Imaging a shorted hard drive
Every once in a while forensic examiners come across hard drives that get shorted. In most cases, a drive has become shorted after experiencing overvoltage either due to a power supply failure or as a result of a user error. Here is what happens to drive in these scenarios and how to fix this.
How drives become shorted
Most drives have two TVS diodes: one on the 5V rail and another one on the 12V rail.
If a drive experiences an overvoltage, its diodes convert the excess electrical power into heat energy and warm up, thus protecting the drive's circuit. Similarly, in the case of reverse polarity, the diode warms up as it conducts the current in the opposite direction.
If the overvoltage or reverse polarity event is short and the dissipated energy is not too high, the diodes can recover and continue working. However, if the dissipated energy is too high, the diodes will "sacrifice" themselves and get shorted.
When the drive is subsequently powered, the shorted diodes create a low-resistance connection between two nodes, known as a short circuit. This is exactly what happens to a drive when its TVS diodes are shorted.
Detect a shorted drive
If you try to connect a shorted drive to Atola Insight Forensic, the Source window will have a short circuit alert to notify the operator about the detected issue.
Short circuit alert.
A drive with a shorted TVS diode cannot be identified or imaged. You can try to run diagnostics on the drive, although it cannot be properly diagnosed and the report will suggest that the TVS diodes should be replaced.
Diagnostics report of a shorted drive.
Image a shorted drive
If you need to image a shorted drive but do not have new TVS diodes on hand to replace the shorted ones, you can image the drive using Insight after removing the diodes.
This process is safe because Insight has short circuit and overvoltage protection, which guards both the imager and the drives connected to it against circuit failures.
To remove the diodes, heat the area of the drive where they are located with a hot fan (such as in a hot air soldering station) and then gently remove them with tweezers.
Once the diodes have been detached, you can plug the drive into Insight and proceed with imaging data from its platters.
Imaging a drive with detached TVS diodes.
