive is unable to read data from the damaged sectors, and the Retry mode can last for a very long time before the drive decides to give up on a particular sector and return an error with a timeout.
How does Insight handle freezing drives?
If Insight simply waited for each Read sectors command to be completed:
- it would take ages to get an image of a drive with numerous errors;
- it could cause the drive to slip into complete freeze;
- in the worst-case scenario, further damage could be caused to the data on the drive.
The Reset command
To avoid causing further damage to the data on the drive and long waiting periods, Insight issues the Reset command whenever a drive attempts to read a block of sectors for longer than allowed by the pre-configured timeout.
Reset is a device interface operation, using which Insight (the host) stops the previously sent Read sectors (or any other) command and then continues imaging from the next planned block on the drive.
If the device is still running the Read Sectors command, even after the first Reset attempt, Insight will wait 3 seconds and perform the second Reset command. At the moment of the second Reset, a new entry will appear in the imaging Log reading
Power cycle due to the source device falling into freeze.
Performing a power cycle
If 20 seconds after the second Reset, the drive still tries to read the bad block, Insight performs a Power cycle by forcibly cutting power to the drive for 5 seconds.
At this point, Insight adds two entries to the imaging Log:
After a successful power cycle
If the first Power cycle command is successful, and the drive becomes ready to receive another command, there will be a final log entry for this problematic block of sectors saying:
And then Insight continues imaging from the next planned block.
After an unsuccessful power cycle
If the first Power cycle command is ineffective, and the drive is still in a Busy state and can’t run another command, Insight makes one or more additional power cycles.
In Insight’s default settings, the Max consecutive Power Cycles option is set to five. If all five Power cycles are unsuccessful, imaging is terminated. It can be resumed afterward, and Insight will continue to image all remaining sectors.
While users can change the default maximum numbers of Resets and Power cycles, this number is based on our decades-long experience and balances the need for data retrieving with the risk of further data loss.
Features with the ‘until power cycle’ option
If prior to imaging you apply the Change Max Address temporarily (until power cycle) option, the Power cycles performed in the course of imaging do not affect it. The Host Protected Area remains accessible throughout the imaging process. Insight temporarily removes the HPA max address restriction after each imaging-related Power cycle.
The same is true for the Reset Password until power cycle option. Insight keeps the password reset throughout the imaging process, without regard to the applied Power cycles.
