Imaging damaged hard drives

Features to handle damaged drives

To handle damaged drives in the most gentle and thorough way, TaskForce 2 includes these features:

• Multi-pass imaging with different timeouts for each pass.
• Automated handling of freezing damaged drives.
• Imaging data from good heads only.
• Imaging in reverse direction.
• Disable read look-ahead mode.
• Simultaneous hash calculation.
• Calculation of segmented hashes.
• Read block size management.
• Tracking changes in drive's health using SMART table.
• Programmable behavior and even more fine-tuning for the toughest cases.
• Short circuit protection.
• Automatically generated detailed report with unread sectors.

See following sections for details on each feature.

Imaging damaged drives.

Multi-pass imaging with different timeouts for each pass

Multi-pass imaging uses large blocks with short timeouts on the first few passes, scheduling reads inside slow areas for later. And then using the smallest block size on the last pass when fewer sectors are left to be read.

This technique helps achieve maximum imaging speeds in good areas of the drive. At the same time, it allows approaching bad areas in the most delicate way possible and retrieving as much data as possible.

Automated handling of freezing drive

Often a damaged drive is unable to read data from the damaged sectors and goes into a long-lasting retry mode before it gives up on a particular sector and returns an error.

To avoid causing further damage to the data on the drive and long waiting periods, TaskForce 2 issues a reset command whenever a drive attempts to read a block of sectors longer than allowed by the pre-configured timeout. And later Atola hard drive imaging hardware continues retrieving data from the next planned block on the drive.

If retry mode last despite two reset commands, TaskForce 2 will perform power cycle command by forcibly cutting power to the drive for 5 seconds. And then will continue imaging from the next planned block. If the second power cycle does not help either, imaging will be terminated.

Imaging data from good heads only

If the diagnostics report shows that a part of drive’s head stack is damaged, TaskForce 2 lets you to select good heads only to be imaged during an imaging session. This function helps avoid further damage to the healthy parts of the drive by disabling the damaged head.

Disabling the damaged head in the imaging settings.

Imaging in reverse direction

With this function selected, TaskForce 2 will approach skipped areas of the drive from the other side on any selected pass.

This way, the imaging module can retrieve more data from a drive before entering a damaged zone, which needs to be focused on during the following passes.

Disable read look-ahead mode

Most contemporary hard drives have read look-ahead functionality, which makes the drive read more blocks sequentially than requested by software.

In good drives, this functionality helps the drive operate faster by reading more data and caching it.

But with bad drives, read look-ahead leads to bad areas being addressed more often. This slows down the process and may lead to a complete freeze of the drive. In such cases, disabling read look-ahead option is advisable.

Simultaneous hash calculation

With bad drives, the fewer times you read data on them, the longer they will last. This can be critical for ensuring that the drive is preserved in a working condition longer.

It is therefore advisable that when imaging a damaged drive, hash calculation is done simultaneously with imaging. This way, TaskForce 2 only reads the data on the drive once.

Segmented hashing

When dealing with a damaged hard drive, we strongly recommend using segmented hashing. This method supports multi-pass imaging and handling of bad sectors and provides better resiliency against data corruption.

Read block size management

Block sizes and timeouts for each source drive read operation are adjustable. The default settings of the passes are optimized based on our vast experience in data recovery market to fit most problematic hard drives and other types of storage media. Therefore, it is advisable to follow them, unless a particular drive requires specific settings.

Tracking changes in drive's health using SMART table

Each hard drive has a SMART table that gives information about its health. The worse the values in the SMART table, the more carefully the drive needs to be treated.

To evaluate how quickly a bad drive’s condition is getting worse, a user of TaskForce 2 can track critical changes in drive’s health.

To do that, TaskForce 2 can compare the SMART table before and after imaging and highlight any differences.

Short circuit protection

TaskForce 2 is equipped with short circuit protection, which prevents impact on both the system and the drives connected to it. For a detailed explanation of how we suggest working with such drives, see Imaging a shorted hard drive

Settings for imaging damaged hard drives

TaskForce 2 has two presets called Default and Damaged, recommended for good and faulty drives respectively.

The Damaged preset for imaging faulty drives.

To approach bad drives in the most gentle way possible, TaskForce 2 uses its special multi-pass imaging system.

To thoroughly retrieve maximum data from an unstable drive in a forensically sound way with a minimal downtime, the preset for damaged hard drives has several major differences from default imaging settings:

• Number of passes: 5 passes for damaged drives instead of 1 pass for good drives.
• Different timeouts for each pass: 1 second on the first pass, 5 seconds on the second, third, and fourth passes, and 60 seconds on the last fifth pass.
• Jump on errors: from 1,000,000 sectors on the first pass to only 1 sector jump on the last pass.
• Different read block sizes for each pass: 4,096 on the first, second, and third passes, 256 for the fourth and fifth passes.
• Segmented hashing with 4 GB segments instead of linear hashing used by default for good drives.